Draft: draft-ietf-mls-protocol

Commentary: It seems like we have a few separable issues here : we require a single signature scheme for the whole group signature schemes are included in the ciphersuite we have an MTI ciphersuite / signature algorithm new ciphersuites should be defined , and what algorithms should go in them Let 's discuss this at the interim and maybe break this PR into a few bits 
 Note that specification required registries imply that there is a designated expert pool . I will add some text to create one . The text is very similar to the TLS DE pool text from with some tweaks that , hopefully , address the misunderstandings uncovered during non - standards track registry requests . Note the process is : ( assuming that the IESG eventually approves this draft ) When the IESG approves this draft , the responsible AD assigns some DEs ( like 2 - 3 suggested by the WG chairs ) . These DEs are in charge of all registrations regardless of whether the draft comes from the WG or elsewhere as all requests go to the MLS DEs mailing list . 
 Here 's the Weekly Digest for : - - Last week 3 issues were created . Of these , 0 issues have been closed and 3 issues are still open . : greenheart : , by : greenheart : , by : greenheart : , by : speaker : , by It received 1 comments . - - Last week , 7 pull requests were created , updated or merged . Last week , 2 pull requests were opened . : greenheart : , by : greenheart : , by Last week , 4 pull requests were updated . : yellowheart : , by : yellowheart : , by : yellowheart : , by : yellowheart : , by Last week , 1 pull request was merged . : purpleheart : , by - - Last week there were 3 commits . : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by - - Last week there were 2 contributors . : bustinsilhouette : : bustinsilhouette : - - Last week there were 2 stagazers . : star : : star : You all are the stars ! : star2 : - - Last week there were no releases . - - That 's all for last week , please < kbd : eyes : Watch</kbdand < kbd : star : Star</kbdthe repository to receive next weekly updates . : smiley : You can also . 
 Here 's the Weekly Digest for : - - Last week 3 issues were created . Of these , 0 issues have been closed and 3 issues are still open . : greenheart : , by : greenheart : , by : greenheart : , by - - Last week , 4 pull requests were created , updated or merged . Last week , 3 pull requests were updated . : yellowheart : , by : yellowheart : , by : yellowheart : , by Last week , 1 pull request was merged . : purpleheart : , by - - Last week there was 1 commit . : hammerandwrench : by - - Last week there was 1 contributor . : bustin_silhouette : - - Last week there were no stargazers . - - Last week there were no releases . - - That 's all for last week , please < kbd : eyes : Watch</kbdand < kbd : star : Star</kbdthe repository to receive next weekly updates . : smiley : You can also . 
 This seems to accurately reflect the consensus we had at the last interim , and there 's nothing I ca n't live with otherwise . I will probably file a follow - up to convert the Derive - Key - Pair operations to use HKDF directly , as discussed , avoiding the need for intermediate values or truncation of SHA-512 .
Paragraph (version A):
Given an octet string X, the private key produced by the Derive-Key-
Pair operation is SHA-256(X).  (Recall that any 32-octet string is a
valid Curve25519 private key.)  The corresponding public key is
X25519(SHA-256(X), 9).
Paragraph (version B):
Ciphersuites are represented with the CipherSuite type.  HPKE public
keys are opaque values in a format defined by the underlying Diffie-
Hellman protocol (see the Ciphersuites section of the HPKE
specification for more information).
Paragraph (version B):
The signature algorithm specified in the ciphersuite is the mandatory
algorithm to be used for the signatutes in MLSPlaintext and the tree
signatures.  It can be different from the signature algorithm
specified in credential fielf of ClientInitKeys.
Paragraph (version B):
Depending on the Diffie-Hellman group of the ciphersuite, different
rules apply to private key derivation and public key verification.
Paragraph (version B):
Given an octet string X, the private key produced by the Derive-Key-
Pair operation is SHA-256(X) (Recall that any 32-octet string is a
valid X25519 private key).  The corresponding public key is
X25519(SHA-256(X), 9).
Paragraph (version B):
Given an octet string X, the private key produced by the Derive-Key-
Pair operation is SHA-512(X) truncated to 448 bits (Recall that any
56-octet string is a valid X448 private key).  The corresponding
public key is X448(SHA-512(X), 5).
Paragraph (version B):
This document requests the creation of the following new IANA
registries: MLS Ciphersuites (mls-ciphersuites).  All of these
registries should be under a heading of "Message Layer Security", and
assignments are made via the Specification Required policy RFC8126.
See de for additional information about the MLS Designated Experts
(DEs).
Paragraph (version B):
A ciphersuite is a combination of a protocol version and the set of
cryptographic algorithms that should be used.
Paragraph (version B):
The KEM/DEM constructions used for HPKE are defined by HPKE.  The
corresponding AEAD algorithms AEAD_AES_128_GCM and AEAD_AES_256_GCM,
are defined in RFC5116.  AEAD_CHACHA20_POLY1305 is defined in
RFC7539.  The corresponding hash algorithms are defined in SHS.
Paragraph (version B):
It is advisable to keep the number of ciphersuites low to increase
the chances clients can interoperate in a federated environment,
therefore the ciphersuites only inlcude modern, yet well-established
algorithms.  Depending on their requirements, clients can choose
between two security levels (roughly 128-bit and 256-bit).  Within
the security levels clients can choose between faster X25519/X448
curves and FIPS 140-2 compliant curves for Diffie-Hellman key
negotiations.  Additionally clients that run predominantly on mobile
processors can choose ChaCha20Poly1305 over AES-GCM for performance
reasons.  Since ChaCha20Poly1305 is not listed by FIPS 140-2 it is
not paired with FIPS 140-2 compliant curves.  The security level of
symmetric encryption algorithms and hash functions is paired with the
security level of the curves.