[MLS] Encryption vs Masking for the sender information

[Benjamin Beurdouche <[e-mail]>]

> On May 2, 2019, at 10:02 AM, Karthikeyan Bhargavan <[e-mail]> wrote:
> 
> Looking at: https://github.com/mlswg/mls-protocol/pull/155
> 
> I see that there is a change in metadata encryption:
> 
>>      "sample = ciphertext[:Hash.length]
>> 	mask = HMAC(sender_data_secret, sample)[:8]
>> 	encrypted_sender_data = sender_data ^ mask
>> 	~~~~~
>> 	
>> 	This approach is similar to the one used for protection of header
>> 	information in QUIC (see Section 5.4 of {{?I-D.ietf-quic-tls}}).
>> 	Note that the sender data values are authenticated by the AEAD
>> 	and the signature, while the masked_sender_data is not and only
>> 	benefit from passive security because it depends on the ciphertext
> 
> I disagree with this change, because it is too early to put in optimizations,
> especially those that rely on non-standard cryptographic constructions.
> I would prefer that we go back to using plain AEAD for the sender_data,
> and that we add this kind of optimization once we have a proof that it is secure.

Using AEAD was in my original PR (#131), but multiple PRs have been
opened and merged together over the last few weeks leading to this state.
I have operationnal control over #155 right now and it is not merged, so
I would be completely fine with going back to use AEAD for now as it
provides better protection against active adversaries anyway...

B.