Subject: [MLS] Tree of application secrets

From: "Hubert Chathi" <[email-masked]>
Date: Mon, 10 Aug 2020 21:25:55 +0100

The tree of application secrets (#astree) is used to derive an application secret for each sender.  However, only the leaf nodes are ever used; I don't see the internal nodes being used anywhere, and I don't see that deriving through a tree provides any extra security.  Would it be simpler to just derived the application secret for a sender using their leaf number (e.g. astree_node_[N]_secret = DeriveAppSecret(application_secret, "label", N, 0, Hash.length) using the same DeriveAppSecret as defined in that section)?  This would mean that if you need to derive the application secret for one of two senders, you'd only need to do O(1) work, rather than O(log(n)) work.

---

From: Brendan McMillion <[email-masked]>
Date: Mon, 10 Aug 2020 15:29:48 -0700

Hey Hubert

The following section describes the application secrets tree's deletion
schedule
<https://messaginglayersecurity.rocks/mls-protocol/draft-ietf-mls-protocol.html#name-deletion-schedule>.
Values are deleted from the tree as they're consumed to provide forward
secrecy. In the flat approach you described, it wouldn't be O(1) to
generate a leaf, it would be O(n) because when you consume the root node
you'd have to generate every leaf.

On Mon, Aug 10, 2020 at 1:27 PM Hubert Chathi <[email-masked]> wrote:

> The tree of application secrets (#astree) is used to derive an application
> secret for each sender.  However, only the leaf nodes are ever used; I
> don't see the internal nodes being used anywhere, and I don't see that
> deriving through a tree provides any extra security.  Would it be simpler
> to just derived the application secret for a sender using their leaf number
> (e.g. astree_node_[N]_secret = DeriveAppSecret(application_secret, "label",
> N, 0, Hash.length) using the same DeriveAppSecret as defined in that
> section)?  This would mean that if you need to derive the application
> secret for one of two senders, you'd only need to do O(1) work, rather than
> O(log(n)) work.
>
> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls
>

---

From: "Hubert Chathi" <[email-masked]>
Date: Tue, 11 Aug 2020 02:33:37 +0100

Ah, right.  That makes sense.  Thanks for the clarification.