Re: [MLS] Removing redundant ciphertexts in commits

[Joel Alwen <[e-mail]>]

So does anyone else see any reason for those ciphertexts? If not we can draft a
PR to get rid of them...

- Joël

On 21/09/2020 09:37, Jost Daniel wrote:
> Hi all,
> 
>  
> 
> When working on our analysis of the standard with Joël Alwen and Marta
> Mularczyk, we noted some inefficiencies around commit messages.
> 
>  
> 
> According to our understanding of the draft, UpdatePath contains encryptions for
> newly added group members. More concretely, the draft states "If populating the
> path field: Create a UpdatePath using the new tree (which includes any new
> members)" and in Section 7.7 "The number of ciphertexts in the
> encrypted_path_secret vector MUST be equal to the length of the resolution of
> the corresponding copath node." However, at this point, the resolution will
> already contain the freshly added leaves via the unmerged_leaves list.
> 
>  
> 
> First, this wastes bandwidth and computation as the commit message is not
> intended to be received by parties being welcomed. Second, this poses an, albeit
> small, additional attack scenario where an attacker gets hold of the freshly
> added party’s decryption key but not the welcome message (that may have been
> communicated over a secure out-of-band channel).
> 
>  
> 
> One potential solution would be to explicitly exclude freshly added parties from
> the resolution in that step, at the cost of some additional book-keeping. Of
> course we are open to suggestions if anybody has a better idea. If not, we are
> obviously happy to draft a PR.
> 
>  
> 
> Best,
> 
> Daniel
> 
> 
> _______________________________________________
> MLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mls
>