Draft: draft-rescorla-mls-architecture

Commentary: A few minor edits to ( hopefully ) improve readability , and a few comments in square braces ( [ ] ) . 
 < img width="1671 " alt="yikes " src="https://user-"Something looks wrong with your text editor ... ;) 
 Arg ! Will fix , sorry about this .
This document specifies version 1.0 of the Messaging Layer Security
(MLS) protocol.  MLS allows group messaging for a large number of
clients over a network with the help of a delivery service for
messages, and potentially an authentication service to provide long
term identity keys, in a way that is designed to prevent
eavesdropping, tampering, and message forgery.
End-to-end security is a requirement for instant messaging systems
and is commonly deployed in many such systems designed over the past
few years.  In this context, what end-to-end means is that the users
of the system enjoy some level of security - with the precise level
depending on the system design - even when the messaging service they
are using misbehaves.
This document specifies version 1.0 of the Messaging Layer Security
(MLS) protocol.  MLS allows group messaging for a large number of
networked clients by providing a delivery service for messages, and
potentially an authentication service, in a way that is designed to
prevent eavesdropping, tampering, and message forgery.
End-to-end security is a requirement for instant messaging systems
and is commonly deployed in many such systems.  In this context,
"end-to-end" captures the notion that users of the system enjoy some
level of security - with the precise level depending on the system
design - even when the messaging service they are using performs
unsatisfactorily.
A Group using a Messaging Service (MS) is a set of participants
called Members where each Member is typically expected to own
multiple devices called Clients.  In order to communicate securely,
Group Members first use services at their disposal to obtain
necessary secrets and credentials required for security.
An Authentication Service (AS) which is responsible for
maintaining user long term identities, issuing credentials which
allow them to authenticate to each other, and potentially
distributing user signing keying material.
A Delivery Service (DS) which is responsible for receiving and
redistributing messages between group members.  In the case of
group messaging, the delivery service may also be responsible for
acting as an "exploder" where the sender sends a single message to
a group which is then forwarded to each recipient in the group.
The DS is also responsible to store and deliver initial public
keying material required to proceed with the group secret key
establishment process.
In many systems, the AS and the DS are actually operated by the same
entity and may even be the same server.  However, they are logically
distinct and, in other systems, may be operated by different entities
so we show them as separate here.  Other partitions are also
possible, such as having a separate directory server.
Alice, Bob, and Charlie create accounts with a messaging service
and obtain credentials from the AS.
Alice, Bob, and Charlie authenticate to the DS and store some
initial keying material which can be used to encrypt to them for
the first time.
When Alice wants to send a message to Bob and Charlie, she
contacts the DS and looks up their initial keying material.  She
uses those keys to establish a new set of keys which she can use
to send to Bob and Charlie.  She then sends the encrypted
message(s) to the DS, which forwards them to the ultimate
recipients.
Roles: Clients in groups (and by extension Members) have equal rights
for managing groups and sending messages, unless specified otherwise
outside the protocol, typically at the application layer.
In MLS a Group is defined as a set of Members who possibly use
multiple endpoint devices to interact with the Messaging Service.
Only endpoints that are not an AS nor a DS are called Clients.  These
clients will typically correspond to end-user devices such as phones,
web clients or other devices running MLS.
A Group using a Messaging Service (MS) comprises a set of
participants called Members where each Member is typically expected
to own multiple devices, called Clients.  In order to communicate
securely, Group Members initially use services at their disposal to
obtain the necessary secrets and credentials required for security.
An Authentication Service (AS) which is responsible for
maintaining user long term identities, issuing credentials which
allow them to authenticate to each other, and potentially
distributing user signing keys.
In many systems, the AS and the DS are actually operated by the same
entity and may even be the same server.  However, they are logically
distinct and, in other systems, may be operated by different
entities, hence we show them as being separate here.  Other
partitions are also possible, such as having a separate directory
server.
Alice, Bob and Charlie create accounts with a messaging service
and obtain credentials from the AS.
Alice, Bob and Charlie authenticate to the DS and store some
initial keying material which can be used to send encrypted
messages to them for the first time.
When Alice wants to send a message to Bob and Charlie, she
contacts the DS and looks up their initial keying material.  She
uses these keys to establish a new set of keys which she can use
to send encrypted messages to Bob and Charlie.  She then sends the
encrypted message(s) to the DS, which forwards them to the
recipients.
In MLS a Group is defined as a set of Members who possibly use
multiple endpoint devices to interact with the Messaging Service.
Only endpoints that are not an AS or a DS are called Clients.  These
clients will typically correspond to end-user devices such as phones,
web clients or other devices running MLS.
Each member device owns a long term identity key pair that uniquely
defines its identity to other Members of the Group.  As single end-
user may operate multiple devices simultaneously (e.g., a desktop and
a phone) or sequentially (e.g., replacing one phone with another),
hence the formal definition of a Group in MLS is the set of Clients
that has legitimate knowledge of the shared (Encryption) Group Key
established throughout the group key establishment phase of the
protocol.
Each member device owns a long term identity key pair that uniquely
defines its identity to other Members of the Group.  As single end-
user may operate multiple devices simultaneously (e.g., a desktop and
a phone) or sequentially (e.g., replacing one phone with another),
hence the formal definition of a Group in MLS is the set of Clients
that has legitimate knowledge of the shared (Encryption) Group Key
established in the group key establishment phase of the protocol.