[MLS] Malicious user segmenting the group

[Jon Toohill <[e-mail]>]

Hey MLS folks,

I'm still skimming through the mailing list archives to get up to speed, so
apologies if this has already been discussed & solved. I saw the following
note in a recent version of the protocol draft:

[[ OPEN ISSUE: It is not possible for the recipient of a handshake message
> to verify that ratchet tree information in the message is accurate, because
> each node can only compute the secret and private key for nodes in its
> direct path. This creates the possibility that a malicious participant
> could cause a denial of service by sending a handshake message with invalid
> values for public keys in the ratchet tree. ]]
>

It seems like this could be solved by having the handshake message sender
prove in zero knowledge (i.e. without revealing their secret or the parent
secret) that they derived the parent public key correctly. ZK-SNARKs are
one way of doing that, but my admittedly weak understanding is that
generating proofs might be too computationally expensive for mobile
devices. Does this seem like a worthwhile direction to investigate? Does
anyone know of a more efficient construction that could be used in MLS?

-Jon Toohill