MLS: how Zero-Knowledge can secure Updates
Résumé
The Messaging Layer Security (MLS) protocol currently developed by the IETF aims at providing a group secure messaging solution. The goal is to provide end-to-end security, including Forward Secrecy and Post Compromise Secrecy, properties well studied for one-toone protocols. MLS proposes a tree-based regular asynchronous update of the group secrets, where a single user can alone perform a complete update. A main drawback is that a malicious user can create a denial of service attack by sending invalid update information. In this work, we propose a solution to prevent this kind of attacks, giving a checkpoint role to the server that transmits the messages. In our solution, the user sends to the server a proof that the update has been computed correctly, without revealing any information about this update. We use a Zero-Knowledge (ZK) protocol together with verifiable encryption as building blocks. As a main contribution, we provide two different ZK protocols to prove knowledge of the input of a pseudo random function implemented as a circuit, given an algebraic commitment of the output and the input.
Origine : Fichiers produits par l'(les) auteur(s)