Draft: draft-ietf-mls-protocol

Commentary: One small change , otherwise LGTM .
Paragraph (version A):
A long-term identity key provider which allows clients to
authenticate protocol messages in a group.  These keys MUST be
kept for the lifetime of the group as there is no mechanism in the
protocol for changing a client's identity key.
Paragraph (version B):
A long-term identity key provider which allows clients to
authenticate protocol messages in a group.
Paragraph (version A):
The members of the group need to keep their views of the tree in sync
and up to date.  When a client proposes a change to the tree (e.g.,
to add or remove a member), it transmits a handshake message
containing a set of public values for intermediate nodes in the
direct path of a leaf.  The other members of the group can use these
public values to update their view of the tree, aligning their copy
of the tree to the sender's.
Paragraph (version B):
The members of the group need to keep their views of the tree in sync
and up to date.  When a client commits a change to the tree (e.g., to
add or remove a member), it transmits a handshake message containing
a set of public values for intermediate nodes in the direct path of a
leaf.  The other members of the group can use these public values to
update their view of the tree, aligning their copy of the tree to the
sender's.
Paragraph (version A):
A ClientInitKey object specifies a ciphersuite that the client
supports, as well as providing a public key that others can use for
key agreement.  The client's identity key can be updated throughout
the lifetime of the group by sending a new ClientInitKey with a new
identity; the new identity MUST be validated by the authentication
service.  ClientInitKeys are intended to be used only once and SHOULD
NOT be reused except in case of last resort.  (See init-key-reuse).
Clients MAY generate and publish multiple ClientInitKey objects to
support multiple ciphersuites.  ClientInitKeys contain an credential
chosen by the client, which the client MUST ensure uniquely
identifies a given ClientInitKey object among the set of
ClientInitKeys created by this client.
Paragraph (version B):
A ClientInitKey object specifies a ciphersuite that the client
supports, as well as providing a public key that others can use for
key agreement.  The client's identity key can be updated throughout
the lifetime of the group by sending a new ClientInitKey with a new
identity; the new identity MUST be validated by the authentication
service.  ClientInitKeys are intended to be used only once and SHOULD
NOT be reused except in case of last resort.  (See init-key-reuse).
Clients MAY generate and publish multiple ClientInitKey objects to
support multiple ciphersuites.  ClientInitKeys contain a public key
chosen by the client, which the client MUST ensure uniquely
identifies a given ClientInitKey object among the set of
ClientInitKeys created by this client.
Paragraph (version A):
Elements of the ratchet tree are called "Node" objects and contain
optionally a "ClientInitKey" when at the leaves or an optional
"ParentNode" above.
Paragraph (version B):
Elements of the ratchet tree are called "Node" objects and the leaves
contain an optional "ClientInitKey", while the parents contain an
optional "ParentNode".
Paragraph (version A):
At any epoch, including the initial state, an application can decide
to synchronize the injection of a PSK in the MLS key schedule.
Paragraph (version A):
This mechanism can be used to improve security in the cases where
having a full run of updates accross members is too expensive or in
the case where the external group key establishment mechanism
provides stronger security against classical or quantum adversaries.
Paragraph (version B):
At any epoch, including the initial state, an application can decide
to synchronize the injection of a PSK into the MLS key schedule.
Paragraph (version B):
This mechanism can be used to improve security in the cases where
having a full run of updates across members is too expensive or in
the case where the external group key establishment mechanism
provides stronger security against classical or quantum adversaries.