updated root key after an Update operation, it cannot compute any derived secrets.  12.4. Initialization keys are intended to be used only once and then

Here's the Weekly Digest for : - - Last week, no issues were created. - - Last week, 5 pull requests were created, updated or merged. Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 2 pull requests were merged. :purpleheart: , by :purpleheart: , by - - Last week there were 2 commits. :hammerandwrench: by :hammerandwrench: by - - Last week there was 1 contributor. :bustin_silhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 18 issues were created. Of these, 3 issues have been closed and 15 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :heart: , by :heart: , by :speaker: , by It received 5 comments. - - Last week, 10 pull requests were created, updated or merged. Last week, 1 pull request was opened. :greenheart: , by Last week, 7 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 2 pull requests were merged. :purpleheart: , by :purpleheart: , by - - Last week there were 4 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 4 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: :bustin_silhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .

updated root key after an Update operation, it cannot compute any derived secrets. <ins> In the case where the client could have been compromised (device loss...), the client SHOULD signal the delivery service to expire all the previous ClientInitKeys and publish fresh ones for PCS. </ins> 12.4. Initialization keys are intended to be used only once and then


Enable Add and Remove proposals from outside the group (*)  draft-07 Initial version of the Tree based Application Key Schedule (*) 9. <del> A client creates a group with a specified set of initial members by constructing an Init message and sending it to those members. The creator of the group constructs an Init message as follows: Fetch one or more ClientInitKeys for each member (including the creator) Identify a protocol version and ciphersuite that is supported by all proposed members. </del>  <del> Construct a ratchet tree with its leaves populated with the public keys and credentials from the ClientInitKeys of the members, and all other nodes blank. </del>  <del> Generate a fresh leaf key pair for the first leaf </del>  <del> Compute its direct path in this ratchet tree </del>  <del> Each member of the newly-created group initializes its state from the Init message as follows: </del>  <del> Verify that all of the ClientInitKeys listed are for the same protocol and ciphersuite; if not, reject the Init as malformed </del>  <del> Note the group ID, protocol version, and ciphersuite in use. </del>  <del> Construct a ratchet tree as above </del>  <del> Update the cached ratchet tree by replacing nodes in the direct path from the first leaf using the direct path </del>  <del> Update the cached ratchet tree by replacing nodes in the direct path from the first leaf using the information contained in the "path" attribute </del>  <del> The epoch secret for the first epoch is computed from: </del>  <del> An all-zero init secret </del>  <del> An update secret "path_secret[i+1]" derived from the "path_secret[i]" associated to the root node </del>  <del> A GroupContext object resulting from the above initialization </del>  <del> The members learn the relevant path secrets by decrypting one of the encrypted path secrets in the DirectPath and working back to the root (as in normal DirectPath processing). </del>  <del> Note the degenerate case of this process: The group creator can initialize a group with one member (itself) and add the remaining members by sending Add proposals followed by a Commit.  This approach is slightly more verbose than simply sending an Init message, but also slightly more private.  The Init leaks the initial configuration of the group, while in the Add approach, the initial group state is sent in encrypted Welcome messages. </del>  <del> [[ OPEN ISSUE: It might be better to collapse these two approaches. This would entail sending multiple Proposals alongside a Commit and encrypting a Welcome to multiple participants, both of which seen like nice optimizations anyway. ]] </del>  <del> [[ OPEN ISSUE: It might be desireable for the group creator to be able to "pre-warm" the tree, by providing values for some nodes not on its direct path.  This would violate the tree invariant, so we would need to figure out what mitigations would be necessary. ]] </del>  10. 10.2.1. <del> The sender of a Commit message is responsible for sending Welcome messages to any new members added via Add proposals.  The Welcome message provides the new member with the current state of the group, after the application of the Commit message.  So the new member will </del>  not be able to decrypt or verify the Commit message, but will have <del> the secrets it needs to participate in the epoch initiated by the </del>  Commit message. <del> The information in a Welcome message is encrypted for the new member using HPKE.  The recipient key pair for the HPKE encryption is the one included in the indicated ClientInitKey. </del>  In the description of the tree as a list of nodes, the "credential" field for a node MUST be populated if and only if that node is a leaf <del> in the tree. </del>  <del> [[ OPEN ISSUE: If multiple members are being added, it would be nice to be able to encrypt the group state once and just encrypt the key to the members.  In that case, you would also need to factor out the "index" field. ]] </del>  11.

This PR makes two major changes that are enabled by Proposals: Multiple participants added in the same epoch receive the same Welcome message Init is always a special case of Add Prior to Proposals, treating Init as a special case of Add led to a performance degradation (). With Proposals, any number of Adds can be done with a single Commit (at cost), so there is no more degradation. The result seems (IMO) much more elegant than before. The main cost is that encryption of Welcome messages is now in two stages (three if you include the internal HPKE stage!), even if there is only one new member. Depends on Obsoletes and
Here's the Weekly Digest for : - - Last week 9 issues were created. Of these, 6 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 13 pull requests were created, updated or merged. Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 10 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 38 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .*
Instead of initializing new members with information from the previous epoch and requiring them to process an Add, we should initialize new members directly with current epoch information. This is covered in , but should be factored out.
Dependent on: Some modeling to convince ourselves that removing isn't dangerous Blocks:
I have made a Tamarin model of the 2- and 3-member cases of the proposal in , which shows that it provides certain authentication properties that one should expect of an AKE. In particular, it provides the property that even if the adder is malicious, they cannot cause the new member and the existing members to come to differing views of the group without causing to group to decohere. (Since the GroupContext is included in the key schedule, this might not be surprising.) Tamarin model here: URL Given this analysis, I'm comfortable making this change. It's preliminary, but I think it's good enough to justify moving forward with this concept pending a more complete analysis.
Fixed in
Modulo fixes discussed with Richard

Enable Add and Remove proposals from outside the group (*) <ins> Replace Init messages with multi-recipient Welcome message (*) </ins> draft-07 Initial version of the Tree based Application Key Schedule (*) 9.  <ins> A group is always created with a single member, the "creator".  The other members are added when the creator effectively sends itself an Add proposal and commits it, then sends the corresponding Welcome message to the new participants.  These processes are described in detail in add, commit, and welcoming-new-members. </ins>  <ins> The creator of a group MUST take the following steps to initialize the group: </ins>  <ins> Fetch ClientInitKeys for the members to be added, and selects a version and ciphersuite according to the capabilities of the members. [[ TODO: Discuss downgrade prevention here ]] </ins>  <ins> Initialize a one-member group with the following initial values (where "0" represents an all-zero vector of size Hash.length): </ins>  <ins> Ratchet tree: A tree with a single node, a leaf containing an HPKE public key and credential for the creator </ins>  <ins> Group ID: A value set by the creator </ins>  <ins> Epoch: 0x00000000 </ins>  <ins> Tree hash: The root hash of the above ratchet tree </ins>  <ins> Confirmed transcript hash: 0 </ins>  <ins> Interim transcript hash: 0 </ins>  <ins> Init secret: 0 </ins>  <ins> For each member, construct an Add proposal from the ClientInitKey for that member (see add) </ins>  <ins> Construct a Commit message that commits all of the Add proposals, in any order chosen by the creator (see commit) </ins>  <ins> Process the Commit message to obtain a new group state (for the epoch in which the new members are added) and a Welcome message </ins>  <ins> Transmit the Welcome message to the other new members </ins>  <ins> The recipient of a Welcome message processes it as described in welcoming-new-members. </ins>  <ins> In principle, the above process could be streamlined by having the creator directly create a tree and choose a random value for first epoch's epoch secret.  We follow the steps above because it removes unnecessary choices, by which, for example, bad randomness could be introduced.  The only choices the creator makes here are its own HPKE key and credential, the leaf secret from which the Commit is built, and the intermediate key pairs along the direct path to the root. </ins>  <ins> A new member receiving a Welcome message can recognize group creation if the number of entries in the "members" array is equal to the number of leaves in the tree minus one.  A client receiving a Welcome message SHOULD verify whether it is a newly created group, and if so, SHOULD verify that the above process was followed by reconstructing the Add and Commit messages and verifying that the resulting transcript hashes and epoch secret match those found in the Welcome message. </ins> 10. 10.2.1.  <ins> The sender of a Commit message is responsible for sending a Welcome message to any new members added via Add proposals.  The Welcome message provides the new members with the current state of the group, after the application of the Commit message.  The new members will </ins> not be able to decrypt or verify the Commit message, but will have  <ins> the secrets they need to participate in the epoch initiated by the </ins> Commit message.  <ins> In order to allow the same Welcome message to be sent to all new members, information describing the group is encrypted with a symmetric key and nonce randomly chosen by the sender.  This key and nonce are then encrypted to each new member using HPKE.  In the same encrypted package, the committer transmits the path secret for the lowest node contained in the direct paths of both the committer and the new member.  This allows the new member to compute private keys for nodes in its direct path that are being reset by the corresponding Commit. </ins> In the description of the tree as a list of nodes, the "credential" field for a node MUST be populated if and only if that node is a leaf  <ins> in the tree (i.e., a node with an even index). On receiving a Welcome message, a client processes it using the following steps: </ins>  <ins> Identify an entry in the "key_packages" array where the "client_init_key_hash" value corresponds to one of this client's ClientInitKeys, using the hash indicated by the "cipher_suite" field.  If no such field exists, or if the ciphersuite indicated in the ClientInitKey does not match the one in the Welcome message, return an error. Decrypt the "encrypted_key_package" using HPKE with the algorithms indicated by the ciphersuite and the HPKE public key in the ClientInitKey. Decrypt the "encrypted_group_info" field using the key and nonce in the decrypted KeyPackage object. Verify the signature on the GroupInfo object.  The signature input comprises all of the fields in the GroupInfo object except the signature field.  The public key and algorithm are taken from the credential in the leaf node at position "signer_index".  If this verification fails, return an error. Identify a leaf in the "tree" array (i.e., an even-numbered node) whose "public_key" and "credential" fields are identical to the corresponding fields in the ClientInitKey.  If no such field exists, return an error.  Let "index" represent the index of this node among the leaves in the tree, namely the index of the node in the "tree" array divided by two. Construct a new group state using the information in the GroupInfo object.  The new member's position in the tree is "index", as defined above. Identify the lowest node at which the direct paths from "index" and "signer_index" overlap.  Set private keys for that node and its parents up to the root of the tree, using the "path_secret" from the KeyPackage and following the algorithm in ratchet-tree- updates to move up the tree. </ins> 11.


Add extensions to ClientInitKeys for expiration and downgrade resistance (*)  draft-07 Initial version of the Tree based Application Key Schedule (*) messages encoded as MLSPlaintext objects in cases where it is necessary for the delivery service to examine such messages. <del> [[ OPEN-ISSUE: Should we allow multiple payloads to be packed into a single MLSPlaintext?  For example, this would allow a Proposal and a Commit to be sent at the same time, emulating the behavior of earlier verions of this protocol.  Or you could emulate Signal by always sending an Update and Commit when you send a message.  Syntactically, you would just define an MLSFrame that would encapsulate the select statement in the middle of MLSPlaintext, and have MLSPlaintext carry a vector of them. ]] </del> The remainder of this section describes how to compute the signature of an MLSPlaintext object and how to convert it to an MLSCiphertext object.  The overall process is as follows:

This is a light optimization over , removing the overhead of extra encryptions/signatures in the case where proposal(s) and a commit are sent at the same time. Depends on
Unfortunately, using a single content type enforces the DS to order everything while there is no reason to force ordering of proposals made for the same epoch.
On conversation with NAME - Will keep content types separate, but allow Commit to have proposals.
Here's the Weekly Digest for : - - Last week 9 issues were created. Of these, 6 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 13 pull requests were created, updated or merged. Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 10 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 38 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .*
This allows combo operations -- multiple adds, moves, resyncs -- without having to worry about getting interrupted mid-operation.
On discussion at the interim 2019-01: It may be better to do not just throw a blind combo layer in here, but rather to have more operation types. That way, we can fully think through the implications of each one.
Deferred for further discussion on the mailing list.
Repurposing this issue for combo moves with regard to Proposals and Commits. We should cover the following cases: One or more Proposals with no Commit A Commit with no Proposals One or more Proposals bundled with a Commit It seems like something like the following would be appropriate: ... together with a requirement that at least one of them be populated.
At the interim: Commit must cover all Proposals in the same message As a result, if any of the Proposals are invalid, then the whole thing fails
Fixed in
Good to go modulo fix.

Add extensions to ClientInitKeys for expiration and downgrade resistance (*) <ins> Allow multiple Proposals and a single Commit in one MLSPlaintext (*) </ins> draft-07 Initial version of the Tree based Application Key Schedule (*) messages encoded as MLSPlaintext objects in cases where it is necessary for the delivery service to examine such messages.  The remainder of this section describes how to compute the signature of an MLSPlaintext object and how to convert it to an MLSCiphertext object.  The overall process is as follows:


The HPKECiphertext values are computed as where "node_public_key" is the public key of the node that the path <del> secret is being encrypted for, and the functions "SetupBaseI" and </del>  "Seal" are defined according to I-D.irtf-cfrg-hpke. Decryption is performed in the corresponding way, using the private signing private key corresponding to the credential at the leaf in the tree indicated by the sender field.  The signature covers the plaintext metadata and message content, i.e., all fields of <del> MLSPlaintext except for the "signature" field. </del>  The ciphertext field of the MLSCiphertext object is produced by supplying the inputs described below to the AEAD function specified

This makes MLSPlaintext signatures and DirectPath encryptions specific to a given group and epoch, to avoid copy/paste attacks. NAME - Note that this since DirectPath HPKE encryptions will have non-empty AAD, while Welcome messages will have none. Depends on
Here's the Weekly Digest for : - - Last week 9 issues were created. Of these, 6 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 13 pull requests were created, updated or merged. Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 10 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 38 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .*
Signatures that go in the MLSPlaintext field right now only include the group ID and epoch. The group ID does help bind the message to a specific group, but group IDs are arbitrary and it seems multiple groups could have the same ID. We should include the whole group context object in the data that's signed, to prevent messages from being copied from one conversation and pasted into another conversation with the same group ID.
Yes, the lack of context has been pointed out by Karthik and I at the last interim. I said I would fix this but I didn’t find time to write the PR yet, I’ll try to do that today. Thanks for the remainder...
The protocol currently uses the public keys in the leaves of the ratchet tree for two purposes: For encrypting path secrets, and for encrypting WelcomeInfo data. We should include the type of message we're sending in the HPKE AAD for that message. Taking messages meant for one purpose and using them for another might leak information about the plaintext because decryption will succeed but not subsequent processing. Ex: Putting a ciphertext containing a path secret in a Welcome message and observing error "unknown group id: abcdef123..." or similar
Question: Should this be HPKE or ?

The HPKECiphertext values are computed as where "node_public_key" is the public key of the node that the path  <ins> secret is being encrypted for, group_context is the current GroupContext object for the group, and the functions "SetupBaseI" and </ins> "Seal" are defined according to I-D.irtf-cfrg-hpke. Decryption is performed in the corresponding way, using the private signing private key corresponding to the credential at the leaf in the tree indicated by the sender field.  The signature covers the plaintext metadata and message content, i.e., all fields of  <ins> MLSPlaintext except for the "signature" field.  The signature also covers the GroupContext for the current epoch, so that signatures are specific to a given group and epoch. </ins> The ciphertext field of the MLSCiphertext object is produced by supplying the inputs described below to the AEAD function specified


In particular, MLS maintains the members' views of the tree in such a way as to maintain the _tree invariant_: <del> In other words, if node is not blank, then it holds a key pair, and </del>  the private key of that key pair is known only to members holding leaves below that node. <del> The reverse implication is not true: A leaf below an intermediate node might not hold the private key for the node.  Such a leaf is called an _unmerged_ leaf, since encrypting to the subtree below the node requires encrypting to the node's public key as well as the unmerged leaves below it.  A leaf is unmerged when it is first added, because the process of adding the leaf does not give it access to all of the nodes above it in the tree.  Leaves are "merged" as they receive the private keys for nodes, as described in ratchet-tree- updates. </del>  5.4.

Picking up some comments from NAME that I missed earlier, and fixing examples. Obsoletes
Here's the Weekly Digest for : - - Last week 9 issues were created. Of these, 6 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 13 pull requests were created, updated or merged. Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 10 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 38 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .*

In particular, MLS maintains the members' views of the tree in such a way as to maintain the _tree invariant_:  <ins> In other words, if a node is not blank, then it holds a key pair, and </ins> the private key of that key pair is known only to members holding leaves below that node.  <ins> The reverse implication is not true: A member may not know the private keys of all the intermediate nodes they're below.  Such a member has an _unmerged_ leaf.  Encrypting to an intermediate node requires encrypting to the node's public key, as well as the public keys of all the unmerged leaves below it.  A leaf is unmerged when it is first added, because the process of adding the leaf does not give it access to all of the nodes above it in the tree.  Leaves are "merged" as they receive the private keys for nodes, as described in ratchet-tree-updates. </ins> 5.4.


7.3.  To allow group members to verify that they agree on the public cryptographic state of the group, this section defines a scheme for generating a hash value that represents the contents of the group's Note that unlike a ParentNode, a ClientInitKey already contains a signature. <del> 7.4. </del>  Each member of the group maintains a GroupContext object that summarizes the state of the group: When a new group is created, the "interim_transcript_hash" field is set to the zero-length octet string. <del> 7.5. </del>  As described in commit, each MLS Commit message needs to transmit a ClientInitKey leaf and node values along its direct path.  The path key of the resolution node and the ephemeral public key transmitted in the message. <del> 7.6. </del>  Group keys are derived using the HKDF-Extract and HKDF-Expand functions as defined in RFC5869, as well as the functions defined Given these inputs, the derivation of secrets for an epoch proceeds as shown in the following diagram: <del> 7.7. </del>  Groups which already have an out-of-band mechanism to generate shared group secrets can inject those in the MLS key schedule to seed the [[OPEN ISSUE: We have to decide if we want an external coordination via the application of a Handshake proposal.]] <del> 7.8. </del>  As described in message-framing, MLS encrypts three different types of information: where "encode_big_endian()" encodes the generation in a big-endian integer of the same size as the base handshake nonce. <del> 7.9. </del>  The main MLS key schedule provides an "exporter_secret" which can be used by an application as the basis to derive new secrets called

The is no longer needed, since CIKs are referenced by hash. ProposalIDs were no longer usable to refer to proposals since we enabled multiple proposals per MLSPlaintext The syntax description for Welcome was invalid
Merge with master obsoleted some changes. I re-implemented the "supportedversion"->"version" change, and added a "keyid" extension to address Benjamin's comment.
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 9 issues were created. Of these, 6 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 13 pull requests were created, updated or merged. Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 10 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 38 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .*

7.3. <ins> Within MLS, a ClientInitKey is identified by its hash (see, e.g., welcoming-new-members).  The "key_id" extension allows applications to add an explicit, application-defined identifier to a ClientInitKey. 7.4. </ins> To allow group members to verify that they agree on the public cryptographic state of the group, this section defines a scheme for generating a hash value that represents the contents of the group's Note that unlike a ParentNode, a ClientInitKey already contains a signature.  <ins> 7.5. </ins> Each member of the group maintains a GroupContext object that summarizes the state of the group: When a new group is created, the "interim_transcript_hash" field is set to the zero-length octet string.  <ins> 7.6. </ins> As described in commit, each MLS Commit message needs to transmit a ClientInitKey leaf and node values along its direct path.  The path key of the resolution node and the ephemeral public key transmitted in the message.  <ins> 7.7. </ins> Group keys are derived using the HKDF-Extract and HKDF-Expand functions as defined in RFC5869, as well as the functions defined Given these inputs, the derivation of secrets for an epoch proceeds as shown in the following diagram:  <ins> 7.8. </ins> Groups which already have an out-of-band mechanism to generate shared group secrets can inject those in the MLS key schedule to seed the [[OPEN ISSUE: We have to decide if we want an external coordination via the application of a Handshake proposal.]]  <ins> 7.9. </ins> As described in message-framing, MLS encrypts three different types of information: where "encode_big_endian()" encodes the generation in a big-endian integer of the same size as the base handshake nonce.  <ins> 7.10. </ins> The main MLS key schedule provides an "exporter_secret" which can be used by an application as the basis to derive new secrets called


6.7.  As described in message-framing, MLS encrypts three different types of information:

This is for injection of out-of-band shared entropy.
Note that an alternative to this is to make PSK a proposal containing a PSK identifier.
I forgot to push my last commit when merging there should be a non-empty context for within the just after the PSK. Fix this when doing step 2 to keep close to the TLS importer...
Think this is obsolete given recent revisions to Derive-Secret
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 11 issues were created. Of these, 1 issues have been closed and 10 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 11 pull requests were created, updated or merged. Last week, 6 pull requests were opened. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 2 commits. :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .

6.7. <ins> Groups which already have an out-of-band mechanism to generate shared group secrets can inject those in the MLS key schedule to seed the MLS group secrets computations by this external entropy. At any epoch, including the initial state, an application can decide to synchronize the injection of a PSK in the MLS key schedule. This mechanism can be used to improve security in the cases where having a full run of updates accross members is too expensive or in the case where the external group key establishment mechanism provides stronger security against classical or quantum adversaries. The security level associated to the PSK injected in the key schedule SHOULD match at least the security level of the ciphersuite in use in the group. Note that, as a PSK may have a different lifetime than an update, it does not necessarily provide the same FS or PCS guarantees than a Commit message. [[OPEN ISSUE: We have to decide if we want an external coordination via the application of a Handshake proposal.]] 6.8. </ins> As described in message-framing, MLS encrypts three different types of information:


adding a new version of herself using a new credential signed under a new IdentityKey, then performing a remove of the old leaf.  This is fine as long as the credential binds to the same identity for the <del> application.  If this verfication is not met, there is no </del>  authentication guarantee at the application layer anyway.]] 6.3. The "epoch" field represents the current version of the group key. The "tree_hash" field contains a commitment to the contents of the <del> group's rachet tree and the credentials for the members of the </del>  group, as described in tree-hashes. The "confirmed_transcript_hash" field contains a running hash over The key and nonce used for the encryption of the message depend on the content type of the message.  The sender chooses the handshake <del> key for a handshake message or an ununsed generation from its (per- </del>  sender) application key chain for the current epoch, according to the type of message being encrypted.

Yeah, I noticed that too as I was implementing. I will fix it in a “reconciliation with implementation” PR I’m working on.
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 11 issues were created. Of these, 1 issues have been closed and 10 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 11 pull requests were created, updated or merged. Last week, 6 pull requests were opened. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 2 commits. :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .

adding a new version of herself using a new credential signed under a new IdentityKey, then performing a remove of the old leaf.  This is fine as long as the credential binds to the same identity for the  <ins> application.  If this verification is not met, there is no </ins> authentication guarantee at the application layer anyway.]] 6.3. The "epoch" field represents the current version of the group key. The "tree_hash" field contains a commitment to the contents of the  <ins> group's ratchet tree and the credentials for the members of the </ins> group, as described in tree-hashes. The "confirmed_transcript_hash" field contains a running hash over The key and nonce used for the encryption of the message depend on the content type of the message.  The sender chooses the handshake  <ins> key for a handshake message or an unused generation from its (per- </ins> sender) application key chain for the current epoch, according to the type of message being encrypted.


Group ID: A value set by the creator <del> Epoch: 0x00000000 </del>  Tree hash: The root hash of the above ratchet tree The group thus evolves from one cryptographic state to another each time a Commit message is sent and processed.  These states are referred to as "epochs" and are uniquely identified among states of <del> the group by four-octet epoch values.  When a new group is initialized, its initial state epoch 0x00000000.  Each time a state transition occurs, the epoch number is incremented by one. </del>  [[ OPEN ISSUE: It would be better to have non-linear epochs, in order <del> to tolerate forks in the history. ]] </del>  10.1.

might invalidate this, but in the meantime we should go ahead with this!
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week, no issues were created. - - Last week, 1 pull request was created, updated or merged. Last week, 1 pull request was updated. :yellow_heart: , by - - Last week there were no commits. - - Last week there were no contributors. - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 11 issues were created. Of these, 1 issues have been closed and 10 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 11 pull requests were created, updated or merged. Last week, 6 pull requests were opened. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 2 commits. :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .

Group ID: A value set by the creator  <ins> Epoch: 0 </ins> Tree hash: The root hash of the above ratchet tree The group thus evolves from one cryptographic state to another each time a Commit message is sent and processed.  These states are referred to as "epochs" and are uniquely identified among states of  <ins> the group by eight-octet epoch values.  When a new group is initialized, its initial state epoch 0x0000000000000000.  Each time a state transition occurs, the epoch number is incremented by one. </ins> [[ OPEN ISSUE: It would be better to have non-linear epochs, in order  <ins> to tolerate forks in the history.  There is a need to discuss whether we want to keep lexicographical ordering for the public value we serialize in the common framing, as it influence the ability of the DS to order messages.]] </ins> 10.1.


[[ TODO: A preliminary formal security analysis has yet to be performed on this authentication scheme.]] <del> [[ OPEN ISSUE: Currently, the group identifier, epoch and generation are contained as meta-data of the Signature.  A different solution could be to include the GroupContext instead, if more information is required to achieve the security goals regarding cross-group attacks. ]] </del> [[ OPEN ISSUE: Should the padding be required for handshake messages ? Can an adversary get more than the position of a participant in the tree without padding ? Should the base ciphertext block length be

Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 11 issues were created. Of these, 1 issues have been closed and 10 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 11 pull requests were created, updated or merged. Last week, 6 pull requests were opened. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 2 commits. :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .

[[ TODO: A preliminary formal security analysis has yet to be performed on this authentication scheme.]]  [[ OPEN ISSUE: Should the padding be required for handshake messages ? Can an adversary get more than the position of a participant in the tree without padding ? Should the base ciphertext block length be


for the specified KEM from a symmetric secret, using the specified hash function. <del> Each node in a ratchet tree contains up to three values: </del>  A private key (only within direct path, see below) If necessary, extend the tree to the right until it has at least index + 1 leaves <del> For each intermediate node along the path from the leaf at position "index" to the root, add "index" to the "unmerged_leaves" list for the node. Blank the path from the leaf at position "index" to the root </del>  Set the leaf node in the tree at position "index" to a new node containing the public key from the ClientInitKey in the Add, as

Blanking on add (I think) was obsoleted by unmerged leaves Add leaf to unmerged list for non-blank nodes on add There are now four elements in each node
Here's the Weekly Digest for : - - Last week 11 issues were created. Of these, 1 issues have been closed and 10 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 11 pull requests were created, updated or merged. Last week, 6 pull requests were opened. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 2 commits. :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Nice catch, Thank you !

for the specified KEM from a symmetric secret, using the specified hash function.  <ins> Each node in a ratchet tree contains up to four values: </ins> A private key (only within direct path, see below) If necessary, extend the tree to the right until it has at least index + 1 leaves  <ins> For each non-blank intermediate node along the path from the leaf at position "index" to the root, add "index" to the "unmerged_leaves" list for the node. </ins> Set the leaf node in the tree at position "index" to a new node containing the public key from the ClientInitKey in the Add, as


messages encoded as MLSPlaintext objects in cases where it is necessary for the delivery service to examine such messages.  The remainder of this section describes how to compute the signature of an MLSPlaintext object and how to convert it to an MLSCiphertext <del> object.  The overall process is as follows: Gather the required metadata: Group ID </del>  <del> Epoch </del>  <del> Content Type </del>  <del> Nonce </del>  <del> Sender index </del>  <del> Key generation </del>  <del> Sign the plaintext metadata - the group ID, epoch, sender index, and content type - as well as the authenticated data and message content </del>  <del> Randomly generate sender_data_nonce and encrypt the sender information using it and the key derived from the sender_data_secret </del>  <del> Encrypt the content using a content encryption key identified by the metadata The group identifier, epoch, content_type and authenticated data fields are copied from the MLSPlaintext object directly.  The content encryption process populates the ciphertext field of the MLSCiphertext object.  The metadata encryption step populates the encrypted_sender_data field. Decryption follows the same step in reverse: Decrypt the metadata, then the message and verify the content signature. </del>  8.1. the sender_data_key from the keyschedule.  It is encoded as an object of the following form:  The Additional Authenticated Data (AAD) for the SenderData ciphertext computation is its prefix in the MLSCiphertext, namely: might propose to remove a member of a group has been inactive for a long time, or propose adding a newly-hired staff member to a group representing a real-world team.  Proposals originating outside the <del> group are identified by having a "sender" value in the range 0xFFFFFF00 - 0xFFFFFFFF. The specific value 0xFFFFFFFF is reserved for clients proposing that they themselves be added.  Proposals with types other than Add MUST NOT be sent with this sender index.  In such cases, the MLSPlaintext MUST be signed with the private key corresponding to the ClientInitKey in the Add message.  Recipients MUST verify that the MLSPlaintext carrying the Proposal message is validly signed with this key. The remaining values 0xFFFFFF00 - 0xFFFFFFFE are reserved for signer that are pre-provisioned to the clients within a group.  If proposals with these sender IDs are to be accepted within a group, the members of the group MUST be provisioned by the application with a mapping between sender indices in this range and authorized signing keys.  To ensure consistent handling of external proposals, the application MUST ensure that the members of a group have the same mapping and apply the same policies to external proposals. </del>  An external proposal MUST be sent as an MLSPlaintext object, since the sender will not have the keys necessary to construct an

Action item from Singapore: it seems better to specify directly in the message if we have an external sender instead of using reserved ranges.
Here's the Weekly Digest for : - - Last week 3 issues were created. Of these, 0 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :speaker: , by It received 1 comments. - - Last week, 7 pull requests were created, updated or merged. Last week, 2 pull requests were opened. :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 3 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustinsilhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .

messages encoded as MLSPlaintext objects in cases where it is necessary for the delivery service to examine such messages. <ins> External sender types are sent as MLSPlaintext, see external- proposals for their use. </ins> The remainder of this section describes how to compute the signature of an MLSPlaintext object and how to convert it to an MLSCiphertext  <ins> object for "member" sender types.  The steps are: </ins>  <ins> Set group_id, epoch, content_type and authenticated_data fields from the MLSPlaintext object directly </ins>  <ins> Randomly generate the sender_data_nonce field </ins>  <ins> Identify the key and key generation depending on the content type </ins>  <ins> Encrypt an MLSSenderData object for the encrypted_sender_data field from MLSPlaintext and the key generation </ins>  <ins> Generate and sign an MLSPlaintextSignatureInput object from the MLSPlaintext object </ins>  <ins> Encrypt an MLSCiphertextContent for the ciphertext field using the key identified, the signature, and MLSPlaintext object </ins>  <ins> Decryption is done by decrypting the metadata, then the message, and then verifying the content signature. </ins>  <ins> The following sections describe the encryption and signing processes in detail. </ins> 8.1. the sender_data_key from the keyschedule.  It is encoded as an object of the following form: <ins> MLSSenderData.sender is assumed to be a "member" sender type.  When constructing an MLSSenderData from a Sender object, the sender MUST verify Sender.sender_type is "member" and use Sender.sender for MLSSenderData.sender. </ins> The Additional Authenticated Data (AAD) for the SenderData ciphertext computation is its prefix in the MLSCiphertext, namely: might propose to remove a member of a group has been inactive for a long time, or propose adding a newly-hired staff member to a group representing a real-world team.  Proposals originating outside the  <ins> group are identified by an "preconfigured" or "new_member" SenderType in MLSPlaintext. The "new_member" SenderType is used for clients proposing that they themselves be added.  For this ID type the sender value MUST be zero. Proposals with types other than Add MUST NOT be sent with this sender type.  In such cases, the MLSPlaintext MUST be signed with the private key corresponding to the ClientInitKey in the Add message. Recipients MUST verify that the MLSPlaintext carrying the Proposal message is validly signed with this key. The "preconfigured" SenderType is reserved for signers that are pre- provisioned to the clients within a group.  If proposals with these sender IDs are to be accepted within a group, the members of the group MUST be provisioned by the application with a mapping between these IDs and authorized signing keys.  To ensure consistent handling of external proposals, the application MUST ensure that the members of a group have the same mapping and apply the same policies to external proposals. </ins> An external proposal MUST be sent as an MLSPlaintext object, since the sender will not have the keys necessary to construct an


Every node, regardless of whether the node is blank or populated, has a corresponding _hash_ that summarizes the contents of the subtree below that node.  The rules for computing these hashes are described <del> in tree-hashes. </del>  5.3. is first added, because the process of adding the leaf does not give it access to all of the nodes above it in the tree.  Leaves are "merged" as they receive the private keys for nodes, as described in <del> ratchet-tree-updates. </del>  5.4. The "tree_hash" field contains a commitment to the contents of the group's ratchet tree and the credentials for the members of the <del> group, as described in tree-hashes. </del>  The "confirmed_transcript_hash" field contains a running hash over the handshake messages that led to this state. 7.5. <del> As described in ratchet-tree-commits, each MLS message needs to transmit a ClientInitKey leaf and node values along its direct path. The path contains a public key and encrypted secret value for all intermediate nodes in the path above the leaf.  The path is ordered from the closest node to the leaf to the root; each node MUST be the parent of its predecessor. </del>  The number of ciphertexts in the "encrypted_path_secret" vector MUST be equal to the length of the resolution of the corresponding copath list of discarded proposals in the Commit. Each proposal covered by the Commit is identified by a ProposalID <del> structure.  The "sender" field in this structure indicates the member of the group that sent the proposal (according to their index in the ratchet tree).  The "hash" field contains the hash of the MLSPlaintext in which the Proposal was sent, using the hash function for the group's ciphersuite. </del>  The sender of a Commit message MUST include in it all proposals that it has received during the current epoch.  Proposals that recipients confirmed by the welcome_info_hash is confirmed at the next epoch change anyway. ]]  A member of the group applies a Commit message by taking the following steps: leaf, or appended to the right edge of the tree if all leaves are occupied. <del> Process the "path" value to update the ratchet tree referenced by the provisional GroupContext and generate the "commit_secret": </del>  Update the ratchet tree by replacing nodes in the direct path of the sender with the corresponding nodes in the path (see direct-paths). The "commit_secret" is the value "path_secret[n+1]" derived <del> from the "path_secret[n]" value associated with the root node. </del>  Use the "commit_secret", the provisional GroupContext, and the init secret from the previous epoch to compute the epoch secret message, return an error. Decrypt the "encrypted_key_package" using HPKE with the algorithms <del> indicated by the ciphersuite and the HPKE public key in the ClientInitKey. </del>  <del> Decrypt the "encrypted_group_info" field using the key and nonce in the decrypted KeyPackage object. </del>  Verify the signature on the GroupInfo object.  The signature input comprises all of the fields in the GroupInfo object except the the "tree" array divided by two. Construct a new group state using the information in the GroupInfo <del> object and verify the integrity of the tree using the "tree_hash". The new member's position in the tree is "index", as defined above. Identify the lowest node at which the direct paths from "index" and "signer_index" overlap.  Set private keys for that node and its parents up to the root of the tree, using the "path_secret" from the KeyPackage and following the algorithm in ratchet-tree- commits to move up the tree. </del>  11.

I have managed to implement Proposal / Commit in mlspp, but it required some modifications to the Welcome and Commit structs and processes. Two major things to point out: This PR proposes to send the same DirectPath to both new members and current members. This avoids the need to have two code paths and special tree math to implant path secrets, at the cost of some bloat in the Welcome and Commit messages. As a result, the sequencing of GroupContexts is a bit tricky. The GroupContext used for encrypting/decrypting DirectPaths is an intermediate context -- the new group context, but before the transcript is updated. All that said, this version is . The implementation exercise highlighted that the net effect of Proposal/Commit was to isolate basically all of the state management complexity to three methods in the client stack: Processing of Welcome messages Generation of Commit+Welcome messages Processing of Commit messages This PR reflects the algorithms for those three things.
NAME I added one minor change (order of fields) and rebased. I think this is ready to merge. I'm also about to drop offline for a bit, so please pull the trigger if it looks good to you.
Ack, I’ll take a look in tonight or tomorrow morning and merge it.
I am merging this now because it includes fixes we definitely need even though I note that I have one philosophical concern and one security concern... Multiplying the numbers of transcript hashes in the state is an implementation concern and not a protocol concern, I would much prefer keep only the real (confirmed) transcript hash. (The implementation should keep the current state and one provisional updated state but the struct shouldn't have to keep both) Sending the initsecret and the updatesecret at once seem equivalent to sending the epoch secret but I don't think it is actually the case since it could be rejected by the DS, breaking the encryption key of that message would hence still have consequences even if the message is rejected. I'll open an issue for that.
Here's the Weekly Digest for : - - Last week 8 issues were created. Of these, 0 issues have been closed and 8 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :speaker: , by It received 1 comments. - - Last week, 6 pull requests were created, updated or merged. Last week, 1 pull request was opened. :greenheart: , by Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 2 pull requests were merged. :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Ok, this looks good to me. I think we don't have to derive that many keys in the main KS but that's ok for now, we can optimize later.

Every node, regardless of whether the node is blank or populated, has a corresponding _hash_ that summarizes the contents of the subtree below that node.  The rules for computing these hashes are described  <ins> in tree-hashes-and-signatures. </ins> 5.3. is first added, because the process of adding the leaf does not give it access to all of the nodes above it in the tree.  Leaves are "merged" as they receive the private keys for nodes, as described in  <ins> ratchet-tree-evolution. </ins> 5.4. The "tree_hash" field contains a commitment to the contents of the group's ratchet tree and the credentials for the members of the  <ins> group, as described in tree-hashes-and-signatures. </ins> The "confirmed_transcript_hash" field contains a running hash over the handshake messages that led to this state. 7.5.  <ins> As described in commit, each MLS Commit message needs to transmit a ClientInitKey leaf and node values along its direct path.  The path contains a public key and encrypted secret value for all intermediate nodes in the path above the leaf.  The path is ordered from the closest node to the leaf to the root; each node MUST be the parent of its predecessor. </ins> The number of ciphertexts in the "encrypted_path_secret" vector MUST be equal to the length of the resolution of the corresponding copath list of discarded proposals in the Commit. Each proposal covered by the Commit is identified by a ProposalID  <ins> value, which contains the hash of the MLSPlaintext in which the Proposal was sent, using the hash function for the group's ciphersuite. </ins> The sender of a Commit message MUST include in it all proposals that it has received during the current epoch.  Proposals that recipients confirmed by the welcome_info_hash is confirmed at the next epoch change anyway. ]] <ins> A member of the group creates a Commit message and the corresponding Welcome message at the same time, by taking the following steps: Construct an initial Commit object with "updates", "removes", "adds", and "ignored" fields populated from Proposals received during the current epoch, and an empty "path" field. Generate a provisional GroupContext object by applying the proposals referenced in the initial Commit object in the order provided, as described in proposals.  Add proposals are applied left to right: Each Add proposal is applied at the leftmost unoccupied leaf, or appended to the right edge of the tree if all leaves are occupied. Create an initial, partial GroupInfo object reflecting the following values: Group ID: The group ID for the group Epoch: The epoch ID for the next epoch Tree: The group's ratchet tree after the commit has been applied Prior confirmed transcript hash: The confirmed transcript hash for the current state of the group (not the provisional state) Create a DirectPath using the new tree (which includes any new members).  The GroupContext for this operation uses the "group_id", "epoch", "tree", and "prior_confirmed_transcript_hash" values in the initial GroupInfo object. Assign this DirectPath to the "path" fields in the Commit and GroupInfo objects. The "commit_secret" is the value "path_secret[n+1]" derived from the "path_secret[n]" value associated to the root node. Construct an MLSPlaintext object containing the Commit object. Use the "commit_secret" to advance the key schedule and compute the "confirmation" value in the MLSPlaintext.  Sign the MLSPlaintext using the current epoch's GroupContext as context. Complete the GroupInfo by populating the following fields: Confirmed transcript hash: The confirmed transcript hash including the current Commit object Interim transcript hash: The interim transcript hash including the current Commit object Confirmation: The confirmation from the MLSPlaintext Sign the GroupInfo using the member's private signing key Encrypt the GroupInfo using the key and nonce derived from the "init_secret" for the current epoch (see welcoming-new-members) For each new member in the group, compute an EncryptedKeyPackage object that encapsulates the "init_secret" for the current epoch. Construct a Welcome message from the encrypted GroupInfo object and the encrypted key packages. </ins> A member of the group applies a Commit message by taking the following steps: leaf, or appended to the right edge of the tree if all leaves are occupied.  <ins> Process the "path" value using the ratchet tree the provisional GroupContext, to update the ratchet tree and generate the "commit_secret": </ins> Update the ratchet tree by replacing nodes in the direct path of the sender with the corresponding nodes in the path (see direct-paths). The "commit_secret" is the value "path_secret[n+1]" derived  <ins> from the "path_secret[n]" value associated to the root node. Update the new GroupContexts confirmed and interim transcript hashes using the new Commit. </ins> Use the "commit_secret", the provisional GroupContext, and the init secret from the previous epoch to compute the epoch secret message, return an error. Decrypt the "encrypted_key_package" using HPKE with the algorithms  <ins> indicated by the ciphersuite and the HPKE private key corresponding to the ClientInitKey. </ins>  <ins> From the "init_secret" in the decrypted KeyPackage object, derive the "group_info_secret", "group_info_key", and "group_info_nonce". Use the key and nonce to decrypt the "encrypted_group_info" field. </ins> Verify the signature on the GroupInfo object.  The signature input comprises all of the fields in the GroupInfo object except the the "tree" array divided by two. Construct a new group state using the information in the GroupInfo  <ins> object.  The new member's position in the tree is "index", as defined above.  In particular, the confirmed transcript hash for the new state is the "prior_confirmed_transcript_hash" in the GroupInfo object. Process the "path" field in the GroupInfo to update the new group state: Update the ratchet tree by replacing nodes in the direct path of the sender with the corresponding nodes in the path (see direct-paths). The "commit_secret" is the value "path_secret[n+1]" derived from the "path_secret[n]" value associated to the root node. Use the "init_secret" from the KeyPackage object together with the decrypted "commit_secret" to generate the epoch secret and other derived secrets for the current epoch. Set the confirmed transcript hash in the new state to the value of the "confirmed_transcript_hash" in the GroupInfo. Verify the confirmation MAC in the GroupInfo using the derived confirmation key and the "confirmed_transcript_hash" from the GroupInfo. </ins> 11.


extension contains a list of MLS ciphersuites that are supported by the client.  7.2. The "expiration" extension represents the time at which clients MUST then it MUST consider the ClientInitKey invalid and not use it for any further processing. <del> Note that as an extension, it is not required that any given ClientInitKey have an expiration time.  In particular, applications that rely on "last resort" ClientInitKeys to ensure continued reachability may choose to omit the expiration extension from these keys, or give them much longer lifetimes than other ClientInitKeys. </del>  7.3.

Here's the Weekly Digest for : - - Last week 3 issues were created. Of these, 0 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :speaker: , by It received 1 comments. - - Last week, 7 pull requests were created, updated or merged. Last week, 2 pull requests were opened. :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 3 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustinsilhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 8 issues were created. Of these, 0 issues have been closed and 8 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :speaker: , by It received 1 comments. - - Last week, 6 pull requests were created, updated or merged. Last week, 1 pull request was opened. :greenheart: , by Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 2 pull requests were merged. :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .

extension contains a list of MLS ciphersuites that are supported by the client. <ins> These extensions MUST be always present in a ClientInitKey. </ins> 7.2. The "expiration" extension represents the time at which clients MUST then it MUST consider the ClientInitKey invalid and not use it for any further processing.  <ins> Applications that rely on "last resort" ClientInitKeys MAY set the expiration to its maximum value even though this is NOT RECOMMENDED. It is RECOMMENDED to rotate last resort keys at a pace chosen by the application even though they can have much longer lifetimes than other ClientInitKeys. This extension MUST always be present in a ClientInitKey. </ins> 7.3.


Metadata (sender information) <del> Proposal and Commit messages </del>  Application messages The sender information used to look up the key for the content encryption is encrypted under AEAD using a random nonce and the <del> sender_data_key which is derived from the sender_data_secret as </del>  follows: <del> Each handshake message is encrypted using a key and a nonce derived from the handshake_secret for a specific sender to prevent two senders to perform in the following way: </del>  <del> Here the value [sender] represents the index of the member that will use this key to send, encoded as a uint32.  Each sender maintains two "generation" counters, one for application messages and one for handshake messages.  These counters are incremented by one each time the sender sends a message. </del>  <del> For application messages, a chain of keys is derived for each sender in a similar fashion.  This allows forward secrecy at the level of application messages within and out of an epoch.  A step in this chain (the second subscript) is called a "generation".  The details of application key derivation are described in the astree section below. </del>  <del> For handshake messages (Proposals and Commits), the same key is used for all messages, but the nonce is updated according to the generation of the message: </del>  <del> where "encode_big_endian()" encodes the generation in a big-endian integer of the same size as the base handshake nonce. </del>  7.11. Note that fixing concrete values for GroupContext_[n] and application_secret completely defines all secrets in the AS Tree. <del> 12.2. The secret of a leaf in the AS Tree is used to initiate a symmetric hash ratchet which generates a sequence of keys and nonces.  The group member assigned to that leaf uses the j-th key/nonce pair in the sequence to encrypt (using the AEAD) the j-th message they send during that epoch.  In particular, each key/nonce pair MUST NOT be used to encrypt more than one message. More precisely, the initial secret of the ratchet for the group member assigned to the leaf with node index N is simply the secret of that leaf. </del>  <del> Keys, nonces and secrets of ratchets are derived using Derive-App- Secret.  The context in a given call consists of the index of the sender's leaf in the ratchet tree and the current position in the ratchet.  In particular, the index of the sender's leaf in the ratchet tree is the same as the index of the leaf in the AS Tree used to initialize the sender's ratchet. Here, AEAD.nonce_length and AEAD.key_length denote the lengths in bytes of the nonce and key for the AEAD scheme defined by the ciphersuite. 12.3. </del>  It is important to delete all security sensitive values as soon as they are _consumed_. A sensitive value S is said to be _consumed_ if KD0 and ND0 to allow for out-of-order delivery, and SHOULD retain D2 to allow for processing future messages. <del> 12.4. </del>  During each epoch senders MUST NOT encrypt more data than permitted by the security bounds of the AEAD scheme used. cryptographic operations using the application secrets can't affect the group init_secret, it remains to be proven correct. ]] <del> 12.5. </del>  The group members MUST use the AEAD algorithm associated with the negotiated MLS ciphersuite to AEAD encrypt and decrypt their length of the plaintext by allowing to send a variable number of ciphertext blocks ? ]] <del> 12.6. </del>  Since each Application message contains the group identifier, the epoch and a message counter, a client can receive messages out of

The current draft uses a hash ratchet to derive single-use keys for application messages, but for handshake messages, re-uses the same key with a sequence of different nonces. This results in a lot of unnecessary extra code. This PR uses the same hash ratchet for handshake and application messages. The only difference is in the base key for the hash ratchet. In the application case, we use the AStree. In the HS case, we derive the base keys directly from the handshake secret. The lack of a tree in the HS case means that either the client will do a linear number of derivations on the first send/receive, or it will keep the handshake secret around and not get FS for handshake messages within the epoch.
NAME - would appreciate your thoughts here
As discussed on the PR call: There's no point to FS for Proposals because clients have to cache the plaintext anyway Given that, the "flat derivation" approach should be fine We should have separate keys per sender to it easier to avoid nonce collisions Unclear whether we should derive nonces on a hash ratchet or use a counter
Here's the Weekly Digest for : - - Last week 5 issues were created. Of these, 1 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :speaker: , by It received 3 comments. - - Last week, 8 pull requests were created, updated or merged. Last week, 7 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 3 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 3 issues were created. Of these, 0 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :speaker: , by It received 1 comments. - - Last week, 7 pull requests were created, updated or merged. Last week, 2 pull requests were opened. :greenheart: , by :greenheart: , by Last week, 4 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 1 pull request was merged. :purpleheart: , by - - Last week there were 3 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustinsilhouette: - - Last week there were 2 stagazers. :star: :star: You all are the stars! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Please merge when you have chance.

Metadata (sender information)  <ins> Handshake messages (Proposal and Commit) </ins> Application messages The sender information used to look up the key for the content encryption is encrypted under AEAD using a random nonce and the  <ins> "sender_data_key" which is derived from the "sender_data_secret" as </ins> follows:  <ins> For handshake and application messages, a sequence of keys is derived via a "sender ratchet".  Each sender has their own sender ratchet, and each step along the ratchet is called a "generation". </ins>  <ins> A sender ratchet starts from a per-sender base secret.  For application keys, the base secret is derived as described in astree. For handshake keys, base secrets are derived directly from the "handshake_secret". </ins>  <ins> The base secret of for each sender is used to initiate a symmetric hash ratchet which generates a sequence of keys and nonces.  The sender uses the j-th key/nonce pair in the sequence to encrypt (using the AEAD) the j-th message they send during that epoch.  In particular, each key/nonce pair MUST NOT be used to encrypt more than one message. </ins>  <ins> Keys, nonces and secrets of ratchets are derived using Derive-App- Secret.  The context in a given call consists of the index of the sender's leaf in the ratchet tree and the current position in the ratchet.  In particular, the index of the sender's leaf in the ratchet tree is the same as the index of the leaf in the AS Tree used to initialize the sender's ratchet. </ins>  <ins> Here, AEAD.nonce_length and AEAD.key_length denote the lengths in bytes of the nonce and key for the AEAD scheme defined by the ciphersuite.  "ratchet" should be understood to mean "handshake" or "application" depending on the context. </ins> 7.11. Note that fixing concrete values for GroupContext_[n] and application_secret completely defines all secrets in the AS Tree.  <ins> The secret in the leaf of the AS tree is used to initiate a symmetric hash ratchet, from which a sequence of single-use keys and nonces are derived, as described in encryption-keys. </ins>  <ins> 12.2. </ins> It is important to delete all security sensitive values as soon as they are _consumed_. A sensitive value S is said to be _consumed_ if KD0 and ND0 to allow for out-of-order delivery, and SHOULD retain D2 to allow for processing future messages.  <ins> 12.3. </ins> During each epoch senders MUST NOT encrypt more data than permitted by the security bounds of the AEAD scheme used. cryptographic operations using the application secrets can't affect the group init_secret, it remains to be proven correct. ]]  <ins> 12.4. </ins> The group members MUST use the AEAD algorithm associated with the negotiated MLS ciphersuite to AEAD encrypt and decrypt their length of the plaintext by allowing to send a variable number of ciphertext blocks ? ]]  <ins> 12.5. </ins> Since each Application message contains the group identifier, the epoch and a message counter, a client can receive messages out of