Draft: draft-ietf-mls-protocol

Commentary: Interim 2022 - 06 - 02 : Merge
Paragraph (version A):
The "group_id", "version", and "cipher_suite" fields in the
Welcome message MUST be the same as the corresponding fields in
the ReInit proposal.
Paragraph (version A):
The Welcome MUST specify a PreSharedKey of type "resumption"
with usage "reinit".  The "group_id" MUST match the old group,
and the "epoch" MUST indicate the epoch after the Commit
covering the ReInit.
Paragraph (version B):
The "group_id", "version", "cipher_suite", and "extensions"
fields in the Welcome message MUST be the same as the
corresponding fields in the ReInit proposal.  The "epoch" in
the Welcome message MUST be 1.
Paragraph (version B):
The Welcome MUST specify a PreSharedKeyID of type "resumption"
with usage "reinit", where the "group_id" field matches the old
group and the "epoch" field indicates the epoch after the
Commit covering the ReInit.
Paragraph (version A):
The "psktype" in the PreSharedKeyID struct is not set to
"resumption" and the "usage" is "reinit" or "branch".
Paragraph (version B):
The "psktype" in the PreSharedKeyID struct is set to "resumption"
and the "usage" is "reinit" or "branch".
Paragraph (version A):
The sender of a Commit message is responsible for sending a single
Welcome message to all the new members added via Add proposals.  The
Welcome message provides the new members with the current state of
the group, after the application of the Commit message.  The new
members will not be able to decrypt or verify the Commit message, but
will have the secrets they need to participate in the epoch initiated
by the Commit message.
Paragraph (version B):
The sender of a Commit message is responsible for sending a single
Welcome message to all the new members added via Add proposals.  The
Welcome message provides the new members with the current state of
the group after the application of the Commit message.  The new
members will not be able to decrypt or verify the Commit message, but
will have the secrets they need to participate in the epoch initiated
by the Commit message.
Paragraph (version A):
If a "PreSharedKeyID" is part of the GroupSecrets and the client
is not in possession of the corresponding PSK, return an error.
Paragraph (version B):
If a "PreSharedKeyID" is part of the GroupSecrets and the client
is not in possession of the corresponding PSK, return an error.
Additionally, if a "PreSharedKeyID" has type "resumption" with
usage "reinit" or "branch", verify that it is the only such PSK.
Paragraph (version B):
If a "PreSharedKeyID" was used that has type "resumption" with
usage "reinit" or "branch", verify that the "epoch" field in the
GroupInfo is equal to 1.
Paragraph (version B):
For usage "reinit", verify that the last Commit to the
referenced group contains a ReInit proposal and that the
"group_id", "version", "cipher_suite", and
"group_context.extensions" fields of the GroupInfo match the
ReInit proposal.  Additionally, verify that all the members of
the old group are also members of the new group, according to
the application.
Paragraph (version B):
For usage "branch", verify that the "version" and
"cipher_suite" of the new group match those of the old group,
and that the members of the new group compose a subset of the
members of the old group, according to the application.