search

mlswg / mls-protocol

MLS protocol
https://messaginglayersecurity.rocks
Other
233 stars 60 forks source link

Add a section discussing the security of the sender data protection #836

Closed bifurcation closed 1 year ago

bifurcation commented 1 year ago

Fixes #770

kkohbrok commented 1 year ago

I would propose we say that we need AE1 security for our AEAD scheme, which gives us random ciphertexts and if we have random ciphertexts the input to key/nonce generation for sender data encryption is unique. This in turn gives us AE1 security for sender data encryption. I don't think we need AE2 encryption because our nonces are random and don't reveal any private information. Also, if I understand correctly, AES GCM is not AE2 secure, so if we want AE2 security, we need a different scheme or the transform described in NAN.

Probably needless to say, but I don't have a security proof for any of this. So more eyes on whatever we write here would be appreciated.