Draft: draft-ietf-mls-architecture

Commentary: Comment by A user with multiple devices becomes a member of the group multiple times . This implies that group members can detect which of the user 's clients was used for a specific message . Can this property be eliminated or at least reduced in the possible cases ( eg if the user 's devices are all online , could these work together to hide the information from which device / client the user sent the message ? eg by always picking one of them to relay ? ) 
 Correct . Even if a client does n't send a message , the rest of the group can see the set of devices a user has ( assuming the application provides a correlator , e.g. , a user ID in the credential ) . This was discussed in the WG , and the feeling was that it was possible to work around it by having a user 's devices sync across themselves so that they appeared as a single virtual client . ( You could even use an MLS group for this ! ) It would take some effort to make it work well ( e.g. , having a lock to avoid simultaneous sends with the same generation ) . But it seemed possible enough that we could assume it was n't an MLS problem .
When the same user uses multiple clients, it may be possible for
other members of a group to recognize all of those clients as
belonging to the same user.  For example, all of a user's clients
might present credentials authenticating the user's identity.  This
association among devices might be considered a leak of private
information.  An application that wishes to mitigate this privacy
risk has a couple of options.
This risk only arises when the leaf nodes for the clients in question
provide data that can be used to correlate the clients.  So one way
to mitigate this risk is by only doing device-level authentication
within MLS.  If user-level authentication is still desirable, the
application would have to be provide it through some other mechanism.
It is also possible to maintain user-level authentication while
hiding information about the clients that a user uses.  This can be
done by having the clients share cryptographic state, so that they
appear as a single client within the MLS group.  The application
would need to provide a synchronization mechanism so that the
clients' state remained consistent across changes to the MLS group.
When the same user uses multiple clients, it may be possible for
other members of a group to recognize all of those clients as
belonging to the same user.  For example, all of a user's clients
might present credentials authenticating the user's identity.  This
association among devices might be considered a leak of private
information.  The remainder of this section describes several
approaches for addressing this.
This risk only arises when the leaf nodes for the clients in question
provide data that can be used to correlate the clients.  So one way
to mitigate this risk is by only doing client-level authentication
within MLS.  If user-level authentication is still desirable, the
application would have to be provide it through some other mechanism.
It is also possible to maintain user-level authentication while
hiding information about the clients that a user owns.  This can be
done by having the clients share cryptographic state, so that they
appear as a single client within the MLS group.  The application
would need to provide a synchronization mechanism so that the
clients' state remained consistent across changes to the MLS group.