Re: [MLS] Use Cases for avoiding Forward Secrecy

Raphael Robert <> Wed, 28 February 2018 17:31 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id EAD1C12D880 for <>; Wed, 28 Feb 2018 09:31:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.935
X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id G3UlYllnO2CB for <>; Wed, 28 Feb 2018 09:31:30 -0800 (PST)
Received: from ( [IPv6:2a00:1450:400c:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 2356E1243FE for <>; Wed, 28 Feb 2018 09:31:30 -0800 (PST)
Received: by with SMTP id 188so6569478wme.1 for <>; Wed, 28 Feb 2018 09:31:30 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=xoYxmdjEvyy9JvBM+3Ur15QJYI2SwJW2qIBl/YxsWK4=; b=0QRwZcFPp7bP1o1h74DktJHYziFr/okZPa4B3S79aMuNbEYX4kbZp4adtvi1KcCVbE 3nLX9gpCnYE82au2K9uhcmGMmrkOvCj1ZY5ZDnFNMrVe+YHzC5BRy2X7AkWUgyzCNyKq gLkCOUt1BJ8A+ETr+X058WogGzS59ARog+bl0ejLzGj6a8gM7eoZa5RFFnjAuKiQwvtu u+X1O/vHqDFffhoG/2lehPvHqQOlFRQ3W3AVOgANk1pNTxzQmYkFuxmmcT+aXL6rc3K/ GxzAoqzg03OuL8SiNlSwkjSgN+7u6t/Eyy2IvxtPpzRgps3y8qrQp1AI9aL82umVQooz y7Yw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=xoYxmdjEvyy9JvBM+3Ur15QJYI2SwJW2qIBl/YxsWK4=; b=APyle/7Rrz6uO8lMkdM/gkVkG1liPa8U0FvhSJV6HGxRIcFiQ5vhI7jkWBOgbImo+u XRv9owULajncs1UGG2Tx0N7B5tvI1Jpi9bDRoZ97YRzsRxfyq+7cYxLuhYpU42j6hMsg PGnEpg7r4dqbr3HdpuJRhbwB4Umv0J1RdFqACBsHEkSECMl+INsfob717DCiBv7MgrJf JkBs9Gzy6/PInrrEKOxbSzNwF14PrxN7k07PCmQng8jDJ1n5tygHx978CXKzk/OUzyjY vMb/Gg9S950HD0twYCnbBGkPmVFqcxWJCCY3Qu7v4YZlFa4VWpTvxeijt6++WI90xs85 k0hw==
X-Gm-Message-State: APf1xPDmC6y9hd2PT44IKisyes7ytQYW7l8AmGelM42mjIJDitQdrdrM Z/yd/le0mBYh6S+/2RGM742aoyLEaFQ=
X-Google-Smtp-Source: AG47ELspdeYYINlZpYnzsr7h/8eGXDp1ckHPNTBLUF/D04rJx3EfsP1s1GzHE0eKXEkRF8zc+ZWULA==
X-Received: by with SMTP id b127mr13964347wme.105.1519839088015; Wed, 28 Feb 2018 09:31:28 -0800 (PST)
Received: from rmbp.wire.local ( []) by with ESMTPSA id g52sm4617109wra.20.2018. for <> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Feb 2018 09:31:26 -0800 (PST)
From: Raphael Robert <>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\))
Date: Wed, 28 Feb 2018 18:31:25 +0100
References: <>
In-Reply-To: <>
Message-Id: <>
X-Mailer: Apple Mail (2.3445.5.20)
Archived-At: <>
Subject: Re: [MLS] Use Cases for avoiding Forward Secrecy
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Messaging Layer Security <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 28 Feb 2018 17:31:32 -0000

Hi Dave,

Mandatory retention and UX are valid points of course. The scope of MLS is however to provide strong security guarantees like FS on the other hand. Re-using the same encryption key is something applications that use MLS can on the layer above the messaging protocol: the “application layer”. This would allow application developers to take that decision independently for the specific use cases they want to cater for.


> On 28 Feb 2018, at 18:14, Dave Cridland <> wrote:
> Hi folks,
> While I'm really pleased to see MLS, and I generally like the idea of
> Forward Secrecy, there's a couple of use cases where it might be worth
> avoiding. Feel free to correct me if these are in fact possible with
> Forward Secrecy. Both these relate to archival access to past
> messages:
> * UX - Some users (actually all of them) would like to be able to
> install client software on a new device and have their historical
> messages available to them. Most "business" messaging systems seem to
> work this way, as well as a number of consumer-grade systems. The
> nature of Forward Secrecy means that an archive would need to be held
> on one device and re-sent to another through the network, which is
> trickier to manage, and is reliant on multiple devices being online at
> overlapping times. Alternately, the archival copy might be re-uploaded
> to the server using a static encryption key, I suppose, which would
> rather spoil the point.
> * Retention - Many business and government deployments have mandatory
> retention requirements. An example is MIKEY-SAKKE, promoted in part by
> the UK Government for its own communications, which uses mandatory key
> escrow to keep an archived copy of the messages accessible to the
> business units involved. An advantage of the SAKKE system is that it
> allows the key escrow to be offline, limiting attack opportunities.
> Given the latter, for example, I could not use an MLS-based system to
> discuss a tax problem with the authority, and since I'm unlikely to
> have a SAKKE-based messaging client, I'm unlikely to have encrypted
> messaging to my tax authority at all - which seems signficantly worse
> than merely having no Forward Secrecy.
> None of this is to say that Forward Secrecy should be avoided
> entirely, of course.
> Dave.
> _______________________________________________
> MLS mailing list