[MLS] draft-mahy-mls-group-anchors

Rohan Mahy <rohan.mahy@wire.com> Sun, 19 March 2023 18:29 UTC

Return-Path: <rohan.mahy@wire.com>
X-Original-To: mls@ietfa.amsl.com
Delivered-To: mls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5B07C151531 for <mls@ietfa.amsl.com>; Sun, 19 Mar 2023 11:29:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.095
X-Spam-Level:
X-Spam-Status: No, score=-2.095 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LbuUaB6Gj09J for <mls@ietfa.amsl.com>; Sun, 19 Mar 2023 11:29:09 -0700 (PDT)
Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F001C15152F for <mls@ietf.org>; Sun, 19 Mar 2023 11:29:09 -0700 (PDT)
Received: by mail-wm1-x335.google.com with SMTP id t17-20020a05600c451100b003edc906aeeaso696498wmo.1 for <mls@ietf.org>; Sun, 19 Mar 2023 11:29:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire.com; s=google; t=1679250548; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=30iGvsRE6WjxMa9VhHjtWymIOSznpKtgf8AzZp2GQVI=; b=aXllu5JKk+HytJ3eV5kvdnBEgtRZzC1nYGJ16D9rsvk9A2YngSU9Ap9zaq2b3I+Qr3 c68aQuPdFGM37dqC7Sbr91s7r5vvqJDZwIuwJ760lUkbxhbQ85VZMe9f5L3q5AiAheRL HY+3u40CZtWO4qfdjvAGCz915V3O6vpdJ8Xq4i4XbSOVP11eSqrPlWSmzNSlUjePcY9K eL4C+xG9OB6mVJILwKa5KKZw6djO1slX+1b6i2dO4s3wWA8f8PKGuB4Z7ESa546f62z6 pw/4Q6XhlxsNTwtuTTGNDNSa7+oKAcXkkV6qvbo6dwf/aZZEhmKIT+ZN+ox1gPLtL2CE TweA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1679250548; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=30iGvsRE6WjxMa9VhHjtWymIOSznpKtgf8AzZp2GQVI=; b=L4lKKzWJ1XKrYOZdoK1jA9pswgchKUg6GkMu7z2QlpfmpQGl8mW78NhFEMELLva2dx u6nlzObbxT1MZu6O+2IlKNvia3sOeAalKHW/2X++6mmJnLTCxnIW8v33U0WMohcD8B4x GMLO6FvUsTwWQKtQYdi371lF/Mkrc2CRgQI72PN3EUjPaoYuUdKUvALL/jTG4vWtt32H tqywkAnT7pllr6YNv3WfNICzr/CiT+VV9pfb6ZLkduaKUG4fP0F7XgcNC1aWgEG41GG9 LCnNgmF9mA4Rqc6btiE6xZFiEpkg5xe0bEb/uUH25nuLBnvno0SS09/fG9JkyogUSiYw iw5g==
X-Gm-Message-State: AO0yUKUliOuq8WU0vQinz/1jL1K8EsritenBy6+sJUmAWzQn6fWEq6vR vTKKu/oFLt0gMpB57MWZ2vqG2Y8Ek2waCssMqhJj6I5/1q/MTNkGcKw=
X-Google-Smtp-Source: AK7set8x0yMpaEqQpsCQ44wrxTWxSTrX2ncKeLoEQNl1pEEeXxBaGs4mntGHyLh5eru8cBDj/839nj4I1RWfF4Hs2HY=
X-Received: by 2002:a7b:c2b1:0:b0:3eb:5824:f0ee with SMTP id c17-20020a7bc2b1000000b003eb5824f0eemr8999579wmk.2.1679250547582; Sun, 19 Mar 2023 11:29:07 -0700 (PDT)
MIME-Version: 1.0
From: Rohan Mahy <rohan.mahy@wire.com>
Date: Sun, 19 Mar 2023 11:28:56 -0700
Message-ID: <CACW8--NVHgfatcA4QkZrRamkqqJcc2gviybpAaBfn6fhOcyPew@mail.gmail.com>
To: Messaging Layer Security WG <mls@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000060b9d005f744fcf0"
Archived-At: <https://mailarchive.ietf.org/arch/msg/mls/y10hGXCXHQHzkm4HdaUmaZjVNlU>
Subject: [MLS] draft-mahy-mls-group-anchors
X-BeenThere: mls@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Messaging Layer Security <mls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mls>, <mailto:mls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mls/>
List-Post: <mailto:mls@ietf.org>
List-Help: <mailto:mls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mls>, <mailto:mls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Mar 2023 18:29:13 -0000

Hi,
I wrote a very short draft, a proposed GroupContext extensions which allows
all the members in a (federated) group to coordinate and agree on the trust
anchors used for identity verification for each of the domains
participating in the group.

https://www.ietf.org/archive/id/draft-mahy-mls-group-anchors-00.html

The intention is to restrict the trust anchors on a per-domain basis. As
written, the domain of the subject of an X.509 identity certificate used in
a credential for a user of the group would need to be rooted in the
certificate listed for that domain in this GroupContext extension. That
would need to be either an already (OS/application) trusted root CA, or an
intermediary CA rooted in an already trusted root CA.

Marta suggested that we be able to use a certificate hash instead of the
full certificate (for the case when the certificate is a trusted root CA).
I think that is a great idea. However I could not find a reference to a
standard way of generating such a hash.

Richard suggested that with some additional mechanism, this extension could
also be used to distribute certificates, which are then verified using the
appropriate mechanism(s).

Your comments are welcome.

Thanks,
-rohan

*Rohan Mahy  *l  Vice President Engineering, Architecture

Chat: @rohan_wire on Wire



Wire <https://wire.com/en/download/> - Secure team messaging.

*Zeta Project Germany GmbH  *l  Rosenthaler Straße 40,
<https://maps.google.com/?q=Rosenthaler+Stra%C3%9Fe+40,%C2%A0+10178+Berlin,%C2%A0+Germany&entry=gmail&source=g>10178
Berlin,
<https://maps.google.com/?q=Rosenthaler+Stra%C3%9Fe+40,%C2%A0+10178+Berlin,%C2%A0+Germany&entry=gmail&source=g>
Germany
<https://maps.google.com/?q=Rosenthaler+Stra%C3%9Fe+40,%C2%A0+10178+Berlin,%C2%A0+Germany&entry=gmail&source=g>

Geschäftsführer/Managing Director: Alan Duric

HRB 149847 beim Handelsregister Charlottenburg, Berlin

VAT-ID DE288748675