Draft: draft-ietf-mls-protocol

Commentary: Signatures as specified in the MLS protocol document are ambiguous , in the sense that signatures produced for one purpose in the protocol can be ( maliciously ) used in a different place of the protocol . Indeed , we found that for example , a can have the same serialization as , which proves that one signature could be accepted for different structures . The collisions we have found so far are quite artificial , so it is not super clear how to exploit this , but at least it makes it impossible to have provable security . The solution is pretty simple , we simply prefix each signed value with a label , in a fashion similar to . That way , when calling you can give the structure name in the argument . 
 Something that is still bothering me is the structure : struct { select ( ) { case member : GroupContext context ; case preconfigured : case newmember : struct { } ; } WireFormat wireformat ; opaque groupid<0 .. 255 ; uint64 epoch ;  sender ; opaque authenticateddata<0 .. 2 ^ 32 - 1 ; ContentType contenttype ; select ( MLSPlaintextTBS.contenttype ) { case application : opaque applicationdata<0 .. 2 ^ 32 - 1 ; case proposal : Proposal proposal ; case commit : Commit commit ; } } MLSPlaintextTBS ; Since the first is done on a field defined after it , this structure is not parsable . We could say that 's not a problem since we only need to serialize it , but for security purposes I would recommend to put it at the end , like this : struct { WireFormat wireformat ; opaque groupid<0 .. 255 ; uint64 epoch ;  sender ; opaque authenticateddata<0 .. 2 ^ 32 - 1 ; ContentType contenttype ; select ( MLSPlaintextTBS.contenttype ) { case application : opaque applicationdata<0 .. 2 ^ 32 - 1 ; case proposal : Proposal proposal ; case commit : Commit commit ; } select ( ) { case member : GroupContext context ; case preconfigured : case newmember : struct { } ; } } MLSPlaintextTBS ; What do you think about it ? 
 Nice one ! Crafting collisions is probably not straightforward , but eliminating the the risk altogether is the way to go . 
 It is actually quite easy to craft collisions , I made a script do find them : ( I wanted to check whether there was accidentally a way do disambiguate the structures ) 
 Introduced in . 
 s currently have two usages in the spec : -published key packages that you can download and put in a leaf when adding a new member  content that you update when doing a full Currently , things have been designed to use only one structure for both uses , leading to some weirdness such as : and are useful in the usage 1 , but are parameters of the group in usage 2 . is a good name in usage 1 , but would better be named in usage 2 . some data is important in usage 2 and have no meaning in usage 1 , hence they were designed as " mandatory - when - updating extensions " ( such as , and we were also discussing about adding the in to help prevent cross - group attacks ) How about using different structures for these ? // Essentially identical to KeyPackage struct { ProtocolVersion version ; CipherSuite ciphersuite ; HPKEPublicKey hpkeinitkey ; opaque endpointid<0 .. 255 ; Credential credential ; Extension extensions<8 .. 2 ^ 32 - 1 ; opaque signature<0 .. 2 ^ 16 - 1 ; } PrePublishedKeyPackage ; struct { HPKEPublicKey hpkekey ; opaque endpointid<0 .. 255 ; Credential credential ; opaque parenthash<0 .. 255 ; opaque groupid<0 .. 255 ; Extension extensions<8 .. 2 ^ 32 - 1 ; opaque signature<0 .. 2 ^ 16 - 1 ; } LeafNodeContent ; enum { reserved(0 ) , prepublishedkeypackage(1 ) , leafnodecontent(2 ) , ( 255 ) } LeafNodeType ; struct LeafNode { // This is not included in the signature , but with the " unambiguous signature " PR that 's not a problem LeafNodeType type ; select ( ) { case prepublishedkeypackage : PrePublishedKeyPackage data ; case leafnode_content : LeafNodeContent data ; } } What would you think about refactoring like this ? 
 If we 're doing this , I 'd suggest including a dedicated public key to encrypt Welcome messages to for the . suggested this at some point . It gives us better FS guarantees , because the receiver of the can delete the corresponding private key immediately after decryption , while they might have to keep the other key around for a bit until they can actually issue an update . This might also help clarify . 
 Ties into as well because is an example of an extension that is required and should be a field instead 
 one concern I have is how is that field in created ? 
 When sending a full , the participant includes a new in the ( it replaces the field ) . It computes the signature with where : corresponds to all the fields of except ( the usual thing ) comes from 
 What about the scenario where  pulls down  's key package to add him to the group ? In that case  ca n't do the conversion between formats on  's behalf . 
  do n't have to do the conversion , this is why either contain a ( when adding someone to the group ) or a ( when updating your own key package ) . 
 Ah somehow I missed that part in your original post . Makes sense 
 I like this general direction . It solves a few things . Instead of having leaf nodes contain either a prepublished thing or a normal leaf node , how about having the prepublished thing wrap the leaf node thing ? As a bonus , we get separation between the key pair used for Welcome encryption and the key pair that goes in the leaf for TreeKEM . Then when  adds  , she extracts his LeafNodeContent and sends that in the Add . That does n't let the other members of the group verify that  did the right thing w.r.t .  , but I 'm not heartbroken about that . We might also be able to remove the extensions field from the outer ( KeyPackage ) wrapping if we turn the extension into KeyPackage field . I expect we probably need leaf extensions , but would be open to making into a field . 
 Why not keep sending the KeyPackage in the Add ? That would n't cost much and would allow everyone to validate the lifetime . Note , that the lifetime is crucial in achieving PCS for pre - published key material . If I compromise  and get hold of the private key material of a bunch of his KeyPackages , I can add "  " to any group I want as long as the Credential inside the LeafNodeContent remains valid and  does n't revoke the LeafNodeContent somehow . Also , we 'll have to do this if we want to enable any member to send the Welcome message as you proposed here : 
 I agree that including inside is quite clean , but something is bothering me with this approach : I 'd like that the is signed by the participant occupying that leaf , to protect against cross - group attacks . In the first message of this issue I did this by including in , but in fact we do n't need to store it in the leaf , we just need to include it in the . In any case , if we want to include in the signature , we need a way to differentiate between leaves that triggered a commit and the ones that are " fresh " . And for that I think using a tagged - union struct is the cleanest way to do it . 
 It always feels a bit lazy to use an extension ( and implementations have to be careful to check for their presence ) , but we could use a extension in the same way that we use a extension . You will find both of them only on LeafContents that were updated at least once . Another result of including  in the KeyPackage is that the signature will explicitly sign the and I 'm not sure if that does n't completely destroy any deniability guarantees we can still get from MLS . 
 I do n't think there 's really a good way to get the into the leaf . Because of prepublication , it would have to be optional , but in order to prevent attacks , you need rules to decide whether it 's required in a given situation . It seems like the best you can do is basically TOFU : When you first get the tree , you ca n't validate whether the groupid should be in a given leaf or not Once you 're a member , you require that groupid is sent in Update and UpdatePath.leafkey_package I could live with a solution of that character , but given it 's a bit complex , might prefer to leave it out unless we get a useful property from it . - Re : Sending KeyPackage in Add - Yep , that makes sense . So you would send KeyPackage in Add , and LeafNode in Update . 
 I tried to worked through what would be necessary to implement this . It looks like it would require some fairly invasive changes to be made to rationalize the document 's structure before making this change . But those changes should probably be made anyway . Proposal : Preparatory PR : Rationalize layout Move " Cryptograhic Objects " to before " Ratchet Trees " Update " Ratchet Tree Nodes " to define ParentNode and LeafNode structs , with LeafNode initially just equal to KeyPackage Move subsections of " Key Packages " to under " Ratchet Trees " Parent Hash Tree Hashes Update Paths Move Group State to its own top - level section Main PR : Change LeafNode to have the required content : HPKE key for TreeKEM Credential Parent hash Capabilities Extensions Signature Change KeyPackage to refer to LeafNode for internals , plus : HPKE key for Welcome Lifetime Extensions Signature Add continues to send KeyPackage Update and Commit send LeafNode instead of KeyPackage Remove and Sender refer to LeafNodeRef instead of KeyPackageRef We should probably do the preparatory PR regardless of this issue . 
 Discussion on working call : General agreement on the approach Should sign group_id when possible Include in TBS if we at least have a flag for pre - published / in - group Or we can store it Or we could have independent structs for pre - published / in - group leaves Do we need extensions at both levels ? Capabilities / lifetime should probably be promoted to fields 
 From what I can see , there is no reason not to sign the context in the case of an external init . I 'm not sure why it got taken out , but while implementing external inits , verification went through even when including the context . 
 As I commented in , it 's not even clear that we need this context any more for members any more , given for MLSPlaintext and the AEAD of MLSCiphertext . So I would propose we just remove the context to MLSPlaintextTBS altogether . IIRC you were the one that proposed adding the context .  ? 
 This was fixed in 
 Here 's the Weekly Digest for : - - Last week 9 issues were created . Of these , 6 issues have been closed and 3 issues are still open . : greenheart : , by : greenheart : , by : greenheart : , by : heart : , by : heart : , by : heart : , by : heart : , by : heart : , by : heart : , by : speaker : , by It received 2 comments . - - Last week , 13 pull requests were created , updated or merged . Last week , 3 pull requests were updated . : yellowheart : , by : yellowheart : , by : yellowheart : , by Last week , 10 pull requests were merged . : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by - - Last week there were 38 commits . : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by - - Last week there were 2 contributors . : bustinsilhouette : : bustin_silhouette : - - Last week there was 1 stargazer . : star : You are the star ! : star2 : - - Last week there were no releases . - - That 's all for last week , please < kbd : eyes : Watch</kbdand < kbd : star : Star</kbdthe repository to receive next weekly updates . : smiley : You can also . *
Paragraph (version B):
Here, the functions "Signature.Sign" and "Signature.Verify" are
defined by the signature algorithm.
Paragraph (version A):
The value for hpke_init_key MUST be a public key for the asymmetric
encryption scheme defined by cipher_suite.  The whole structure is
signed using the client's signature key.  A KeyPackage object with an
invalid signature field MUST be considered malformed.  The input to
the signature computation comprises all of the fields except for the
signature field.
Paragraph (version B):
The value for hpke_init_key MUST be a public key for the asymmetric
encryption scheme defined by cipher_suite.  The whole structure is
signed using the client's signature key.  A KeyPackage object with an
invalid signature field MUST be considered malformed.
Paragraph (version B):
The signature is computed by the function "SignWithLabel" with a
label "KeyPackage" and a content comprising of all of the fields
except for the signature field.
Paragraph (version A):
The "signature" field in an MLSPlaintext object is computed using the
signing private key corresponding to the public key, which was
authenticated by the credential at the leaf of the tree indicated by
the sender field.  The signature covers the plaintext metadata and
message content, which is all of MLSPlaintext except for the
"signature", the "confirmation_tag" and "membership_tag" fields.  If
the sender is a member of the group, the signature also covers the
GroupContext for the current epoch, so that signatures are specific
to a given group and epoch.
Paragraph (version B):
The "signature" field in an MLSPlaintext object is computed using the
signing private key corresponding to the public key, which was
authenticated by the credential at the leaf of the tree indicated by
the sender field.  The signature is computed using "SignWithLabel"
with label ""MLSPlaintextTBS"" and with a content that covers the
plaintext metadata and message content, which is all of MLSPlaintext
except for the "signature", the "confirmation_tag" and
"membership_tag" fields.  If the sender is a member of the group, the
content also covers the GroupContext for the current epoch, so that
signatures are specific to a given group and epoch.