Introduced formal security notion of History graph

To recover MLS security we also show that TreeKEM (as implicit to the current version in Draft 11 of MLS) [ 8 ] is indeed a passively secure CGKA according to our definition.

Beyond MLS and TreeKEM we also prove that RTreeKEM [ 3] is a passively secure CGKA.

TreeKEM is also related to schemes for (symmetric-key) Broadcast encryption [ 16 , 18 ] and Multicast encryption [ 12 , 24 , 30 ]