[MLS] Message Protection

[Richard Barnes <[e-mail]>]

Hey all,

One of the things we kind of waved our hands about in the charter and
current protocol draft is message protection.  That is, the idea of
specifying a concrete syntax for using the keys we negotiate using MLS to
actually protect content.

This is a simpler problem than key exchange (since you've already
established a group key), but it still has some nuances that matter to the
overall security story, so it seems worth writing some things down:

- Content encapsulation (e.g., what nonces / AAD you use with AEAD)
- Key schedule, i.e., how message keys are derived from the group key
- ACK / NACK / replay
- Transcript integrity (?)
- Expiration times (?)

What's missing here?

As far as getting something done: My MLS bandwidth is probably going to be
consumed with the key exchange protocol.  Is there someone who would like
to take a stab at writing a message protection specification?  Either as a
new draft or as a section in the protocol draft.

Cheers,
--Richard