Subject: [MLS] Why give the root a pk/sk?

From: Joel Alwen <[email-masked]>
Date: Mon, 11 May 2020 17:26:12 +0900

Quick question for the list. Why assign a pk/sk to the root of the ratchet tree?
(E.g. on Page 18 in the toy example root node G gets node_priv[1] and node_pub[1].)

The commit_secret is then derived HKDF-Expand-Label again on the path_secret for
the root.

Isn't it true that the only thing we ever encrypt to a node's pk is its parent's
path_secret? If so I'm not seeing the point of the pk/sk at the root and the
extra call HKDF-Expand to get commit_secret. Am I missing something?

- Joël

---

From: Richard Barnes <[email-masked]>
Date: Mon, 11 May 2020 16:22:00 -0400

I don't think it's necessary.  IIRC, the Go library doesn't do this, and it
seems to implement the remainder of the spec just fine.

The only case where it might be useful is if we implemented a
send-to-group-from-outside functionality, in support of Add initiated by
the new joiner.  But even in that case, it would probably be better to
derive a key pair off of the key schedule.

--RLB

On Mon, May 11, 2020 at 4:26 AM Joel Alwen <[email-masked]> wrote:

> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls
>

---

From: Raphael Robert <[email-masked]>
Date: Mon, 11 May 2020 23:21:16 +0200

I agree with that. Send-from-outside should be derived from the key schedule.

Raphael

> On 11 May 2020, at 22:22, Richard Barnes <[email-masked]> wrote:
> 
> I don't think it's necessary.  IIRC, the Go library doesn't do this, and it seems to implement the remainder of the spec just fine.
> 
> The only case where it might be useful is if we implemented a send-to-group-from-outside functionality, in support of Add initiated by the new joiner.  But even in that case, it would probably be better to derive a key pair off of the key schedule.
> 
> --RLB
> 
> On Mon, May 11, 2020 at 4:26 AM Joel Alwen <[email-masked] <mailto:[email-masked]>> wrote:
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/mls <https://www.ietf.org/mailman/listinfo/mls>

---

From: Benjamin Beurdouche <[email-masked]>
Date: Tue, 12 May 2020 05:42:17 +0200

@Joel This is because this is part of TreeKEM which has no key schedule and is not specific to MLS.
B.

> On May 11, 2020, at 11:21 PM, Raphael Robert <raphael=[email-masked]> wrote:
>

---

From: Joel Alwen <[email-masked]>
Date: Tue, 12 May 2020 13:18:13 +0900

Thanks for the answers everyone!

> Send-from-outside should be derived from the key schedule.

Yup, totally. Way better (global) forward secrecy that way.

So to summarize, what I'm reading out of these answers is that MLS doesnt really
have a need for the root's PK/SK and extra Derive/HKDF calls.

- Joël

On 12/05/2020 12:42, Benjamin Beurdouche wrote:
>> On May 11, 2020, at 11:21 PM, Raphael Robert
>> <raphael=[email-masked]> wrote:
>>
>>> On 11 May 2020, at 22:22, Richard Barnes <[email-masked] <mailto:[email-masked]>> wrote:
>>>
>>> send-to-group-from-outside functionality, in support of Add initiated by the
>>> new joiner.  But even in that case, it would probably be better to derive a
>>> key pair off of the key schedule.
>>>
>>> --RLB
>>>