Re: [MLS] Stupidest possible message protection

On Sun, Dec 2, 2018 at 2:25 PM Richard Barnes <rlb@ipv.sx> wrote:
>
> Hey all,
>
> As we discussed in Bangkok, there are trade-offs between encrypting handshake messages and enabling the delivery service to assist with scaling.
>
> One way to try to split this baby would be to try to evaluate what information the server needs in order to provide its assistance, and leave that unencrypted.  This solution would of course require that we convince ourselves that the unencrypted bits are actually not sensitive, and would entail a fair bit of complexity in the encryption system.
>
> Another, simpler, approach we could take is to punt the decision to the application.  We would define in the document two options:
>
> 1. Send Handshake messages in the clear
> 2. Send Handshake messages encrypted as Application messages
>
> (And specify details like how you do Welcome+Add, how you disambiguate Handshake from other Application messages.)  But we would not specify which of those paths a given application would do.
>
> What do folks think about that idea?  Personally, I find it kind of appealing in its simplicity, though I acknowledge it adds another variable for interop testing / interop failure.  And if you want to make an MLS API, it's another switch to support.

Doesn't the server need to agree with the client how to do this? And
what about downgrade attacks?
>
> Cheers,
> --RIchard
>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls


-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.