MLS Associated parties

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 9 July 2026.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

This document outlines a mechanism that allows an MLS group (i.e. the members thereof) to share key material with one or more associated parties such as a server acting as the delivery service.¶

The mechanism provides the following properties:¶

• All members of the group agree on the associated parties and their public key material¶

• All members of the group agree on the key material shared with each associated party¶

The mechanism makes the following assumptions:¶

• All associated parties keep track of the group state on a per-commit basis including the group’s RatchetTree and GroupInfo¶

2. Overview

The mechanism sketched in this document allows members of an MLS group to add one or more associated parties (APs). With each AP the group shares secret key material that is evolved with each epoch in the same fashion as the MLS key schedule.¶

The list of APs is part of the group state and thus covered by MLS' group agreement properties. APs can act as external senders and thus send proposals to the group (but can't commit them).¶

APs can be added, updated or removed by group members via proposals.¶

3. Associated partys

An Associated party (AP) is represented in groups through AssociatedPartyEntry struct, which contains the APs credential and signature public key, as well as the HPKE encryption key to which the shared key material is encrypted.¶

Each AP MUST correspond to an external sender in the group's external_senders extension.¶

struct {
  HPKEPublicKey encryption_key;
  uint32 external_sender_index;
  opaque signature;
} AssociatedPartyEntry

struct {
  HPKEPublicKey encryption_key;
  uint32 external_sender_index;
} AssociatedPartyEntryTBS

The signature in an AssociatedPartyEntry MUST be a valid signature under the signature_key of the external sender with index external_sender_index the over an AssociatedPartyEntryTBS with matching fields.¶

The APs of a group are listed in the group's AssociatedParties GroupContext extension.¶

struct {
  AssociatedPartyEntry associated_parties<V>;
} AssociatedParties

struct {
  AssociatedPartyEntry new_party;
} AddAssociatedParty

struct {
  u32 removed_party_index;
} RemoveAssociatedParty

struct {
  AssociatedPartyEntry updated_party;
} UpdateAssociatedParty

4. Exporting the AP secrets

With each new epoch, new, distinct secrets are exported from the MLS key schedule for each AP. The secrets are then sent to the AP and injected into the respective AP key schedules (see Section 5).¶

ap_secret =
  DeriveExtensionSecret(epoch_secret, "AP Secret")

struct {
  u32 ap_index;
  AssociatedPartyEntry ap_entry;
} AssociatedPartyExportContext

ap_commit_base_secret =
  ExpandWithLabel(ap_secret, "AP Commit Base Secret",
                    context, KDF.Nh)

ap_commit_secret =
  DeriveSecret(ap_commit_base_secret, "AP Commit Secret")

ap_commit_secret_id =
  DeriveSecret(ap_commit_base_secret, "AP Commit Secret ID")

struct {
  opaque label = "AP Commit Secret";
  GroupContext group_context;
  opaque ap_commit_secret_id<V>;
} AssociatedPartyCommitEncryptionContext;

(kem_output, ciphertext) =
  SafeEncryptWithContext(0xXXXX, external_pub, context,
                          ap_commit_base_secret)

5. Associated party key schedule

The secrets exported from the MLS key schedule and sent to the APs as described in Section 4 drive the AP key schedule, a simple key schedule that mimics the MLS key schedule. In each epoch, the newly added key material is combined with the key material from the previous epoch to derive the ap_init for the next epoch and the ap_exporter. The ap_exporter is used as input to a puncturable pseudorandom function (PPRF), which the application or other MLS extensions can use to derive further secrets.¶

As the ap_commit_secret is distinct for each AP, each AP has its own key schedule. Key material is thus shared between the group and each AP individually such that APs don't share key material with one-another.¶

6. Sharing associated party secrets with new group members

When adding new group members via Welcome messages, the current ap_init_secrets of all associated parties are included in an AssociatedPartySecrets GroupInfo extension, ordered per associated party according to the associated_parties vector in the group's AssociatedParties extension.¶

struct {
  opaque associated_party_init_secret<V>;
} AssociatedPartySecrets

When a new member joins via external commit, it creates the HPKE ciphertext and key id in the same way as a normal committer would. When deriving the secrets for the new epoch of the associated party key schedule, the ap_init_secret is set to 0.¶

7. Security Considerations

TODO Security¶

8. IANA Considerations

This document registers the AssociatedParties Component with ID 0x0007.¶

Acknowledgments

TODO acknowledge.¶

Contributors

Authors' Addresses