[MLS] Exporters

[Richard Barnes <[e-mail]>]

Hi Benjamin,

(Note: MLS list CC'ed)

Thanks for filing a PR starting work on defining an exporter for MLS [1].
In addition to the specific comments there, I wanted to raise some general
questions here on the mailing list.

Basically, what I'm wondering is at what point it makes sense to export
stuff from MLS -- effectively, what the "API" of an MLS epoch is.  It seems
like there are a couple of approaches you could take here:

1. "Group secret" -- For each epoch, MLS provides:
  - An authenticated list of (identity, signing key) pairs for members in
the group
  - A secret known to the members of the group

2. "Sender secrets" -- For each epoch, MLS provides the following for each
member of the group:
  - An authenticated identity
  - A symmetric key that the participant uses to send messages
  - A signing key

#1 is lower-level, and thus more flexible, but requires the application to
arrange things like per-sender keys.  #2 is closer to application
semantics, but makes life unnecessarily difficult for applications that
just need one key for the whole group.

Personally, I'm inclined toward a "#1+", in the following sense: We define
the exporter as the main way applications access key material, but since we
need a message protection scheme for handshake messages, we also define an
application that uses that scheme to send application data.  Which is maybe
just a fancy way of saying, "remove the `app_secret` and derive it from the
exporter".

If we can come to agreement on the right shape here, it would be good to
update the architecture document to reflect it.  In addition to making the
documents a bit clearer, I think we'd end up with more consistency in MLS
libraries.

--Richard

[1] https://github.com/mlswg/mls-protocol/pull/198