Re: [MLS] RT array implementation motivation

[Tijana Klimovic <[e-mail]>]

Hello,

Thank you for your answers to the question about RT. I do have some more
questions about the choice of framing if you don't mind me asking. I tried
to find answers to them in the group but didn't have much luck.

Namely, in the MLSPlaintext structure, you have the membership_tag included
that MACs everything above it in the MLSPlaintext structure with the
membership_key. I don't see how the framing is any less secure without it
being there, since the signature covers everything above itself, hence only
not including the two mac tags.

Furthermore, it's not clear to me which membership_key is used to construct
it in case of commit messages. I would think that it would be the
membership_key deduced from the GroupContext for the new epoch, after the
proposals and UpdatePath have been applied so that joiners can compute the
epoch_secret. Is this correct?

Lastly, I wanted to ask what is the purpose of having the parent_hash
extension?

As far as I understand, it only must be included in the leafKeyPackage of
the UpdatePath structure and it serves to bind the new HPKE public keys of
all nodes on the path from the leaf(committer) with the leafKeyPackage to
the root and the set of HPKE public keys to which PK's secret key was
encrypted. But the commit contains the confirmation_tag that confirms that
the members of the group have arrived at the same state of the group. So
the confirmation_tag would bind the same as the parent_hash and even more.

Many thanks.
Tijana

On Wed, 19 May 2021 at 15:25, Raphael Robert <[e-mail]> wrote:

> Hi Tijana,
>
> At the end of the day you can use whatever implementation works best of
> course. The array approach has a few benefits though:
>  - it’s language agnostic, something that’s important for IETF
>  - it gives you a serialisation format for free (quite practical for the
> ratchet tree extension)
>  - it let’s you use references to nodes in the tree that are used in the
> Secret Tree to derive secrets for example
>  - it makes it easy to add and remove nodes without having to change
> anything in neighbouring nodes
>
> From a performance standpoint, using the tree math provided should also be
> reasonably fast. If you have some benchmarks to share that prove otherwise,
> it would be interesting to look into it.
>
> Lastly, pointers can be great, but they can also be quite dangerous if
> implemented wrongly.
>
> Hope this helps,
>
> Raphael
>
> > On 19. May 2021, at 14:55, Tijana Klimovic <[e-mail]>
> wrote:
> >
> > Hello,
> >
> > I have only recently started to look into the MLS specification, and was
> wondering why the ratchet tree (RT) structure is chosen to be implemented
> with an array. From what I understand, the pointer-based tree where each
> node would contain the following information:
> >
> >         struct {
> >         Node* sibling;
> >         Node* parent;
> >         Node* left_child;
> >         Node* right_child;
> >         Optional<HPKEPublicEncKey> hpke_enc_pk;
> >         Optional<HPKESecretEncKey> hpke_enc_sk;
> >         Optional<Credential> credential;
> >         Optional<vector<byte>> parent_hash;
> >         Optional<vector<Node*>> unmerged_leaves;
> >         } Node
> >
> > would be more efficient than an array w.r.t. all operations supported by
> the RT.
> >
> > Many thanks.
> > Tijana
> > _______________________________________________
> > MLS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/mls
>
>