Draft: draft-ietf-mls-protocol

Commentary: This PR updates the procedures for Add and Remove to remove double - joins . The cost is a potential increase in the size of GroupOperation messages in the case of incomplete trees . Depends on 
 Ok with
Paragraph (version B):
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 RFC2119 RFC8174 when, and only when, they appear in all capitals,
as shown here.
Paragraph (version A):
To enforce forward secrecy and post-compromise security of messages,
each participant periodically updates its leaf secret which
represents its contribution to the group secret.  Any member of the
group can send an Update at any time by generating fresh leaf secret
and keys and send an Update message that describes how to update the
group secret with that new information.  Once all participants have
processed this message, the group's secrets will be unknown to an
attacker that had compromised the sender's prior leaf secret.
Paragraph (version A):
A _subtree_ of a tree is the tree given by the descendants of any
node, the _head_ of the subtree The _size_ of a tree or subtree is
the number of leaf nodes it contains.  For a given parent node, its
_left subtree_ is the subtree with its left child as head
(respectively _right subtree_).
Paragraph (version A):
The _direct path_ of a root is the empty list, and of any other node
is the concatenation of that node with the direct path of its parent.
The _copath_ of a node is the list of siblings of nodes in its direct
path, excluding the root, which has no sibling.  The _frontier_ of a
tree is the list of heads of the maximal full subtrees of the tree,
ordered from left to right.
Paragraph (version A):
To perform an update, the sender transmits a node by sending the
public key for the node and an encrypted version of the secret value
for the node.  The secret value is encrypted in such a way that it
can be decrypted only by holders of the private key for one of its
children, namely the child that is not in the direct path being
transmitted.  That is, each node in the direct path is encrypted for
holders of the private key for a node in the corresponding copath.
For leaf nodes, no encrypted secret is transmitted.
Paragraph (version B):
The secret value is encrypted for the subtree corresponding to the
node's non-updated child, i.e., the child not on the direct path.
There is one encrypted secret for each public key in the resolution
of the non-updated child.  In particular, for the leaf node, there
are no encrypted secrets, since a leaf node has no children.
Paragraph (version A):
The length of the "node\_secrets" vector MUST be zero for the first
node in the path and one for all other nodes in the path.
Paragraph (version B):
The length of the "node\_secrets" vector MUST be zero for the first
node in the path.  For the remaining elements in the vector, the
number of ciphertexts in the "node\_secrets" vector MUST be equal to
the length of the resolution of the corresponding copath node.  Each
ciphertext in the list is the encryption to the corresponding node in
the resolution.
Paragraph (version A):
Decryption is performed in the corresponding way, using the private
key of the non-updated child and the ephemeral public key transmitted
in the message.
Paragraph (version B):
Decryption is performed in the corresponding way, using the private
key of the resolution node and the ephemeral public key transmitted
in the message.
Paragraph (version A):
The init_keys array MUST have the same length as the cipher_suites
array, and each entry in the init_keys array MUST be a public key for
the DH group or KEM defined by the corresponding entry in the
cipher_suites array.
Paragraph (version A):
The generated leaf secret is placed in the "leaf_secret" field of the
Welcome message.  The direct path and the UserInitKey are placed
their respective fields in the Add message.
Paragraph (version B):
A group member generates this message by requesting a UserInitKey
from the directory for the user to be added, and encoding it into an
Add message.
Paragraph (version B):
The update secret resulting from this change is an all-zero octet
string of length Hash.length.
Paragraph (version A):
The update secret resulting from this change is the secret for the
root node of the ratchet tree after both updates.