Subject: [MLS] Identity in MLS

From: Konrad Kohbrok <[email-masked]>
Date: Mon, 16 Aug 2021 08:50:06 +0200 (CEST)

Hi everyone,

after a discussion with Richard and Raphael on the subject of identity in MLS,
there is now a new PR on the subject of `identity` in MLS groups.

https://github.com/mlswg/mls-protocol/pull/476

The motivation behind the original PR was to prevent cases where group members
can only be uniquely identified via the index of their leaf, as there was no
rule that any part of a KeyPackage had to be unique.

The PR linked above changes a few things in the regard. It introduces a new
`endpoint_id` field to the KeyPackage, which serves to distinguish KeyPackages
in cases where the `identity` in the Credentials of two KeyPackages is the same.

It also poses a few restrictions on Adds and Updates:

Generally, for both Adds and Updates, the committer has to ensure that

- signature keys are unique within a group (this is so that the sender
  of a message can be determined uniquely within a group),
- `(identity, endpoint_id)` tuples are unique in a group,
- `hpke_init_key`s are unique in a group.

Additionally, Updates have to ensure that the new and the old key package have
the same identity (in the Credential), endpoint_id, version and cipher_suite as
the key package they replace and that the new and the old key package do not
share the same `hpke_init_key`.

The restrictions on Updates of course also hold for KeyPackages in `UpdatePath`
fields.

The reason that we introduce an `endpoint_id` in the KeyPackage and require
uniqueness in combination with the credential's `idenity` rather than simply
requiring that the `identity` in the credential is unique is due to possible
restrictions in the way that an AS might issue/authenticate credentials in
general and the X509 use case in particular. As Richard pointed out, a CA will
only sign things it can confirm. So, for example, when using an email address as
a user's identity, the CA will sign a certificate for that email address, but
not for any other identifier (such as a device id) that it can't confirm.

Looking forward to hearing your thoughts and feedback on the PR!

Cheers,
Konrad