Change:
message, return an error. Decrypt the "encrypted_key_package" using HPKE with the algorithms <del> indicated by the ciphersuite and the HPKE public key in the ClientInitKey. </del> <ins> indicated by the ciphersuite and the HPKE private key corresponding to the ClientInitKey. </ins> <del> Decrypt the "encrypted_group_info" field using the key and nonce in the decrypted KeyPackage object. </del> <ins> From the "init_secret" in the decrypted KeyPackage object, derive the "group_info_secret", "group_info_key", and "group_info_nonce". Use the key and nonce to decrypt the "encrypted_group_info" field. </ins> Verify the signature on the GroupInfo object.  The signature input comprises all of the fields in the GroupInfo object except the

Discussion:
I have managed to implement Proposal / Commit in mlspp, but it required some modifications to the Welcome and Commit structs and processes. Two major things to point out: This PR proposes to send the same DirectPath to both new members and current members. This avoids the need to have two code paths and special tree math to implant path secrets, at the cost of some bloat in the Welcome and Commit messages. As a result, the sequencing of GroupContexts is a bit tricky. The GroupContext used for encrypting/decrypting DirectPaths is an intermediate context -- the new group context, but before the transcript is updated. All that said, this version is . The implementation exercise highlighted that the net effect of Proposal/Commit was to isolate basically all of the state management complexity to three methods in the client stack: Processing of Welcome messages Generation of Commit+Welcome messages Processing of Commit messages This PR reflects the algorithms for those three things.
NAME I added one minor change (order of fields) and rebased. I think this is ready to merge. I'm also about to drop offline for a bit, so please pull the trigger if it looks good to you.
Ack, I’ll take a look in tonight or tomorrow morning and merge it.
I am merging this now because it includes fixes we definitely need even though I note that I have one philosophical concern and one security concern... Multiplying the numbers of transcript hashes in the state is an implementation concern and not a protocol concern, I would much prefer keep only the real (confirmed) transcript hash. (The implementation should keep the current state and one provisional updated state but the struct shouldn't have to keep both) Sending the initsecret and the updatesecret at once seem equivalent to sending the epoch secret but I don't think it is actually the case since it could be rejected by the DS, breaking the encryption key of that message would hence still have consequences even if the message is rejected. I'll open an issue for that.
Here's the Weekly Digest for : - - Last week 8 issues were created. Of these, 0 issues have been closed and 8 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by :speaker: , by It received 1 comments.

- - Last week, 6 pull requests were created, updated or merged. Last week, 1 pull request was opened. :greenheart: , by Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 2 pull requests were merged. :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Here's the Weekly Digest for : - - Last week 4 issues were created. Of these, 0 issues have been closed and 4 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :greenheart: , by - - Last week, 14 pull requests were created, updated or merged. Last week, 8 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 6 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 10 commits.

:hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 3 contributors. :bustinsilhouette: :bustinsilhouette: :bustinsilhouette: - - Last week there were no stargazers. - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .
Ok, this looks good to me. I think we don't have to derive that many keys in the main KS but that's ok for now, we can optimize later.