Subject: [MLS] Delta-Remove may not be feasible

From: Richard Barnes <[email-masked]>
Date: Mon, 4 Feb 2019 17:26:06 -0500

Hey all,

I was just looking at the list of open issues, in particular #104
(Sever-initated removal).  It occurred to me that we had forgotten to
record the idea (raised by EKR, me, and Yevgeniy at various times) of using
a "delta" approach to make removal more efficient.

When I sat down to try to figure out how to actually do it, I discovered
that none of the obvious approaches work with Curve25519 / Curve448!  It
turns out that the private->public mapping for those curves is not a
homomorphism with regard to addition or multiplication.  I sent a ping to
the CFRG list to see if anyone has any good ideas:

https://mailarchive.ietf.org/arch/msg/cfrg/JVg30dldjr4pcwZ1perpA1k-OGQ

Cheers,
--Richard