Re: [MLS] recruiting reviewers: mls-architecture

[Dave Cridland <[e-mail]>]

On Wed, 19 Sep 2018 at 16:12, Sean Turner <[e-mail]> wrote:

> mls-protocol:
> https://github.com/mlswg/mls-protocol
>
> So let’s get this party started!
>
>
Further partying:

The third para of "Terminology" seems to have a truncated sentence, perhaps
just a missing period after "head of the subtree" here: "A subtree of a
tree is the tree given by the descendants of any node, the head of the
subtree The size of a tree or subtree [...]"

"Merkle Proofs" says that a proof is "the value of the leaf node, as well
as the values of each node in its copath". The ASCII-art diagram shows the
proof for A as being B and CD, yet I read the quoted portion as meaning it
should include A as well. Either I am being daft (possible) or the
ASCII-art diagram also mark A with an asterisk.

"Ratchet Trees for ART" doesn't appear to have a definition of the DH()
notation. I assume it's the DH operation as defined in the ciphersuites
section.

When discussing the ciphersuite "ART with P-256 and SHA-256", the document
appears to suggest that the identity KDF is "non-trivial" - is that right?
Or is it saying that the overall KDF is non-trivial? Or that it is trivial,
but it doesn't matter?

When discussing Blank Ratchet Tree Nodes, it's not clear (to me) whether
nodes always remains blank, or if subsequent Adds might revive them into
real values. So with a trivial tree:

  AB
 /   \
A    B

Removing B leads to

 A
 / \
A   _

Does adding C then lead to

  AC
 /  \
A    C

?

I will try to find the time to knock out a toy implementation of (probably)
ART, which might uncover other issues (but might simply remind everyone why
I should never write cryptographic code).

Dave.