Subject: [MLS] MLS: the WG name should include "group"

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sat, 24 Mar 2018 07:27:24 -0400

Thanks for all the work that has gone into the proposed MLS architecture
and protocol drafts already.

As we move toward working group formation, i'm a little bit concerned
that the ostensible name of the project ("message layer security")
doesn't adequately describe the most salient features.

We spent most of the time at the BoF in IETF 101 London talking about
the design of the group key agreement scheme and the strong
cryptographic properties we want it to provide -- and i suspect that
most of the work in any formed WG will center around that problem.

So it seems odd to me that the word "group" doesn't appear in the name
"MLS".

I'm no good at acronyms, but i'll just throw out two alternatives:

  MSG: Messaging Security for Groups

  MESSAGE: Message Encryption and Security Standard for Asynchronous Group Environments

I hope since the WG isn't yet formed, it's not too late to consider a
change to the name.  We ought to be up front about the group-specific
context that we're talking about here, as we already have a security
layer that works for messages passing between two endpoints
synchronously (TLS) and it'd be nice to clearly carve up the territory.

        --dkg

---

From: Shivan <[email-masked]>
Date: Sat, 24 Mar 2018 13:14:58 +0000

+1 the name seems to be inspired by TLS but the drafts concern themselves
explicitly with group messaging, not messaging as a whole.

On Sat, Mar 24, 2018, 11:28 AM Daniel Kahn Gillmor <[email-masked]>
wrote:

> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls
>

---

From: Jon Millican <[email-masked]>
Date: Sat, 24 Mar 2018 13:43:37 +0000

Thanks for raising this point. I'm also no good at naming, but agree that there's potential scope to name more clearly. A couple of points in response to the specific issues you raised though:

While most of the discussion has focused on groups, my feeling is that this is because group is a more challenging superset of the pairwise case; and we should still care about pairwise messaging. In the pairwise case I think the main differentiator compared with TLS is the requirement for asynchronicity; so if we're clearly carving up the territory it might make sense to highlight this.

Just my 2c though. I have no objection at all to changing the name, and certainly agree that group support is a crucial aspect that could be worth highlighting.

Jon

On 24 Mar 2018, at 13:15, Shivan <[email-masked]<mailto:[email-masked]>> wrote:

+1 the name seems to be inspired by TLS but the drafts concern themselves explicitly with group messaging, not messaging as a whole.

On Sat, Mar 24, 2018, 11:28 AM Daniel Kahn Gillmor <[email-masked]<mailto:[email-masked]>> wrote:
Thanks for all the work that has gone into the proposed MLS architecture
and protocol drafts already.

        --dkg
_______________________________________________
MLS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mls<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=>
_______________________________________________
MLS mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwICAg&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=

---

From: "Katriel Cohn-Gordon" <[email-masked]>
Date: Sat, 24 Mar 2018 14:05:39 +0000

+1

I have no strong feelings regarding the name, but I do think we are
working on groups *because* you need them for general messaging.
Katriel

On Sat, 24 Mar 2018, at 1:43 PM, Jon Millican wrote:
> Thanks for raising this point. I'm also no good at naming, but agree
> that there's potential scope to name more clearly. A couple of points
> in response to the specific issues you raised though:> 
> While most of the discussion has focused on groups, my feeling is that
> this is because group is a more challenging superset of the pairwise
> case; and we should still care about pairwise messaging. In the
> pairwise case I think the main differentiator compared with TLS is the
> requirement for asynchronicity; so if we're clearly carving up the
> territory it might make sense to highlight this.> 
> Just my 2c though. I have no objection at all to changing the name,
> and certainly agree that group support is a crucial aspect that could
> be worth highlighting.> 
> 
> Jon
> 
> On 24 Mar 2018, at 13:15, Shivan <[email-masked]> wrote:
> 
>> +1 the name seems to be inspired by TLS but the drafts concern
>> themselves explicitly with group messaging, not messaging as a whole.>> 
>> On Sat, Mar 24, 2018, 11:28 AM Daniel Kahn Gillmor
>> <[email-masked]> wrote:>>> Thanks for all the work that has gone into the proposed MLS
>>> architecture>>>  and protocol drafts already.
>>> 
>>>  As we move toward working group formation, i'm a little bit
>>>  concerned>>>  that the ostensible name of the project ("message layer security")>>>  doesn't adequately describe the most salient features.
>>> 
>>>  We spent most of the time at the BoF in IETF 101 London talking
>>>  about>>>  the design of the group key agreement scheme and the strong
>>>  cryptographic properties we want it to provide -- and i
>>>  suspect that>>>  most of the work in any formed WG will center around that problem.>>> 
>>>  So it seems odd to me that the word "group" doesn't appear in
>>>  the name>>>  "MLS".
>>> 
>>>  I'm no good at acronyms, but i'll just throw out two alternatives:>>> 
>>>    MESSAGE: Message Encryption and Security Standard for
>>>    Asynchronous Group Environments>>> 
>>>  I hope since the WG isn't yet formed, it's not too late to
>>>  consider a>>>  change to the name.  We ought to be up front about the group-
>>>  specific>>>  context that we're talking about here, as we already have a
>>>  security>>>  layer that works for messages passing between two endpoints
>>>  synchronously (TLS) and it'd be nice to clearly carve up the
>>>  territory.>>> 
>>>          --dkg
>>> https://www.ietf.org/mailman/listinfo/mls[1]
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwICAg&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=> _________________________________________________
> MLS mailing list
> [email-masked]

Links:

  1. https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=

---

From: Raphael Robert <[email-masked]>
Date: Sat, 24 Mar 2018 16:25:16 +0100

We looked at a number of alternatives to MLS and in the end none of them seemed to be substantially better than “Messaging Layer Security”, but that doesn’t mean the name cannot be changed.

In my opinion “messaging” implies groups in 2018 and it’s not a special case of messaging anymore. It's the norm for non-E2EE products, and a number of E2EE messengers support it as well already today: WhatsApp, Signal, Wire, etc. In the context of MLS, “groups" are also interchangeable with “multi-device”, which is also becoming the norm.

The 1:1 pairwise mode is still important technologically, but application-wise it will most likely be perceived as a special case of (group) messaging.

Also just my 2c.

Raphael

> On 24 Mar 2018, at 15:05, Katriel Cohn-Gordon <[email-masked]> wrote:
> 
> +1
> 
> I have no strong feelings regarding the name, but I do think we are working on groups because you need them for general messaging.
> 
> Katriel
> 
> 
>> On 24 Mar 2018, at 13:15, Shivan <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>>> On Sat, Mar 24, 2018, 11:28 AM Daniel Kahn Gillmor <[email-masked] <mailto:[email-masked]>> wrote:
>>> [email-masked] <mailto:[email-masked]>
>>> https://www.ietf.org/mailman/listinfo/mls <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=>
>>> [email-masked] <mailto:[email-masked]>
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwICAg&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwICAg&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=>
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/mls <https://www.ietf.org/mailman/listinfo/mls>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/mls <https://www.ietf.org/mailman/listinfo/mls>

---

From: Suhas Nandakumar <[email-masked]>
Date: Sat, 24 Mar 2018 08:31:44 -0700

'mls' seems to be a fine name as it indicates e2e security for messaging
layer of the stack. Group vs 1:1 is a realization of an application context
on top of such a abstraction layer is what i feel.

./S

On Sat, Mar 24, 2018 at 8:25 AM, Raphael Robert <[email-masked]> wrote:

> We looked at a number of alternatives to MLS and in the end none of them
> seemed to be substantially better than “Messaging Layer Security”, but that
> doesn’t mean the name cannot be changed.
>
> In my opinion “messaging” implies groups in 2018 and it’s not a special
> case of messaging anymore. It's the norm for non-E2EE products, and a
> number of E2EE messengers support it as well already today: WhatsApp,
> Signal, Wire, etc. In the context of MLS, “groups" are also interchangeable
> with “multi-device”, which is also becoming the norm.
>
> The 1:1 pairwise mode is still important technologically, but
> application-wise it will most likely be perceived as a special case of
> (group) messaging.
>
> Also just my 2c.
>
> Raphael
>
> Thanks for raising this point. I'm also no good at naming, but agree that
> there's potential scope to name more clearly. A couple of points in
> response to the specific issues you raised though:
>
> this is because group is a more challenging superset of the pairwise case;
> and we should still care about pairwise messaging. In the pairwise case I
> think the main differentiator compared with TLS is the requirement for
> asynchronicity; so if we're clearly carving up the territory it might make
> sense to highlight this.
>
> Just my 2c though. I have no objection at all to changing the name, and
> certainly agree that group support is a crucial aspect that could be worth
> highlighting.
>
>
> Jon
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=>
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.
> ietf..org_mailman_listinfo_mls&d=DwICAg&c=5VD0RTtNlTh3ycd41b3MUw&r=
> M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=
> jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_mls&d=DwICAg&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=>
>
> *_______________________________________________*
> MLS mailing list
> [email-masked]

---

From: Nadim Kobeissi <[email-masked]>
Date: Sun, 25 Mar 2018 21:33:42 +0200

I do not believe the name should be changed:

1. MLS is a protocol that is equally suited for pairwise messaging as it is for group messaging
2. The MLS name is elegant and mirrors TLS.

I would recommend not spending a lot of time on this.

Nadim Kobeissi
Symbolic Software • https://symbolic.software
Sent from office

> On Mar 24, 2018, at 4:31 PM, Suhas Nandakumar <[email-masked]> wrote:
> 
> 'mls' seems to be a fine name as it indicates e2e security for messaging layer of the stack. Group vs 1:1 is a realization of an application context on top of such a abstraction layer is what i feel.
> 
> ./S
> 
> 
> 
> We looked at a number of alternatives to MLS and in the end none of them seemed to be substantially better than “Messaging Layer Security”, but that doesn’t mean the name cannot be changed..
> 
> The 1:1 pairwise mode is still important technologically, but application-wise it will most likely be perceived as a special case of (group) messaging..
> 
> Also just my 2c.
> 
> Raphael
> 
>>>> On Sat, Mar 24, 2018, 11:28 AM Daniel Kahn Gillmor <[email-masked]> wrote:
>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf..org_mailman_listinfo_mls&d=DwICAg&c=5VD0RTtNlTh3ycd41b3MUw&r=M0CVEJydBVUX_bvEqMa84Q&m=q5KP1AJUu-4ir-39yrQWELe1gULZ7UQbevfDBrgr0ss&s=jlPCTk9fCDAvKt6l2DuFKYLJoRLEL_KXV7lPHhtlA3M&e=

---

From: Dave Cridland <[email-masked]>
Date: Mon, 26 Mar 2018 09:24:10 +0100

I believe we should make it out of wood. It's a renewable resource and, if
well-treated, will be more than adequate for keeping the effects of weather
off the cycles stored inside.

---

From: Rich Persaud <[email-masked]>
Date: Mon, 26 Mar 2018 05:23:51 -0400

> We looked at a number of alternatives to MLS and in the end none of them seemed to be substantially better than “Messaging Layer Security”, but that doesn’t mean the name cannot be changed.

There is potential for collision with the MLS acronym that has been used for years (decades?), especially when combined with search terms like "security" or "cryptography":  https://en.wikipedia.org/wiki/Multilevel_security

Rich

---

From: Richard Barnes <[email-masked]>
Date: Mon, 26 Mar 2018 22:46:14 +0100

While I have some sympathy for DKG's point, I agree with Raphel and Katriel
that things are clear enough as-is.  In addition, if there's any ambiguity,
it should be cleared up by the charter.

If we're going to change, I admit that I find MSG pretty appealing.
Topical and tasty!

On Mon, Mar 26, 2018 at 10:23 AM, Rich Persaud <[email-masked]> wrote:

> There is potential for collision with the MLS acronym that has been used
> for years (decades?), especially when combined with search terms like
> "security" or "cryptography":  https://en.wikipedia.org/
> wiki/Multilevel_security
> <https://en.m.wikipedia.org/wiki/Multilevel_security>
>
> Rich
>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 27 Mar 2018 16:54:56 -0400

> 2. The MLS name is elegant and mirrors TLS.

"Mirroring TLS" is exactly what i'm afraid of.  This is a radically
different protocol, performing demonstrably different work at a
different position within the stack, with a different view on what
interoperability even means.

Let's make it very clear that this *is not* TLS, and that it is not a
substitute for TLS.

The protocol described in the documents is *not* equally-suited for
pairwise messaging -- it has a number of subtle features that are
included solely because it is intended to handle group messaging.  As
other people have written upthread, the protocol this nascent WG aims to
describe will handle pairwise messaging as a special case of group
messaging.  It is not designed intentionally for pairwise messaging and
if it were, it would have a different design.

          --dkg

---

From: Richard Barnes <[email-masked]>
Date: Tue, 27 Mar 2018 21:17:34 +0000

> if it were, it would have a different design.

I'm surprised by this claim.  Signal protocol is designed for 1-1
messaging, and with the current draft, a 2-party session is pretty much the
same as a Signal session.

ISTM the difference between MLS(n=2) and TLS is driven more by the desire
for asynchronicity than by the optimization for groups.  Which might lead
one to argue that "asynchronous" should be in the name, but the same
"because it's 2018" argument applies.

--Richard

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 27 Mar 2018 17:45:04 -0400

> same as a Signal session.

Sure, so we don't need the tree at all in that case, right?  similarly,
we don't need message signatures (which Signal doesn't have).

i get it that the 2-party protocol can be treated as a special case of
the n-party protocol.  that doesn't mean we're designing a two-party
protocol, though.  We're clearly designing a group messaging protocol,
and we should say so.

> "because it's 2018" argument applies.

Asynchronous messaging predates the present moment by at least 36 years
(c.f. RFC 821) -- it's not a novel 2018 requirement :P

             --dkg

---

From: [email-masked]
Date: Tue, 27 Mar 2018 17:02:34 -0600

+1