Summary

  • The 2 November revision of the MLS virtual-clients working-group draft lets several emulator clients appear as one leaf in a higher-level group. It is an Internet-Draft, not an RFC.
  • Every emulator holds the virtual client's full secret state. A compromise of one exposes current secrets and impersonation power in every higher-level group that leaf joins.
  • Removing an emulator means deleting outstanding KeyPackages, advancing the emulation group, changing credentials and refreshing keys in every higher-level group. The new revision also says the weaker of the source and target ciphersuites limits effective strength.

The single seat has several owners

Imagine four devices behind one name in an encrypted group. Other members see one MLS leaf, so a message does not advertise which device sent it. The tree is smaller. An update in the inner emulation group can help refresh several outer groups. The 2 November MLS working-group draft describes that bargain in draft-ietf-mls-virtual-clients-02.

The concealment has a precise boundary. All emulator clients hold the complete secret state of the virtual client. The draft says compromise of one gives an attacker the current epoch secrets of the emulation group and every higher-level group the virtual client belongs to, plus the ability to impersonate it. The other members chose to trust one visible leaf; the application has made several devices capable of speaking for it.

Taking a suspect device off the inner membership list is only the first operation. The draft's removal sequence begins by deleting outstanding virtual-client KeyPackages at the delivery service. A Remove commit creates a fresh emulation-group epoch. The application supplies new credentials and authentication key material; remaining emulators update the virtual client's key material in every higher-level group and upload fresh KeyPackages. Long-lived credentials accessible to the removed device should be revoked. Another emulator usually has to be online, and the delivery service must actually support deletion.

A stale KeyPackage can let the removed client process a later Welcome.

Revision -02 adds a ciphersuite warning that is easy to miss beside the tree diagrams. Key material for an outer group is derived from a secret made under the inner group's suite. Importing it into a stronger target suite changes its cryptographic context; it cannot manufacture entropy. Effective strength is bounded by the weaker suite. The draft tells applications to choose an emulation-group suite at least as strong as every target suite.

One leaf also does not erase all metadata. A derivation marker can reveal that it is virtual; a shared epoch identifier can link its appearances across groups. The document gives no production adoption count or observed incident. Its decision point is already concrete: an application that hides its devices from peers must be able to remove one from every place where the shared identity still works.

Original sources