Draft: draft-rescorla-mls-architecture

Commentary: More subtle changes and TODOs .
Each member device owns a long term identity key pair that uniquely
defines its identity to other Members of the Group.  As single end-
user may operate multiple devices simultaneously (e.g., a desktop and
a phone) or sequentially (e.g., replacing one phone with another),
the formal definition of a Group in MLS is the set of Clients that
has legitimate knowledge of the shared (Encryption) Group Key
established in the group key establishment phase of the protocol.
Each member device owns a long term identity key pair that uniquely
defines its identity to other Members of the Group.  [[TODO: Probably
we can rewrite all occurrences of "member device" to "Client", or
leave all-but-one to indicate the relation.]] Because a single Member
may operate multiple devices simultaneously (e.g., a desktop and a
phone) or sequentially (e.g., replacing one phone with another), the
formal definition of a Group in MLS is the set of Clients that has
legitimate knowledge of the shared (Encryption) Group Key established
in the group key establishment phase of the protocol.
In general, MLS only provides limited protection against compromised
Clients.  If the Client is compromised, then the attacker will
obviously be able to decrypt any messages for groups in which the
Client is a member.  It will also be able to send messages
impersonating the Client.
Forward security and Post-compromise security fs-and-pcs.
MLS provides Forward security and Post-compromise security fs-and-
pcs.
Clients should not be able to send messages to groups.  which
appear to be from other Clients message-secrecy-authentication.
Clients should not be able to perform trivial denial of service
attacks denial-of-service.
A new device can join the group and will be considered as a new
Client by the protocol.  Hence this Client will not gain access to
the history even if it is owned by someone who is already a Member of
the Group.  Restoring history is typically not allowed at the
protocol level but applications may elect to provide such a mechanism
outside of MLS.
MLS provides additional protection regarding secrecy of past messages
and future messages.  These cryptographic security properties are
Perfect Forward Secrecy (PFS) and Post-Compromise Security (PCS).
PFS ensures that access to all encrypted traffic history combined
with an access to all current keying material on clients will not
defeat the secrecy properties of messages older than the oldest key
of the client.  Note that this means that clients have the extremely
important role of deleting appropriate keys as soon as they have been
used with the expected message, otherwise the secrecy of the messages
and the security for MLS is considerably weakened.
MLS provides additional protection regarding secrecy of past messages
and future messages.  These cryptographic security properties are
Perfect Forward Secrecy (PFS) and Post-Compromise Security (PCS).
PFS ensures that access to all encrypted traffic history combined
with an access to all current keying material on clients will not
defeat the secrecy properties of messages older than the oldest key
of the client.  Note that this means that clients have the extremely
important role of deleting appropriate keys as soon as they have been
used with the expected message, otherwise the secrecy of the messages
and the security for MLS is considerably weakened.