[MLS] Stupidest possible message protection

[Richard Barnes <[e-mail]>]

Hey all,

As we discussed in Bangkok, there are trade-offs between encrypting
handshake messages and enabling the delivery service to assist with
scaling.

One way to try to split this baby would be to try to evaluate what
information the server needs in order to provide its assistance, and leave
that unencrypted.  This solution would of course require that we convince
ourselves that the unencrypted bits are actually not sensitive, and would
entail a fair bit of complexity in the encryption system.

Another, simpler, approach we could take is to punt the decision to the
application.  We would define in the document two options:

1. Send Handshake messages in the clear
2. Send Handshake messages encrypted as Application messages

(And specify details like how you do Welcome+Add, how you disambiguate
Handshake from other Application messages.)  But we would not specify which
of those paths a given application would do.

What do folks think about that idea?  Personally, I find it kind of
appealing in its simplicity, though I acknowledge it adds another variable
for interop testing / interop failure.  And if you want to make an MLS API,
it's another switch to support.

Cheers,
--RIchard