Draft: draft-ietf-mls-architecture

Commentary: For the authors ' consideration : Section 3 A member with a valid credential authenticates its MLS messages by signing them with the s / its / it's/ mechanisms for a user to monitor and control which keys are associated to their identity . s / to their / with their/ Operational Requirements A extension can help maintain interoperability s / A extension / An extension/ Whether there should be a extension in groups . s / a extension / an extension/ 2 Forward and Post - Compromise Security MLS partially defend against this problem by active member including freshness , however not s / defend / defends/ s / member /   a key updates from clients that are not otherwise sending messages s / a key / key/ 1 Compromise of AEAD key material authentication is not affected in neither of these s / neither / either/ 2 Compromise of the Group Secrets of a single group for one or more group epochs of the compromised party with no ability to an honest group to recover message secrecy . s / to an / for an/ 3 Compromise by an active adversary with the ability to sign messages the attacker can perform all operations which are available to an legitimate client s / an legitmate / a legitimate/ 4 Compromise of the authentication with access to a signature key Beware that in both oracle and private key access , an active adaptive attacker , can follow th s / attacker , can / attacker can/ 5 Security consideration in the context of a full state compromise They also are providing the strong authentication guarantees to other clients s / providing the strong / providing strong/ hence we consider that their protection by additional security mechanism should be a priority . s / mechanism / mechanisms/ Overall there is no way to detect or prevent these compromise , as discussed s / compromise / compromises/ 1 Privacy of delivery and push notifications For secure messaging systems , push notification are often sent real - time s / notification / notifications/ 3 Authentication Service Compromise MLS client ( which is under the control of the user ) have often the ability s / have often / often have/ 
 Approved with nits . These changes look good to me .
In a system based on Key Transparency (KT) KeyTransparency, the
issuance function would correspond to the insertion of a key in a
KT log under a user's identity.  The verification function would
correspond to verifying a key's inclusion in the log for a claimed
identity, together with the KT log's mechanisms for a user to
monitor and control which keys are associated to their identity.
In a system based on Key Transparency (KT) KeyTransparency, the
issuance function would correspond to the insertion of a key in a
KT log under a user's identity.  The verification function would
correspond to verifying a key's inclusion in the log for a claimed
identity, together with the KT log's mechanisms for a user to
monitor and control which keys are associated with their identity.
MLS partially defend against this problem by active member including
freshness, however not much can be done on the inactive side
especially in the case where the client has not processed messages.
MLS partially defends against this problem by active members
including freshness, however not much can be done on the inactive
side especially in the case where the client has not processed
messages.
Note that under that compromise scenario, authentication is not
affected in neither of these cases.  As every member of the group can
compute the AEAD keys for all the chains (they have access to the
Group Secrets) in order to send and receive messages, the
authentication provided by the AEAD encryption layer of the common
framing mechanism is very weak.  Successful decryption of an AEAD
encrypted message only guarantees that a member of the group sent the
message.
Note that under that compromise scenario, authentication is not
affected in either of these cases.  As every member of the group can
compute the AEAD keys for all the chains (they have access to the
Group Secrets) in order to send and receive messages, the
authentication provided by the AEAD encryption layer of the common
framing mechanism is very weak.  Successful decryption of an AEAD
encrypted message only guarantees that a member of the group sent the
message.
If the adversary is active, the adversary can follow the protocol and
perform updates on behalf of the compromised party with no ability to
an honest group to recover message secrecy.  However, MLS provides
PCS against active adaptive attackers through its Remove group
operation.  This means that, as long as other members of the group
are honest, the protocol will guarantee message secrecy for all
messages exchanged in the epochs after the compromised party has been
removed.
If the adversary is active, the adversary can follow the protocol and
perform updates on behalf of the compromised party with no ability
for an honest group to recover message secrecy.  However, MLS
provides PCS against active adaptive attackers through its Remove
group operation.  This means that, as long as other members of the
group are honest, the protocol will guarantee message secrecy for all
messages exchanged in the epochs after the compromised party has been
removed.
Note that under this compromise scenario, the attacker can perform
all operations which are available to an legitimate client even
without access to the actual value of the signature key.
Note that under this compromise scenario, the attacker can perform
all operations which are available to a legitimate client even
without access to the actual value of the signature key.
Beware that in both oracle and private key access, an active adaptive
attacker, can follow the protocol and request to update its own
credential.  This in turn induces a signature key rotation which
could provide the attacker with part or the full value of the private
key depending on the architecture of the service provider.
Beware that in both oracle and private key access, an active adaptive
attacker can follow the protocol and request to update its own
credential.  This in turn induces a signature key rotation which
could provide the attacker with part or the full value of the private
key depending on the architecture of the service provider.
However, the signature private keys are mostly used by clients to
send a message.  They also are providing the strong authentication
guarantees to other clients, hence we consider that their protection
by additional security mechanism should be a priority.
Overall there is no way to detect or prevent these compromise, as
discussed in the previous sections, performing separation of the
application secret states can help recovery after compromise, this is
the case for signature keys but similar concern exists for the
encryption private key used in the TreeKEM Group Key Agreement.
However, the signature private keys are mostly used by clients to
send a message.  They also provide strong authentication guarantees
to other clients, hence we consider that their protection by
additional security mechanisms should be a priority.
Overall there is no way to detect or prevent these compromises, as
discussed in the previous sections, performing separation of the
application secret states can help recovery after compromise, this is
the case for signature keys but similar concern exists for the
encryption private key used in the TreeKEM Group Key Agreement.
For secure messaging systems, push notification are often sent real-
time as it is not acceptable to create artificial delays for message
retrieval.
For secure messaging systems, push notifications are often sent real-
time as it is not acceptable to create artificial delays for message
retrieval.
Infrastructures that provide cryptographic material or credentials in
place of the MLS client (which is under the control of the user) have
often the ability to use the associated secrets to perform operations
on behalf of the user, which is unacceptable in many situations.
Other mechanisms can be used to prevent this issue, such as the
service blessing cryptographic material used by an MLS client.
Infrastructures that provide cryptographic material or credentials in
place of the MLS client (which is under the control of the user)
often have the ability to use the associated secrets to perform
operations on behalf of the user, which is unacceptable in many
situations.  Other mechanisms can be used to prevent this issue, such
as the service blessing cryptographic material used by an MLS client.