Change:
This makes MLSPlaintext signatures and DirectPath encryptions specific to a given group and epoch, to avoid copy/paste attacks. NAME - Note that this since DirectPath HPKE encryptions will have non-empty AAD, while Welcome messages will have none. Depends on
Here's the Weekly Digest for : - - Last week 9 issues were created. Of these, 6 issues have been closed and 3 issues are still open. :greenheart: , by :greenheart: , by :greenheart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :heart: , by :speaker: , by It received 2 comments. - - Last week, 13 pull requests were created, updated or merged. Last week, 3 pull requests were updated. :yellowheart: , by :yellowheart: , by :yellowheart: , by Last week, 10 pull requests were merged. :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by :purpleheart: , by - - Last week there were 38 commits. :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by :hammerandwrench: by - - Last week there were 2 contributors. :bustinsilhouette: :bustin_silhouette: - - Last week there was 1 stargazer. :star: You are the star! :star2: - - Last week there were no releases. - - That's all for last week, please :eyes: Watch and :star: Star the repository to receive next weekly updates. :smiley: You can also .*
Signatures that go in the MLSPlaintext field right now only include the group ID and epoch. The group ID does help bind the message to a specific group, but group IDs are arbitrary and it seems multiple groups could have the same ID. We should include the whole group context object in the data that's signed, to prevent messages from being copied from one conversation and pasted into another conversation with the same group ID.
Yes, the lack of context has been pointed out by Karthik and I at the last interim. I said I would fix this but I didn’t find time to write the PR yet, I’ll try to do that today. Thanks for the remainder...
The protocol currently uses the public keys in the leaves of the ratchet tree for two purposes: For encrypting path secrets, and for encrypting WelcomeInfo data. We should include the type of message we're sending in the HPKE AAD for that message. Taking messages meant for one purpose and using them for another might leak information about the plaintext because decryption will succeed but not subsequent processing. Ex: Putting a ciphertext containing a path secret in a Welcome message and observing error "unknown group id: abcdef123..." or similar
Question: Should this be HPKE or ?

Discussion:
The HPKECiphertext values are computed as where "node_public_key" is the public key of the node that the path <del> secret is being encrypted for, and the functions "SetupBaseI" and </del> <ins> secret is being encrypted for, group_context is the current GroupContext object for the group, and the functions "SetupBaseI" and </ins> "Seal" are defined according to I-D.irtf-cfrg-hpke. Decryption is performed in the corresponding way, using the private

signing private key corresponding to the credential at the leaf in the tree indicated by the sender field.  The signature covers the plaintext metadata and message content, i.e., all fields of <del> MLSPlaintext except for the "signature" field. </del> <ins> MLSPlaintext except for the "signature" field.  The signature also covers the GroupContext for the current epoch, so that signatures are specific to a given group and epoch. </ins> The ciphertext field of the MLSCiphertext object is produced by supplying the inputs described below to the AEAD function specified