4 ms·

I know some academics working on MLS and I spent some time last year trying to understand it, to decide if I wanted to work with them. I think this blog post do

I know some academics working on MLS and I spent some time last year trying to understand it, to decide if I wanted to work with them. I think this blog post doesn't mention the core problem that MLS is trying to solve, which is efficient and secure key management (including forward secrecy and post-compromise security, which the Signal Double Ratchet protocol does so elegantly) for group end-to-end encrypted messaging. You don't want to have a O(n^2) keys for n users to talk to each other, and you don't want to have a single shared session key that must be renegotiated among all participants every time one participant leaves or gets kicked out of the group. I think MLS can do this with O(lg n) keys and fewer key exchanges as participants come and go.

skrowl 4y ago
[dead]
tptacek 4y ago
I've sort of mentally bucketed MLS into "secure end-to-end messaging for large group applications", like Slack or Telegram, where Signal's idea of a "group" is more akin to a bunch of people making plans to meet up for drinks or something. (I don't know how accurate this really is, and MLS people would also probably argue that their abstractions work nicely for small groups too).
DJBunnies 4y ago
Is that not what schnorr signatures solve?
- tptacek 4y ago
  ... no?
upofadown 4y ago
>I think MLS can do this with O(lg n) keys and fewer key exchanges as participants come and go. Does this potentially help with the group end to end encrypted chat identity problem? The number of identities that need to be verified goes up O(n^2) with the number of participants. It is hard to make that usable.