Subject: [MLS] question about group contexts and deriving epoch secrets

From: "Hubert Chathi" <[email-masked]>
Date: Mon, 08 Feb 2021 18:45:31 -0500

When deriving the epoch secret, you do "ExpandWithLabel(., "epoch", GroupContext_[n], KDF.Nh)", so you need a GroupContext.  As far as I can tell, there appears to be a contradiction about which GroupContext to use: in the "Key Schedule" section (Line 1404), it says to use "The GroupContext object for current epoch", but in the "Commit" section under the part talking about a group member who applies a Commit message (Line 2660), it says to use the provisional GroupContext.  (The part talking about the group member who creates the Commit message doesn't say which GroupContext to use.)  If we are supposed to use the "new" GroupContext (after applying both the proposals and the update), but if we are supposed to use the provisional GroupContext, then I don't think that a new member has access to the tree_hash or confirmed_transcript_hash to create the GroupContext needed to derive the epoch secret.  So it seems like the "new" GroupContext should be correct, but Line 2660 is pretty explicit about using the provisional GroupContext.

---

From: Raphael Robert <[email-masked]>
Date: Tue, 9 Feb 2021 10:56:07 +0100

I think “new GroupContext” and “provisional GroupContext” are synonyms.

Creating the Commit:
 - Use the confirmed transcript hash (old intermediate transcript hash combined with new commit content from current MLSPlaintext)
 - Create new provisional GroupContext with new provisional epoch (old epoch  + 1), new tree hash (after proposals were applied to old tree) and confirmed transcript hash from above

Applying a Commit as an existing member:
 - Same as creating a Commit

Joining a group from a Welcome message:
- Create GroupContext with epoch from GroupInfo, tree hash from GroupInfo and confirmed transcript hash from GroupInfo

Does that answer the question?

If you think the spec is wrong/confusing feel free to file a PR.

Raphael

> On 9. Feb 2021, at 00:45, Hubert Chathi <[email-masked]> wrote:
> 
> When deriving the epoch secret, you do "ExpandWithLabel(., "epoch", GroupContext_[n], KDF.Nh)", so you need a GroupContext.  As far as I can tell, there appears to be a contradiction about which GroupContext to use: in the "Key Schedule" section (Line 1404), it says to use "The GroupContext object for current epoch", but in the "Commit" section under the part talking about a group member who applies a Commit message (Line 2660), it says to use the provisional GroupContext.  (The part talking about the group member who creates the Commit message doesn't say which GroupContext to use.)  If we are supposed to use the "new" GroupContext (after applying both the proposals and the update), but if we are supposed to use the provisional GroupContext, then I don't think that a new member has access to the tree_hash or confirmed_transcript_hash to create the GroupContext needed to derive the epoch secret.  So it seems like the "new" GroupContext should be correct, but Line 2660 is pretty expli
> cit about using the provisional GroupContext.
> 
> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls

---

From: "Hubert Chathi" <[email-masked]>
Date: Tue, 09 Feb 2021 18:44:30 -0500

> I think “new GroupContext” and “provisional GroupContext” are synonyms.

I'm not so sure about this.  The "provisional GroupContext" is created after applying the proposals (line 2532), but before the UpdatePath is applied to the tree (line 2559).  Whereas, from what I understand, new members are only given the tree after the UpdatePath is applied, which would give a different tree_hash and hence GroupContext.  I don't know if I'm just misunderstanding something.

> Creating the Commit:
>  - Use the confirmed transcript hash (old intermediate transcript hash 
> combined with new commit content from current MLSPlaintext)
>  - Create new provisional GroupContext with new provisional epoch (old 
> epoch  + 1), new tree hash (after proposals were applied to old tree) 
> and confirmed transcript hash from above
> 
> - Create GroupContext with epoch from GroupInfo, tree hash from 
> GroupInfo and confirmed transcript hash from GroupInfo
> 

Yes, once I manage to understand what's going on, I plan on filing a PR.