Draft: draft-ietf-mls-protocol

Commentary: This PR implements a collection of comments on . It aims to achieve the goal stated by of having every derivation have a different relationship , but with a simpler construction . 
 Ok , I think this is good enough : )
Paragraph (version A):
The Application schedule begins with the Application secrets which
are arranged in an "Application Secret Tree" or AS Tree for short; a
left balanced binary tree with the same set of nodes and edges as the
epoch's ratchet tree.  Each leaf in the AS Tree is associated with
the same group member as the corresponding leaf in the ratchet tree.
Nodes are also assigned an index according to their position in the
array representation of the tree (described in tree-math).  If V is a
node in the AS Tree then IndexOf(V) denotes it's index while
V.leftChild and V.rightChild denote the children of V (if they
exist).
Paragraph (version A):
The secret of any other node in the tree is derived from its parent's
secret using a call to Derive-Secret.  The context for the call is
the (hash of the) Group state of the epoch and the index of the node
whose secret is being derived.
Paragraph (version B):
The Application schedule begins with the Application secrets which
are arranged in an "Application Secret Tree" or AS Tree for short; a
left balanced binary tree with the same set of nodes and edges as the
epoch's ratchet tree.  Each leaf in the AS Tree is associated with
the same group member as the corresponding leaf in the ratchet tree.
Nodes are also assigned an index according to their position in the
array representation of the tree (described in tree-math).  If N is a
node index in the AS Tree then left(N) and right(N) denote the
children of N (if they exist).
Paragraph (version B):
The secret of any other node in the tree is derived from its parent's
secret using a call to Derive-App-Secret.
Paragraph (version A):
More precisely, the initial secret of the ratchet for the group
member assigned to the leaf with index i is simply the secret of that
leaf.
Paragraph (version A):
Keys, nonces and secrets of ratchets are derived using HKDF-Expand-
Label.  The context in a given call consists of (a hash of) the
current Group state, the index of the sender's leaf in the ratchet
tree and the position in the ratchet.  In particular, the index of
the sender's leaf in the ratchet tree is the same as the index of the
leaf in the AS Tree used to initialize the sender's ratchet.
Paragraph (version A):
Ratchet_position is initialized to 1 for the first HKDF-Expand-Label
call of a new ratchet and incremented for each subsequent call in
that ratchet.
Paragraph (version A):
Here, AEAD.nonceLen and AEAD.keyLength denote the lengths in bytes of
the nonce and key for the AEAD scheme defined by the ciphersuite.
Paragraph (version B):
More precisely, the initial secret of the ratchet for the group
member assigned to the leaf with node index N is simply the secret of
that leaf.
Paragraph (version B):
Keys, nonces and secrets of ratchets are derived using Derive-App-
Secret.  The context in a given call consists of the index of the
sender's leaf in the ratchet tree and the current position in the
ratchet.  In particular, the index of the sender's leaf in the
ratchet tree is the same as the index of the leaf in the AS Tree used
to initialize the sender's ratchet.
Paragraph (version B):
Here, AEAD.nonce_length and AEAD.key_length denote the lengths in
bytes of the nonce and key for the AEAD scheme defined by the
ciphersuite.
Paragraph (version A):
Concretely, suppose we have the following AS Tree.
Paragraph (version A):
Then if a client uses key KD1 and nonce ND1 during epoch n then it
must consume (at least) values G, F, D0, D1, KD1, ND1 as well as the
update_secret and init_secret used to derive G (i.e. the
application_secret).
Paragraph (version B):
Then if a client uses key KD1 and nonce ND1 during epoch n then it
must consume (at least) values G, F, D0, D1, KD1, ND1 as well as the
update_secret and init_secret used to derive G (i.e. the
application_secret).  The client MAY retain (i.e., not consume) the
values KD0 and ND0 to allow for out-of-order delivery, and SHOULD
retain D2 to allow for processing future messages.