Re: [MLS] Short review of MLS drafts from the OTRv4 group

[Sofia <[e-mail]>]

Hi, Raphel et al,

> The will is definitely there to allow deniability in MLS. However since that
> property is quite divisive, the current status quo is that it should be optional.
> In practical terms, *some* deniability could be achieved by distributing the
> message signing keys through a deniable channel (similar to how the sender keys
> concept works). In a way this puts deniability “out of scope” in the sense
> that the distribution of signing keys is not in the charter. To my knowledge,
> there is no other substantial proposal on how deniability could be achieved,
> but it would be great to hear more from you on that subject!

Mmm... are those MAC keys for message authentication or something else?
Well, it depends in the kind of deniability you want to attain and how "strong"
it will be. I've been re-reading some of the papers of the deniability properties
for a group chat setting. I'll send the ideas and concepts :) I hope that
is useful. Maybe that can be an starting point for a discussion..

Thanks!

--
Sofía Celi (aka cherenkov)
@claucece / @cherenkov_d
Cryptographic research and implementation at CAD: https://autonomia.digital/
EF74 1A5F 5692 E56F 14F6  243C 3992 6144 F89D 996F