Re: [MLS] multiple devices per user?

[Jon Millican <[e-mail]>]

I should mention that this third option – at least in the context of MLS – is currently something of a half-baked idea. It’s an approach that should work in a hypothetical ART-based protocol, but we haven’t dug into it enough to figure out whether it will fit into the proposed constraints for MLS.

On 24/03/2018, 23:08, "Jon Millican" <[e-mail]<mailto:[e-mail]>> wrote:

I’d like to second Ekr’s points here. To provide a concrete use case, in Facebook Messenger, we want Secret Conversations to work for a user as soon as they log in on a new device. This somewhat blurs the boundary between device loss/recovery and concurrent use as it is used for both situations; but we don’t want to require existing device to authorise new devices as – to be perfectly frank – we’re not convinced that most people would actually do this, and it puts a potential usability barrier in the way of people using the E2E mode. While Wire is fully E2E, I believe that they similarly allow logging into a new device without any interaction with old devices. As far as I’m aware, neither service synchronises decryption keys between devices, and we instead just treat each new device as effectively a new group participant.

However there is a third option that we alluded to in the ART paper, that sits somewhere between your options 0 and 1.

2) Give each user as a separate ART subtree. The leaves of the group thread tree would then simply be the roots of each user’s subtree. You can then use this to mask the number of devices each user has, but without synchronising their private key material. The same algorithms would apply to the subtrees, so we’d get FS and PCS with respect to each device – including when they’re added and removed.

This option could be quite flexible, so you could then make a number of the design choices discussed application-specific. E.g. if you want to require new devices on an account to be enrolled by others, then you can do this without surfacing any warnings. Otherwise you could choose to notify that the user’s leaf changed: or even the full list of each user’s devices if you wished.

Jon

On 24/03/2018, 22:43, "MLS on behalf of Eric Rescorla" <[e-mail]<mailto:[e-mail]> on behalf of [e-mail]<mailto:[e-mail]>> wrote:



On Sat, Mar 24, 2018 at 10:32 PM, Daniel Kahn Gillmor <[e-mail]<mailto:[e-mail]>> wrote:
In the BoF at IETF 101, I expressed my concern about the way that
multiple devices fits in the architectural requirements.  I'm repeating
those concerns on-list here in the hopes of raising on-list discussion,
and trying to flesh them out here in more detail.

I see two use cases that might come under the "multi-device" rubric:

 a) device loss/recovery

 b) actual concurrent use (e.g. laptop + desktop + mobile)

i'll focus here mainly on (b), since i think (a) is a distinct
situation.

Privacy Considerations
----------------------

It's not clear to me that any user has a situation where they *want* to
indicate to other users of the group which device they're using.

Really? Because this kind of status reporting is actually a reasonably common
feature of IM systems.


Security Considerations
-----------------------

When the user has multiple devices, there are two possible approaches:

 0) sharing decryption-capable keys across devices (peers see a single
    key for each user)

 1) distinct per-device decryption-capable keys (peers see multiple keys
    per user)

One potential argument is that option (1) might provide
"transparency" -- or visibility of a key change in the event of an
adversary who tries to change the keys of a client.  but i don't think
this argument works.

The reason for #1 isn't transparency, it's that there are use cases in
which users want to add a new device without an existing device being
online, and these are incompatible with type #0 designs.



Furthermore, it's not clear what a group conversation participant can
*do*, security-wise, in the event of recieving such a message from
another participant -- is this actually a new phone, or is it a wiretap
injection?  should i ask the user about it?  should i take action?  what
ction?

Generally, I wouldn't expect them to take any action at all. It's a user's
responsibility to ensure that the right number of devices are registered
to their account, just as its common for the number of Web browsers
one has attached to ones Gmail account.


To avoid UX warning fatigue, i'm wary about introducing more of these
events than are strictly necessary (scenario (a) above probably
represents a "necessary" event, sadly, but "i just got a new phone"
doesn't seem necessary).

And finally, we presumably want any sort of device change to be
authorized from an already-known device for the same user.

This was not in fact my assumption, for the reason indicated above

-Ekr