Re: [MLS] Use Cases for avoiding Forward Secrecy

[Dave Cridland <[e-mail]>]

On 28 February 2018 at 21:16, Stephen Farrell <[e-mail]> wrote:
>
> Hiya,
>
> On 28/02/18 17:14, Dave Cridland wrote:
>> Given the latter, for example, I could not use an MLS-based system to
>> discuss a tax problem with the authority, and since I'm unlikely to
>> have a SAKKE-based messaging client, I'm unlikely to have encrypted
>> messaging to my tax authority at all - which seems signficantly worse
>> than merely having no Forward Secrecy.
>
> Sorry, why is transport layer security not sufficient between you
> and your tax authority?
>

Because it's not a single hop.

Supposing my tax authority uses XMPP, for example, and so has (in my
case) hmrc.gov.uk as an XMPP domain. I use some commercialish XMPP
provider. I don't want my provider to be able to read my tax messages,
nor do I want them archived in plaintext on the server (although I
probably do want a verifiable record). Meanwhile, HMRC wants to keep
an archived, but secured, copy at their end, viewable by their
organisation.

> I'm unclear as to why the security guarantees (aimed for) between
> groups of people ought be reduced in order to meet the goals of
> securing communications between a person and a service provider.
>

I'm not suggesting they should be.

I am suggesting that it might be nice if my options were not simply FS or FO.

(Besides which, the archives in a non-FS situation gain some security
guarantees, too).

> I do agree that it'd be good if a user of some application could
> add a new device and still see old messages, but I'm not at all
> clear that's that significant (for the crypto) since people will
> always need to have some kind of fallback to handle cases where
> they've lost state.

Assume a FS-only message transfer. In that case, how do we recover
missing messages? We have to transport those from another device that
has them. That's a perfectly reasonable concept, and one that has been
tried before in Skype. Unfortunately, as mobile devices replaced
desktop/laptop combinations as the dominant device, they switched away
from the design back to centrally-held archives since the clever
synchronisation options simply didn't work.

Of course, there are users who prefer the trade-off of higher security
and no (or limited) archives. Such users would, one hopes, be warned
about the change in security should they enter into a conversation
with someone who cannot (or will not) support FS.

Dave.