[MLS] Key Schedule, ProposalOrRef objects, Group splitting attack

[Tijana Klimovic <[e-mail]>]

Hello,

I had a few questions about different parts of the specification.

Firstly, I wanted to ask about the motivation behind the Key Schedule being
what it is, namely a sequence alternating between KDF.Extract and
KDF.Expand. Why couldn't it be just a single KDF.Extract followed by a
single KDF.Expand, to form an actual key derivation function, and then
derive the different keys by providing the appropriate context?

Furthermore I am not sure why the KDF.Expand is used at all here since the
length parameter provided is KDF.Nh which from the specification is
supposed to be: "The value KDF.Nh is the size of an output from
KDF.Extract, in bytes". Therefore, the KDF Expands used by the scheme don't
really expand the pseudorandom key given by the KDF.Extract to have a
bigger length.

I am not sure why we use a ProposalOrRef type. And why only proposals sent
by the commiter are included by value and all others are hashes of the
MLSPlaintext containing proposals sent by members different from the
commiter.

Lastly, I haven't managed to find where the specification tackles the
problem of the group splitting attack. Namely, if we for example have a
group of 5 clients, the attacker can split the group state into two group
states, by making sure that any message (proposal, commit, application)
originating from client 1,2,3 is delivered to only client 1,2,3 only and
that similarily any message originating from clients 4,5 are only delivered
to clients 4,5.

Many thanks.
Tijana Klimovic