Change:
the "tree" array divided by two. Construct a new group state using the information in the GroupInfo <del> object and verify the integrity of the tree using the "tree_hash". The new member's position in the tree is "index", as defined above. Identify the lowest node at which the direct paths from "index" and "signer_index" overlap.  Set private keys for that node and its parents up to the root of the tree, using the "path_secret" from the KeyPackage and following the algorithm in ratchet-tree- commits to move up the tree. </del> <ins> object.  The new member's position in the tree is "index", as defined above.  In particular, the confirmed transcript hash for the new state is the "prior_confirmed_transcript_hash" in the GroupInfo object. Process the "path" field in the GroupInfo to update the new group state: Update the ratchet tree by replacing nodes in the direct path of the sender with the corresponding nodes in the path (see direct-paths). The "commit_secret" is the value "path_secret[n+1]" derived from the "path_secret[n]" value associated to the root node. Use the "init_secret" from the KeyPackage object together with the decrypted "commit_secret" to generate the epoch secret and other derived secrets for the current epoch. Set the confirmed transcript hash in the new state to the value of the "confirmed_transcript_hash" in the GroupInfo. Verify the confirmation MAC in the GroupInfo using the derived confirmation key and the "confirmed_transcript_hash" from the GroupInfo. </ins> 11.

Discussion:
I have managed to implement Proposal / Commit in mlspp, but it required some modifications to the Welcome and Commit structs and processes. Two major things to point out: This PR proposes to send the same DirectPath to both new members and current members. This avoids the need to have two code paths and special tree math to implant path secrets, at the cost of some bloat in the Welcome and Commit messages. As a result, the sequencing of GroupContexts is a bit tricky. The GroupContext used for encrypting/decrypting DirectPaths is an intermediate context -- the new group context, but before the transcript is updated. All that said, this version is . The implementation exercise highlighted that the net effect of Proposal/Commit was to isolate basically all of the state management complexity to three methods in the client stack: Processing of Welcome messages Generation of Commit+Welcome messages Processing of Commit messages This PR reflects the algorithms for those three things.
NAME I added one minor change (order of fields) and rebased. I think this is ready to merge. I'm also about to drop offline for a bit, so please pull the trigger if it looks good to you.
Ack, I’ll take a look in tonight or tomorrow morning and merge it.
I am merging this now because it includes fixes we definitely need even though I note that I have one philosophical concern and one security concern... Multiplying the numbers of transcript hashes in the state is an implementation concern and not a protocol concern, I would much prefer keep only the real (confirmed) transcript hash. (The implementation should keep the current state and one provisional updated state but the struct shouldn't have to keep both) Sending the initsecret and the updatesecret at once seem equivalent to sending the epoch secret but I don't think it is actually the case since it could be rejected by the DS, breaking the encryption key of that message would hence still have consequences even if the message is rejected. I'll open an issue for that.
Here's the Weekly Digest for : - - Last week 8 issues were created. Of these, 0 issues have been closed and 8 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :speaker: , by It received 1 comments.

- - Last week, 6 pull requests were created, updated or merged. Last week, 1 pull request was opened. :greenheart: , by Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 2 pull requests were merged. :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits.

:hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Ok, this looks good to me. I think we don't have to derive that many keys in the main KS but that's ok for now, we can optimize later.