Subject: Re: [MLS] May 2019 Interim Registration and Issue discussion

From: Karthikeyan Bhargavan <[email-masked]>
Date: Thu, 2 May 2019 10:02:58 +0200

Looking at: https://github.com/mlswg/mls-protocol/pull/155

I see that there is a change in metadata encryption:

>       "sample = ciphertext[:Hash.length]
> 	mask = HMAC(sender_data_secret, sample)[:8]
> 	encrypted_sender_data = sender_data ^ mask
> 	~~~~~
> 	
> 	This approach is similar to the one used for protection of header
> 	information in QUIC (see Section 5.4 of {{?I-D.ietf-quic-tls}}).
> 	Note that the sender data values are authenticated by the AEAD
> 	and the signature, while the masked_sender_data is not and only
> 	benefit from passive security because it depends on the ciphertext

I disagree with this change, because it is too early to put in optimizations,
especially those that rely on non-standard cryptographic constructions.
I would prefer that we go back to using plain AEAD for the sender_data,
and that we add this kind of optimization once we have a proof that it is secure.

Best,
Karthik

> On 25 Apr 2019, at 19:50, Richard Barnes <[email-masked]> wrote:
> 
> Couple of notes on plans for the protocol document:
> 
> As Nick notes, we are hoping to publish draft-05 of the protocol document before the interim.  I have marked a handful of PRs for inclusion in that release:
> 
> https://github.com/mlswg/mls-protocol/milestone/2
> 
> If folks could review those PRs ASAP, that would be helpful, as we will be working to get a few major things merged next week.  Thanks to Joël Alwen and Michael Rosenberg for reviews so far.
> 
> In general, my thinking is that draft-05 will be a "feature release" and draft-06 will be a "performance relase", in the following sense: In draft-05, we're getting in a lot of the big changes to the security model (tree hashing, common signing/encryption).  We'll try to keep these things stable for a bit, to let some analysis get done.  While that's going on, we can focus on issues that relate more to performance / scalability / maintainability, such as server assist, server-initiated add/remove, or KDF trees for application secrets.  I've already put a few issues / PRs into the draft-06 milestone:
> 
> https://github.com/mlswg/mls-protocol/milestone/3
> 
> --Richard
> 
> On Thu, Apr 25, 2019 at 1:38 PM Nick Sullivan <nick=[email-masked]> wrote:
> The date and location are set for the May 2019 Interim meeting. It will be on May 16 at the Wire headquarters in Berlin. More details can be found on Github: https://github.com/mlswg/wg-materials/tree/master/interim-2019-05.
> 
> Please register with the following form if you intend on attending either remotely or in person.
> Registration Link (https://forms.gle/8vK6ZKSrFzgX6KTr8)
> 
> Registration deadline closes on May 2nd.
> 
> We are soliciting proposals for presentations to add to the agenda for the meeting. Please send proposals to [email-masked]. Due to time limitations, these should be restricted to discussions about current active drafts.
> 
> Here are the active documents:
> Protocol (https://tools.ietf.org/html/draft-ietf-mls-protocol-04)
> Issues: https://github.com/mlswg/mls-protocol/issues
> Milestones: https://github..com/mlswg/mls-protocol/milestones
> 
> Architecture (https://tools.ietf.org/html/draft-ietf-mls-architecture-02)
> Issues: https://github.com/mlswg/mls-architecture
> 
> Federation (https://tools.ietf.org/html/draft-omara-mls-federation-00)
> Issues: https://github.com/mlswg/mls-federation/issues
> 
> 
> As a reminder for the working group, the target milestone for the -05 draft of the protocol document is May 1st, 2019. There are still a number of open issues that should be discussed here: https://github.com/mlswg/mls-protocol/milestone/2. We encourage the authors and other participants to read these issues, distill the main questions raised by them and propose answers for discussion on the list in the coming week.
> 
> 
> Nick and Sean
> 
> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls
> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls

---

From: Benjamin Beurdouche <[email-masked]>
Date: Thu, 2 May 2019 11:05:23 +0200

> On May 2, 2019, at 10:02 AM, Karthikeyan Bhargavan <[email-masked]> wrote:
> 

Using AEAD was in my original PR (#131), but multiple PRs have been
opened and merged together over the last few weeks leading to this state.
I have operationnal control over #155 right now and it is not merged, so
I would be completely fine with going back to use AEAD for now as it
provides better protection against active adversaries anyway...

B.

---

From: Richard Barnes <[email-masked]>
Date: Thu, 2 May 2019 17:45:25 -0400

> provides better protection against active adversaries anyway...

We published draft-05 today with AEAD instead of masking.  I have a pretty
strong preference for masking, though, because AEAD imposes a lot of
overhead.  Maybe we could discuss this at the interim?

--Richard

---

From: Nick Sullivan <[email-masked]>
Date: Thu, 9 May 2019 10:41:36 -0700

Hello All,

Registration for the interim is closed, but not everyone who expressed an
interest has registered. If you previously expressed interest in attending
either in person or remotely, please register by tomorrow (May 10th). The
preliminary agenda will be published by the end of the week.

Nick & Sean

On Thu, Apr 25, 2019 at 10:50 AM Richard Barnes <[email-masked]> wrote:

> As Nick notes, we are hoping to publish draft-05 of the protocol document
> before the interim.  I have marked a handful of PRs for inclusion in that
> release:
>
> If folks could review those PRs ASAP, that would be helpful, as we will be
> working to get a few major things merged next week.  Thanks to Joël Alwen
> and Michael Rosenberg for reviews so far.
>
> In general, my thinking is that draft-05 will be a "feature release" and
> draft-06 will be a "performance relase", in the following sense: In
> draft-05, we're getting in a lot of the big changes to the security model
> (tree hashing, common signing/encryption).  We'll try to keep these things
> stable for a bit, to let some analysis get done.  While that's going on, we
> can focus on issues that relate more to performance / scalability /
> maintainability, such as server assist, server-initiated add/remove, or KDF
> trees for application secrets.  I've already put a few issues / PRs into
> the draft-06 milestone:
>
> On Thu, Apr 25, 2019 at 1:38 PM Nick Sullivan <nick=
> [email-masked] <[email-masked]..org>> wrote:
>
>> The date and location are set for the May 2019 Interim meeting. It will
>> be on May 16 at the Wire headquarters in Berlin. More details can be found
>> on Github:
>> https://github.com/mlswg/wg-materials/tree/master/interim-2019-05.
>>
>> Registration Link <https://forms.gle/8vK6ZKSrFzgX6KTr8> (
>> https://forms.gle/8vK6ZKSrFzgX6KTr8)
>>
>> We are soliciting proposals for presentations to add to the agenda for
>> the meeting. Please send proposals to [email-masked]. Due to time
>> limitations, these should be restricted to discussions about current active
>> drafts.
>>
>> *Protocol* (https://tools.ietf.org/html/draft-ietf-mls-protocol-04)
>>
>> <https://github.com/mlswg/mls-protocol/milestones>
>>
>> *Architecture* (
>> https://tools.ietf.org/html/draft-ietf-mls-architecture-02)
>>
>> *Federation* (https://tools.ietf.org/html/draft-omara-mls-federation-00)
>>
>> As a reminder for the working group, the target milestone for the -05
>> draft of the protocol document is May 1st, 2019. There are still a number
>> of open issues that should be discussed here:
>> https://github.com/mlswg/mls-protocol/milestone/2. We encourage the
>> authors and other participants to read these issues, distill the main
>> questions raised by them and propose answers for discussion on the list in
>> the coming week.
>>
>>
>> Nick and Sean
>>

---

From: Raphael Robert <[email-masked]>
Date: Tue, 14 May 2019 13:36:22 +0200

Hello all,

The address of the venue where the interim will be held is the following:

Happy Pigeons GmbH
Erich-Weinert-Straße 78
10439 Berlin

Doors will be open at 9am.

Thanks

Raphael

> On 9 May 2019, at 19:41, Nick Sullivan <nick=[email-masked]> wrote:
> 
> Hello All,
> 
> Registration for the interim is closed, but not everyone who expressed an interest has registered. If you previously expressed interest in attending either in person or remotely, please register by tomorrow (May 10th). The preliminary agenda will be published by the end of the week.
> 
> Nick & Sean
> 
> https://github.com/mlswg/mls-protocol/milestone/2 <https://github.com/mlswg/mls-protocol/milestone/2>
> 
> In general, my thinking is that draft-05 will be a "feature release" and draft-06 will be a "performance relase", in the following sense: In draft-05, we're getting in a lot of the big changes to the security model (tree hashing, common signing/encryption).  We'll try to keep these things stable for a bit, to let some analysis get done.  While that's going on, we can focus on issues that relate more to performance / scalability / maintainability, such as server assist, server-initiated add/remove, or KDF trees for application secrets..  I've already put a few issues / PRs into the draft-06 milestone:
> 
> https://github.com/mlswg/mls-protocol/milestone/3 <https://github.com/mlswg/mls-protocol/milestone/3>
> 
> --Richard
> 
> On Thu, Apr 25, 2019 at 1:38 PM Nick Sullivan <nick=[email-masked] <mailto:[email-masked]..org>> wrote:
> The date and location are set for the May 2019 Interim meeting. It will be on May 16 at the Wire headquarters in Berlin. More details can be found on Github: https://github.com/mlswg/wg-materials/tree/master/interim-2019-05 <https://github.com/mlswg/wg-materials/tree/master/interim-2019-05>.
> 
> Registration Link <https://forms.gle/8vK6ZKSrFzgX6KTr8> (https://forms.gle/8vK6ZKSrFzgX6KTr8 <https://forms.gle/8vK6ZKSrFzgX6KTr8>)
> 
> We are soliciting proposals for presentations to add to the agenda for the meeting. Please send proposals to [email-masked] <mailto:[email-masked]>. Due to time limitations, these should be restricted to discussions about current active drafts.
> 
> Protocol (https://tools.ietf.org/html/draft-ietf-mls-protocol-04 <https://tools.ietf.org/html/draft-ietf-mls-protocol-04>)
> Issues: https://github.com/mlswg/mls-protocol/issues <https://github.com/mlswg/mls-protocol/issues>
> Milestones: https://github..com/mlswg/mls-protocol/milestones <https://github.com/mlswg/mls-protocol/milestones>
> Architecture (https://tools.ietf.org/html/draft-ietf-mls-architecture-02 <https://tools.ietf.org/html/draft-ietf-mls-architecture-02>)
> Issues: https://github.com/mlswg/mls-architecture <https://github.com/mlswg/mls-architecture>
> Federation (https://tools.ietf.org/html/draft-omara-mls-federation-00 <https://tools.ietf.org/html/draft-omara-mls-federation-00>)
> Issues: https://github.com/mlswg/mls-federation/issues <https://github.com/mlswg/mls-federation/issues>
> 
> As a reminder for the working group, the target milestone for the -05 draft of the protocol document is May 1st, 2019. There are still a number of open issues that should be discussed here: https://github.com/mlswg/mls-protocol/milestone/2 <https://github.com/mlswg/mls-protocol/milestone/2>. We encourage the authors and other participants to read these issues, distill the main questions raised by them and propose answers for discussion on the list in the coming week.
> 
> 
> Nick and Sean
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/mls <https://www.ietf.org/mailman/listinfo/mls>

---

From: Nick Sullivan <[email-masked]>
Date: Thu, 16 May 2019 07:35:38 +0200

As a reminder, here are the meeting details:
https://github.com/mlswg/wg-materials/blob/master/interim-2019-05/README.md

For remote attendance, we’ll be setting up WebEx:

Topic: MLS Interim: 16 May 2019
Date: Monday, January 16, 2019
Time: 9:00 am | Central Europead Summer Time (Berlin, GMT+02:00) | 8 hrs
Meeting link:
https://ietf.webex.com/ietf/j.php?MTID=md546be15e628910271eed585d1ad8567
Meeting number (access code): 648 186 985
Meeting password: ftw!

On Tue, May 14, 2019 at 1:36 PM Raphael Robert <raphael=
[email-masked]> wrote:

> <https://maps.google.com/?q=Erich-Weinert-Stra%C3%9Fe+78+10439+Berlin&entry=gmail&source=g>
> 10439 Berlin
> <https://maps.google.com/?q=Erich-Weinert-Stra%C3%9Fe+78+10439+Berlin&entry=gmail&source=g>
>
> On 9 May 2019, at 19:41, Nick Sullivan <
> nick=[email-masked]> wrote:
>
> Hello All,
>
>> If folks could review those PRs ASAP, that would be helpful, as we will
>> be working to get a few major things merged next week.  Thanks to Joël
>> Alwen and Michael Rosenberg for reviews so far.
>>
>> trees for application secrets..  I've already put a few issues / PRs into
>> the draft-06 milestone:
>>