Subject: [MLS] Compatibility behavior around new credentials.

From: Brendan McMillion <[email-masked]>
Date: Mon, 4 Apr 2022 11:34:54 -0700

Hi mls@

I wanted to write a note introducing PR #631. Currently, my understanding
is that the extensibility behavior of new credentials is underspecified in
a few ways:

1. There's no way to safely introduce new credential types. Members of a
group could simply start using a new credential type, but they wouldn't
know that other members of the group understand that credential type. We
could say that new credential types must only be registered by negotiated
extensions, but that extension could potentially be removed at any time by
a GroupContextExtensions proposal while members are still using the special
credential type.

2. There's no way to safely remove support for credential types. We have
the unauthenticated BasicCredential in the spec which isn't meant to be
used in production, but members have no way to signal when they will/won't
accept a BasicCredential. Similarly, a client that intends to use only
alternative credential types has no way to signal to the group that they
don't suppport X509Credential, and that adding a member with an
X509Credential to the group would block them from continuing.

PR #631 solves this by adding a "credentials" field to the "capabilities"
field of LeafNode that lists all of the client's supported credential
types, and adding logic to ensure that the credential preferences of all
group members are followed.

[0] https://github.com/mlswg/mls-protocol/pull/631