Draft: draft-ietf-mls-protocol

Commentary: This makes MLSPlaintext signatures and DirectPath encryptions specific to a given group and epoch , to avoid copy / paste attacks . - Note that this since DirectPath HPKE encryptions will have non - empty AAD , while Welcome messages will have none . Depends on 
 Here 's the Weekly Digest for : - - Last week 9 issues were created . Of these , 6 issues have been closed and 3 issues are still open . : greenheart : , by : greenheart : , by : greenheart : , by : heart : , by : heart : , by : heart : , by : heart : , by : heart : , by : heart : , by : speaker : , by It received 2 comments . - - Last week , 13 pull requests were created , updated or merged . Last week , 3 pull requests were updated . : yellowheart : , by : yellowheart : , by : yellowheart : , by Last week , 10 pull requests were merged . : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by : purpleheart : , by - - Last week there were 38 commits . : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by : hammerandwrench : by - - Last week there were 2 contributors . : bustinsilhouette : : bustin_silhouette : - - Last week there was 1 stargazer . : star : You are the star ! : star2 : - - Last week there were no releases . - - That 's all for last week , please < kbd : eyes : Watch</kbdand < kbd : star : Star</kbdthe repository to receive next weekly updates . : smiley : You can also . * 
 Signatures that go in the MLSPlaintext field right now only include the group ID and epoch . The group ID does help bind the message to a specific group , but group IDs are arbitrary and it seems multiple groups could have the same ID . We should include the whole group context object in the data that 's signed , to prevent messages from being copied from one conversation and pasted into another conversation with the same group ID . 
 Yes , the lack of context has been pointed out by Karthik and I at the last interim . I said I would fix this but I did n’t find time to write the PR yet , I ’ll try to do that today . Thanks for the remainder ... 
 The protocol currently uses the public keys in the leaves of the ratchet tree for two purposes : For encrypting path secrets , and for encrypting WelcomeInfo data . We should include the type of message we 're sending in the HPKE AAD for that message . Taking messages meant for one purpose and using them for another might leak information about the plaintext because decryption will succeed but not subsequent processing . Ex : Putting a ciphertext containing a path secret in a Welcome message and observing error " unknown group i d : ... " or similar 
 Question : Should this be HPKE or ?
Paragraph (version A):
where "node_public_key" is the public key of the node that the path
secret is being encrypted for, and the functions "SetupBaseI" and
"Seal" are defined according to I-D.irtf-cfrg-hpke.
Paragraph (version B):
where "node_public_key" is the public key of the node that the path
secret is being encrypted for, group_context is the current
GroupContext object for the group, and the functions "SetupBaseI" and
"Seal" are defined according to I-D.irtf-cfrg-hpke.
Paragraph (version A):
The signature field in an MLSPlaintext object is computed using the
signing private key corresponding to the credential at the leaf in
the tree indicated by the sender field.  The signature covers the
plaintext metadata and message content, i.e., all fields of
MLSPlaintext except for the "signature" field.
Paragraph (version B):
The signature field in an MLSPlaintext object is computed using the
signing private key corresponding to the credential at the leaf in
the tree indicated by the sender field.  The signature covers the
plaintext metadata and message content, i.e., all fields of
MLSPlaintext except for the "signature" field.  The signature also
covers the GroupContext for the current epoch, so that signatures are
specific to a given group and epoch.