Draft: draft-ietf-mls-protocol

Commentary: This removes the following graf : The DS and AS may also apply additional policies to MLS operations to obtain additional security properties . For example , MLS enables any participant to add or remove members of a group ; a DS could enforce a policy that only certain members are allowed to perform these operations . MLS authenticates all members of a group ; a DS could help ensure that only clients with certain types of credential are admitted . MLS provides no inherent protection against denial of service ; A DS could also enforce rate limits in order to mitigate these risks . My sense is this belongs in Security Considerations , not here . 
 This looks good to me . Please do move the removed paragraph to the security considerations , either here or in .
Paragraph (version A):
The core functionality of MLS is continuous group authenticated key
exchange (AKE).  As with other authenticated key exchange protocols
(such as TLS), the participants in the protocol agree on a common
secret value, and each participant can verify the identity of the
other participants.  MLS provides group AKE in the sense that there
can be more than two participants in the protocol, and continuous
group AKE in the sense that the set of participants in the protocol
can change over time.
Paragraph (version B):
A Delivery Service (DS) that routes MLS messages among the
participants in the protocol.
Paragraph (version B):
MLS assumes a trusted AS but a largely untrusted DS. authentication-
service-compromise describes the impact of compromise or misbehavior
of an AS.  MLS is designed to protect the confidentiality and
integrity of the group data even in the face of a compromised DS; in
general, the DS is just expected to reliably deliver messages.
delivery-service-compromise describes the impact of compromise or
misbehavior of a DS.
Paragraph (version B):
The core functionality of MLS is continuous group authenticated key
exchange (AKE).  As with other authenticated key exchange protocols
(such as TLS), the participants in the protocol agree on a common
secret value, and each participant can verify the identity of the
other participants.  That secret can then be used to protect messages
sent from one participant in the group to the other participants
using the MLS framing layer or can be exported for use with other
protocols.  MLS provides group AKE in the sense that there can be
more than two participants in the protocol, and continuous group AKE
in the sense that the set of participants in the protocol can change
over time.
Paragraph (version B):
The creator of an MLS group creates the group's first epoch
unilaterally, with no protocol interactions.  Thereafter, the members
of the group advance their shared cryptographic state from one epoch
to another by exchanging MLS messages.
Paragraph (version A):
KeyPackage and Welcome messages are used to initiate a group or
introduce new members, so they are exchanged between group members
and clients not yet in the group.
Paragraph (version B):
KeyPackage and Welcome messages are used to initiate a group or
introduce new members, so they are exchanged between group members
and clients not yet in the group.  A client publishes a KeyPackage
via the DS, thus enabling other clients to add it to groups.  When a
group member wants to add a new member to a group it uses the new
member's KeyPackage to add the new member to the group and construct
a Welcome message with which the new member can initialize its local
state.