Draft: draft-ietf-mls-protocol

Commentary: The public key in a credential is introduced without a special name and the field in the BasicCredential is currently called public_key , which is not very expressive . A few paragraphs below , it is referenced as " Identity Key " or simply " Identity " , which is a bit misleading , as Credentials are supposed to contain an additional " identity " which is not the key . I propose we clear up the terminology a bit here and refer to the public key contained in a Credential as " Signature Key " .
Paragraph (version A):
A long-term identity key provider which allows clients to
authenticate protocol messages in a group.
Paragraph (version B):
A long-term signature key provider which allows clients to
authenticate protocol messages in a group.
Paragraph (version A):
A KeyPackage object specifies a ciphersuite that the client supports,
as well as providing a public key that others can use for key
agreement.  The client's identity key can be updated throughout the
lifetime of the group by sending a new KeyPackage with a new
identity; the new identity MUST be validated by the authentication
service.
Paragraph (version B):
A KeyPackage object specifies a ciphersuite that the client supports,
as well as providing a public key that others can use for key
agreement.  The client's signature key can be updated throughout the
lifetime of the group by sending a new KeyPackage with a new
signature key; the new signature key MUST be validated by the
authentication service.
Paragraph (version A):
The value for hpke_init_key MUST be a public key for the asymmetric
encryption scheme defined by cipher_suite.  The whole structure is
signed using the client's identity key.  A KeyPackage object with an
invalid signature field MUST be considered malformed.  The input to
the signature computation comprises all of the fields except for the
signature field.
Paragraph (version B):
The value for hpke_init_key MUST be a public key for the asymmetric
encryption scheme defined by cipher_suite.  The whole structure is
signed using the client's signature key.  A KeyPackage object with an
invalid signature field MUST be considered malformed.  The input to
the signature computation comprises all of the fields except for the
signature field.
Paragraph (version A):
Note that the long-term identity keys used by the protocol MUST be
distributed by an "honest" authentication service for clients to
authenticate their legitimate peers.
Paragraph (version B):
Note that the long-term signature keys used by the protocol MUST be
distributed by an "honest" authentication service for clients to
authenticate their legitimate peers.
Paragraph (version A):
The second form considers authentication with respect to the sender,
meaning the group members can verify that a message originated from a
particular member of the group.  This property is provided by digital
signatures on the messages under identity keys.
Paragraph (version B):
The second form considers authentication with respect to the sender,
meaning the group members can verify that a message originated from a
particular member of the group.  This property is provided by digital
signatures on the messages under signature keys.