[MLS] Deniability without pairwise channels.

[Mathias Hall-Andersen <[e-mail]>]

Dear MLS group,

In MLS: since all group members share the same secret,
the application of an AEAD does not provide authentication within the group,
MLS mitigates this using sign-then-encrypt with a long-term signing key.

> [[ OPEN ISSUE: Signatures under the identity keys, while simple, have the side-effect of preclude deniability.
> We may wish to allow other options, such as (ii) a key chained off of the identity key,
> or (iii) some other key obtained through a different manner,
> such as a pairwise channel that provides deniability for the message contents.]]
>
> -- Section 12.2 Authentication

If deniability (without pairwise channels) is a desired feature in MLS,
has the group discussed the feasibility of applying a "sign & reveal" type scheme?
There are essentially two different options:

1. Short-term credentials:

Clients would generate temporary "credentials" pk_{temp} for the group,
by creating a certificate under their long term credential pk_{long term}:

S <- Sign(sk_{long term}, <Group Identifier, Expiry, pk_{temp}>)

Publish (S, pk_{temp}) to the group.

Then when sending messages apply sign-then-encrypt using the short-term credential:

S_{msg} <- Sign(sk_{term}, m)
c <- Seal(k, .., .., <S_{msg}, m>)

Later, e.g. in lock-step with updates to the ratchet tree,
the client publishes sk_{temp} to the group and generates a new short-term credential.


2. One-time credentials:

When sending messages apply sign-then-encrypt using a one-time credential:

S_{cert} <- Sign(sk_{long term}, <Group Identifier, Message Index, pk_{temp}>)
S_{msg} <- Sign(sk_{term}, m)

Then encrypt:

c <- Seal(k, .., .., <S_{cert}, S_{msg}, sk_{old}, m>)

Where k is the group key and sk_{old} is the sk_{temp} from the previous message.

Best Regards,
Mathias