Re: [MLS] reusing HPKE keys from welcome messages

[Richard Barnes <[e-mail]>]

This seems like a reasonable trade-off in terms of performance.  There are
some mechanical issues to address because we use the same KeyPackage struct
for initialization and for leaves in the tree.  In particular, if we have
both "WelcomeKey" and "LeafKey" in the package, we probably don't want the
leaves to keep making new WelcomeKeys forever.

I think that's adequately addressed, though, by just putting the WelcomeKey
in an extension, and requiring that extension to be present in KeyPackages
used for initialization.

Alternatively, it seems like this issue could be papered over operationally
if a member updates on joining.  That would push the expense to join time
instead of KP generation time.  I don't think this is a great trade-off,
though, just wanted to document it.

--Richard


On Fri, Apr 17, 2020 at 3:48 AM Joel Alwen <[e-mail]> wrote:

> Hey Everyone,
>
> Sandro Coretti and I have a few suggestions. To keep threads on the list
> topic
> specific I'm putting the suggestions in separate emails so please excuse
> the
> spam. Here goes.
>
> Issue: HPKE Key Reuse
> Suppose Alice (commits to a proposal that) invites Bob to a group. For
> this she
> uses a Key Bundle for Bob with an HPKE pub key in it. That pub key has 2
> functions (and correct me if I'm wrong here). On the one it becomes the
> HPKE key
> in Bob's leaf in the new ratchet tree. On the other hand, the Welcome
> message to
> Bob is also encrypted to that HPKE key.
>
> Problem: Bob must keep around the corresponding HPKE secret until he
> updates or
> leaves the group. Thing is, that same HPKE sec key lets you reprocess that
> welcome message. Ergo, until he does an update we have no FS for all MLS
> epochs
> after his join. (See PS. at end of email for more.)
>
> Proposed Solution: Separate HPKE keys for welcome message and initial leaf
> key.
> E.g. Key Bundles registered on the Key Server have two HPKE keys. One for
> the
> welcome message only and the other used as new leaf's HPKE key. As soon as
> Bob
> processes the welcome message he deletes the HPKE key he used for it.
>
>
> Thoughts?
>
> - Joël & Sandro
>
>
>
> PS. For those familiar, this is basically a special case of the FS issues
> with
> TreeKEM we address with RTreeKEM in eprint/2019/1189. But normally attacks
> on
> the FS of some TreeKEM epoch msg still requires u to somehow know the
> previous
> epochs init_secret. Thats why, normally, FS attacks on TreeKEM "only"
> translate
> to PCFS attacks on MLS. But for the welcome message variant that's
> different.
> The whole point of the welcome message is to bootstrap from that one HPKE
> secret
> key all the way to full-state MLS (including current key schedule). So the
> attacker no longer needs an extra init_secret if they leak that one HPKE
> secret
> key. Thus, this goes from the usual PCFS attack for MLS to being a plain
> FS one.
>
> _______________________________________________
> MLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mls
>