Original text:
Private key (optional) <del> Privaate key seed data (optional) </del>  Leaf creation: Just import data Puncture tree heads are nodes that are OK whose parents are not OK <del> [[ Following sections to be filled from earlier PDF/code + diffs from the London meeting ]] </del> 5.  6.  6.1.  6.2. <del> 6.3. </del>  <del> 6.4. </del>  <del> 6.5. </del>  <del> 6.6. </del>  7.  Each state-changing message is premised on a given starting state Thus, there is a need to deconflict if two messages are generated In any case, risk of starvation <del> 7.1. </del>  With this approach, the server ensures that incoming messages are added to an ordered queue and outgoing messages are dispatched in the This apllies to all messages, not only state changing messages. <del> 8. </del>  The primary purpose of this protocol is AKE choose to ignore it (if the value is not known, or if transcript security is not required). <del> 9. Key Secrecy Authentication Re-use of InitKeys </del> 10. <del> 11. The Asynchronous Ratcheting Tree is the building block around which this protocol is built.  It was originally specified by Cohn-Gordon et al with a formal proof of its security properties (https://eprint.iacr.org/2017/666). ART uses a Diffie-Hellman Key Tree to derive a shared secret for a group, allowing it to be efficiently updated (ratcheted) by any group member (leaf node) to provide the properties of Forward Secrecy and Post-Compromise Security.  Alongside ratcheting, receiving messages, and changing the group membership can also be efficiently achieved. 11.1. ART uses a recursive structure, in which every node is a Diffie- Hellman public key or key pair.  The value of a given parent node's private key is computed as follows: (TODO: define our KDF). The ART root secret is the private Diffie-Hellman key of the root of the tree.  This should not be used directly within the protocol, but rather computed into a Stage Key (TODO: below). For this document, we will use the shorthand notation [A,B] to indicate KDF(DH(Alice, Bob)). 11.2. Changing a leaf DH key will inherently update its entire path to and including the root. In the above tree, if C updates to C', the path of all nodes referencing C is updated, resulting in the below tree. C must transmit the public keys of her entire path to the other participants in the tree.  Each participant will update their copath with their respective element from this path, and thus recompute the same updated tree that C has computed. 11.3. 11.4. 12. [[ Session comprised of (1) ART (2) pre-stage key (3) message key chains ]] [[ Each node caches... ]] 13. In MLS, the endpoints involved in a session collaborate to establish and maintain an Asynchronous Ratchet Tree for the session.  There are three major phases in the life-cycle of a group: Initializing the tree Adding a new endpoint Updating a leaf in the tree Leaves are never removed from tree.  One endpoint can remove another endpoint by updating that endpoint's leaf to a key that the endpoint being removed does not possess. At any point, an endpoint can publish a PreKey message, which contains information that another endpoint can use to add that endpoint to a group.  Typically applications provide a PreKey cache to which endpoints periodically push fresh PreKey messages. Suppose an endpoint A wants to initiate a group conversation with otehr endpoints B, C, and D.  A accomplishes this by downloading PreKeys fro B, C, and D, computing a tree over (A, B, C, D), and sending different individual Setup messages to B, C, and D. If A subsequently wants to add another endpoint E to the conversation, then the process is similar.  First A downloads a PreKey for E and uses it to add E to the tree.  From these computations, A generates a Setup message for E and an Add message that can be broadcast to B, C, and D. Upon being added, E should update its leaf key so that its leaf key will not be known to A.  To update a leaf key in the tree, an endpoint simply generates a new key pair, creates an Update message, and broadcasts it to the group. 13.1. Each MLS endpoint caches a view of the overall tree including certain global elements and certain elements specific to the endpoint: For the group: The current epoch The list of identity keys for the group The current frontier The current preStageKey For the endpoint: Index in the tree Leaf key pair Copath MLS messages synchronize this state information across the participants in the group. Note that no state is modified when an endpoint sends a Setup, Add, or Update message.  Because all endpoints need to process updates to the tree in the same order, there is a risk that any given message of these types will be rejected.  To avoid the need to roll back on such rejections, endpoints only apply Setup / Add / Update messages once they are published and accepted by the group.  For more discussion of how modifications to the tree should be sequenced, see #sequencing- of-modifications. 13.2. 13.2.1. 13.2.2. 13.2.3. 13.2.4. 13.3. [[ Endpoints need to make modifications to the tree in the same order.  How does that happen? ]] 14. </del>  <del> [[ What trust is placed in the server? ]] </del>  <del> 15. </del> 

Reviewer comments:
This PR adds a pretty complete description of the protocol. The only major thing that's missing is , which should be straightforward-ish to construct. NAME want to take a stab at that?

Revised text:
Private key (optional)  <ins> Private key seed data (optional) </ins> Leaf creation: Just import data Puncture tree heads are nodes that are OK whose parents are not OK  5. <ins> Logically, the state of an MLS group at a given time comprises: A group ID A ciphersuite used for cryptographic computations A Merkle tree over the participants' identity keys A ratchet tree over the participants' leaf key pairs A message root key (known only to participants) An add key pair (private key known only to participants) An init secret (known only to participants) Since a group can evolve over time, a session logically comprises a sequence of states.  The time in which each individual state is used is called an "epoch", and each state is assigned an epoch number that increments when the state changes. MLS handshake message provide each node with enough information about the trees to authenticate messages within the group and compute the group secrets. Thus, each participant will need store the following information about each state of the group: The participant's index in the identity/ratchet trees The private key for the participant's leaf key pair The private key for the participant's identity key pair The current epoch number The group ID A subset of the identity tree comprising at least the copath for the participant's leaf A subset of the ratchet tree comprising at least the copath for the participant's leaf The current message root key The current update key pair The current init secret 5.1. Each MLS session uses a single cipher suite that specifies the following values to be used in group key computations: A hash function A Diffie-Hellman group Public keys used in the protocol are opaque values in a format defined by the ciphersuite. 5.2. Group keys are derived using the HKDF-Extract and HKDF-Expand functions as defined in RFC5869, as well as the functions defined below: The Hash function used by HKDF is the cipher suite hash algorithm. Hash.length is its output length in bytes.  In the below diagram: HKDF-Extract takes its Salt argument form the top and its IKM argument from the left Derive-Secret takes its Secret argument from the incoming arrow When processing a handshake message, a participant combines the following information to derive new epoch secrets: The init secret from the previous epoch The update secret for the current epoch The handshake message that caused the epoch change The current group ID and epoch The derivation of the epoch key pair depends on the change being made.  For the first epoch, when there is no previous epoch key pair, the creator of the group generates a fresh key pair and publishes it to the initial set of participants. Given these inputs, the derivation of secrets for an epoch proceeds as shown in the following diagram: </ins> 6. <ins> In order to facilitate asynchronous addition of participants to a group, it is possible to pre-publish initialization keys that provide some public information about a user or group.  UserInitKey messages provide information a user that a group member can use to add the user to a group without the user being online.  GroupInitKey messages provide information about a group that a new user can use to join the group without any of the existing members of the group being online. </ins> 6.1. <ins> A UserInitKey object specifies what cipher suites a client supports, as well as providing public keys that the client can use for key derivation and signing.  The client's identity key is intended to be stable through the lifetime of the group; there is no mechanism to change it.  Init keys are intend to be used one time only (or perhaps a small number of times, see #init-key-reuse). The init_keys array MUST have the same length as the cipher_suites array, and each entry in the init_keys array MUST be a public key for the DH group defined by the corresponding entry in the cipher_suites array. The whole structure is signed using the client's identity key.  A UserInitKey object with an invalid signature field MUST be considered mal-formed.  The input to the signature computation comprises all of the fields except for the signture field. </ins> 6.2.  <ins> A GroupInitKey object specifies the aspects of a group's state that a new member needs to initialize its state (together with an identity key and a fresh leaf key pair). The current epoch number The number of participants currently in the group The group ID The cipher suite used by the group The public key of the current update key pair for the group </ins>  <ins> The frontier of the identity tree, as a sequence of hash values </ins>  <ins> The frontier of the ratchet tree, as a sequence of public keys </ins>  <ins> GroupInitKey messages are not themselves signed.  A GroupInitKey should not be published "bare"; instead, it should be published by constructing a handshake message with type "none", which will include a signature by a member of the group and a proof of membership in the group. </ins> 7. <ins> Over the lifetime of a group, changes need to be made to the group's state: Initializing a group A current member adding a new participant A new participant adding themselves A current participant updating its leaf key A current member deleting another current member In MLS, these changes are accomplished by broadcasting "handshake" messages to the group.  Note that unlike TLS and DTLS, there is not a consolidated handshake phase to the protocol.  Rather, handshake messages are exchanged throughout the lifetime of a group, whenever a change is made to the group state. An MLS handshake message encapsulates a specific message that accomplishes a change in group state, and also includes two other important features: First, it provides a GroupInitKey so that a new participant can observe the latest state of the handshake and initialize itself.  Second, it provides a signature by a member of the group, together with a Merle inclusion proof that demonstrates that the signer is a legitimate member of the group. Before considering a handshake message valid, the recipient MUST verify both that the signature is valid and that the Merkle inclusion proof is valid.  The input to the signature computations comprises the entire handshake message except for the signature field. The Merkle tree head to be used for validating the inclusion proof MUST be one that the recipient trusts to represent the current list of participant identity keys. 7.1. [[ Direct initialization is currently undefined.  A participant can create a group by initializing its own state to reflect a group including only itself, then adding the initial participants.  This has computation and communication complexity O(N log N) instead of the O(N) complexity of direct initialization. ]] 7.2. An GroupAdd message is sent by a group member to add a new participant to the group.  The contents of the message are simply the UserInitKey for the user being added. A group member generates such a message by downloading a UserInitKey for the user to be added.  The added participant processes the message together with the private key corresponding to the UserInitKey to initialize his state as follows: Compute the participant's leaf key pair by combining the init key in the UserInitKey with the prior epoch's update key pair Use the frontiers in the GroupPreKey of the Handshake message to add its keys to the trees An existing participant receiving a GroupAdd message first verifies the signature on the message, then verifies its identity proof against the identity tree held by the participant.  The participant then updates its state as follows: Compute the new participant's leaf key pair by combining the leaf key in the UserPreKey with the prior epoch add key pair Update the group's identity tree and ratchet tree with the new participant's information The update secret resulting from this change is the output of a DH computation between the private key for the root of the ratchet tree and the add public key from the previous epoch. [[ ALTERNATIVE: The sender could also generate the new participant's leaf using a fresh key pair, as opposed to a key pair derived from the prior epoch's secret.  This would reduce the "double-join" problem, at the cost of the GroupAdd having to include a new ratchet frontier. ]] 7.3. A UserAdd message is sent by a new group participant to add themselves to the group, based on having already had access to a GroupInitKey for the group. A new participant generates this message using the following steps: Fetch a GroupInitKey for the group Use the frontiers in the GroupPreKey to add its keys to the trees Compute the direct path from the new participant's leaf in the new ratchet tree (the add_path). An existing participant receiving a UserAdd first verifies the signature on the message, then verifies its identity inclusion proof against the updated identity tree expressed in the GroupPreKey of the Handshake message (since the signer is not included in the prior group state held by the existing participant).  The participant then updates its state as follows: Update trees with the descriptions in the new GroupInitKey Update the local ratchet tree with the add path in the UserAdd message, replacing any common nodes with the values in the add path The update secret resulting from this change is the secret for the root node of the ratchet tree. 7.4. An Update message is sent by a group participant to update its leaf key pair.  This operation provides post-compromise security with regard to the participant's prior leaf private key. The sender of an Update message creates it in the following way: Generate a fresh leaf key pair Compute its direct path in the current ratchet tree An existing participant receiving a Update message first verifies the signature on the message, then verifies its identity proof against the identity tree held by the participant.  The participant then updates its state as follows: Update the cached ratchet tree by replacing nodes in the direct path from the updated leaf with the corresponding nodes in the Update message The update secret resulting from this change is the secret for the root node of the ratchet tree. 7.5. A delete message is sent by a group member to remove one or more participants from the group. The sender of a Delete message creates it in the following way: Compute the ordered list of subtree heads by puncturing the deleted participants' leaves from the current ratchet tree Generate a fresh DH key pair and initialize a "delete path" to the one-element list containing that key pair For each subtree head in the list: Perform a DH computation between the subtree head's public key and the private key from the last key pair in the delete path Derive a DH key pair from the output of that DH computation Append the resulting key pair to the delete path The head field in the Delete message holds the public keys corresponding to the subtree heads.  The path field holds the public keys corresponding to the delete path, with the last element omitted (it is unnecessary).  As a result, the heads and path arrays MUST have the same length. Note that the sender of a Delete message must enough information about the ratchet tree so that it has all of the subtree heads resulting from the puncture operation.  This criterion is met if the sender has a copath for each of the deleted participants. An existing participant receiving a Delete message first verifies the signature on the message, then verifies its identity proof against the identity tree held by the participant.  The participant then updates its state as follows: Compute the ordered list of subtree heads by puncturing the deleted participants' leaves from the current ratchet tree Find a public key in the list of subtree heads for which the private key is known to the recipient Perform a DH computation between the known subtree head private key and the public key in the delete path at the same index For each remaining element in the list of subtree heads: Derive a DH key pair from the last DH output Perform a DH computation between the private key of the derived key pair with the subtree head's public key The update secret for this change is the last DH output from the delete path. 8. </ins> Each state-changing message is premised on a given starting state Thus, there is a need to deconflict if two messages are generated In any case, risk of starvation  <ins> 8.1. </ins> With this approach, the server ensures that incoming messages are added to an ordered queue and outgoing messages are dispatched in the This apllies to all messages, not only state changing messages.  <ins> 9. </ins> The primary purpose of this protocol is AKE choose to ignore it (if the value is not known, or if transcript security is not required).  10.  <ins> 10.1. </ins>  <ins> 10.2. </ins>  <ins> 10.3. </ins>