[MLS] welcome_secret

[Chris Brzuska <[e-mail]>]

Hi all,

I think that the current derivation of the welcome_secret (used to 
encrypt the Group_Info) performs additional operations which are not 
needed, and its use is not optimal from a security perspective (and not 
necessary from an efficiency perspective). In the current version, we 
encrypt the joiner_secret (without PSK) and then derive the 
welcome_secret from the joiner-secret.

Case 1: If the welcome_secret is not derived from the PSK, then one can 
use the same symmetric-key for encrypting the Group_Info than for 
encrypting the Group_Secrets. There is no efficiency loss, since for all 
new members, the same symmetric key for encrypting the Group_Secrets is 
used. In the case that the welcome_secret does not depend on the PSK, it 
is not needed at all.

Disadvantage of this: The PSK does not protect the GroupInfo, as 
mentioned by Konrad.

Additional Disadvantage of current version: Performs additional 
unnecessary key derivations which do not add security/efficiency.

Case 2: If we want to make the welcome_secret depend on the PSK, we do 
not need to make it depend on the group_secrets. Making the 
welcome_secret depend on the group_secrets does not add any security. 
Instead, we only need to derive it from the PSK and the symmetric-key 
which was sent to all group members. In this case, it makes sense that 
both, the Group_Secrets and the Group_Info will be encrypted with the 
same key rather than different keys. In this case, both the 
Group_Secrets and the Group_Info will be protected by the combination of 
PSK knowledge and knowing the secret-key for the PKE.

Advantage of this: The PSK protects both the GroupInfo and the GroupSecrets.

Chris