[MLS] Removing redundant ciphertexts in commits

[Jost Daniel <[e-mail]>]

Hi all,

When working on our analysis of the standard with Joël Alwen and Marta Mularczyk, we noted some inefficiencies around commit messages.

According to our understanding of the draft, UpdatePath contains encryptions for newly added group members. More concretely, the draft states "If populating the path field: Create a UpdatePath using the new tree (which includes any new members)" and in Section 7.7 "The number of ciphertexts in the encrypted_path_secret vector MUST be equal to the length of the resolution of the corresponding copath node." However, at this point, the resolution will already contain the freshly added leaves via the unmerged_leaves list.

First, this wastes bandwidth and computation as the commit message is not intended to be received by parties being welcomed. Second, this poses an, albeit small, additional attack scenario where an attacker gets hold of the freshly added party's decryption key but not the welcome message (that may have been communicated over a secure out-of-band channel).

One potential solution would be to explicitly exclude freshly added parties from the resolution in that step, at the cost of some additional book-keeping. Of course we are open to suggestions if anybody has a better idea. If not, we are obviously happy to draft a PR.

Best,
Daniel