Original text:
provides FS with regard to any removed members and PCS for the committer and any updated members.  When creating or processing a Commit, three different ratchet trees and their associated GroupContexts are used: "epoch": The epoch that the group will be in after this Commit  A member of the group applies a Commit message by taking the following steps: The confirmation tag value confirms that the members of the group have arrived at the same state of the group: <del> 11.2.1. </del>  New members can join the group in two ways.  Either by being added by a group member, or by adding themselves through an external Commit. "signer".  The signature covers the following structure, comprising all the fields in the GroupInfo above "signature": <del> 11.2.1.1. </del>  External Commits are a mechanism for new members (external parties that want to become members of the group) to add themselves to a application will need to ensure that continuing, non-resync'ing members have the required PSK. <del> 11.2.1.2. </del>  The sender of a Commit message is responsible for sending a Welcome message to any new members added via Add proposals.  The Welcome

Reviewer comments:
As suggested by NAME to improve the legibility of the document structure.
Sounds good. Queue it up for after the reorg :)
This issue accompanies the e-mail [1] pointing out editorial issues with the draft and suggesting improvements. TL;DR: I don't think the draft currently is what is needed to implement MLS. It needs an editorial overhaul with a better structure. [1] URL
If we want an implementation document, which is a legitimate ask, we should write an implementation document.
What's the purpose of the document if not for implementation? In order for this draft to become an RFC it needs implementations. I don't see a way this will happen with the draft as is.
Specifying a functional behavior and providing a guide for implementation are two very different things. Re: what you suggested in your email: Internal representations of the tree, the way you number the indices, how you implement them or the fact that you store some hashes in the nodes are completely irrelevant to this document. Also, there is nothing formal about this appendix. On the other hand the information you need from this document is how to perform computations : things such as providing the arguments to the nodeencap/nodedecap functions which are required to generate a correct payload and a standard way to serialize abstract structures... etc.
Right, the document is doing neither right now.
We have two separable issues here: We need better explanation of the overall structure of the protocol (as in Franziskus' email), and we could rearrange the text to be clearer. For the first, I have filed . That provides a pretty complete overview of the protocol, covering all of the syntax and high-level operations. For the second, we should do a second PR after the other outstanding PRs have landed. Looking at the table of contents, I would propose we refactor in the following way: For top-level sections: Move to after and For subsections: Move the tree-relevant subsections of into — including , , and Split into two: Put the GroupContext definition part in a new subsection under Put the transcript updating part in a new subsection under
I have an alternative organization of the first sections: Add the one sentence definition of before the last paragraph of Swap and This seems to all flow nicely with very few forward references. A more radical rewrite might Move forward before but I don't think that is necessary. I do like Richard's proposal to split
I'm considering this fixed after the series of reorg PRs that NAME NAME and I just finished.
This is a good start. I may propose some additional refactoring of the text before ### Creating a Commit in another PR. Hi all, While trying to implement the MLS protocol from scratch I ran into a couple issues and I think there’s a general problem regarding the structure of the draft. Note that these are all editorial issues. Right now I see no straightforward way to implement the spec as there’s no clear structure. To implement even the basic tree structure it’s necessary to jump through the entire document. There’s also a lot of prose and examples and very little implementable parts. Let me give some examples: Section 5 (Ratchet Trees) reads like a non-normative section (or paper). The really interesting bit related to trees is in Appendix A. I suggest moving the formal description of the tree from Appendix A to this section. It’s impossible to implement this from the hand full examples here. There’s no description in here on how the tree actually works. For example, adding a node to the tree is defined in 10.1.1 (Add). The ratchet tree nodes as described in Section 5 don't hold a KeyPackage. But Section 7 says “As the KeyPackage is a structure which is stored in the Ratchet Tree and updated depending on the evolution of this tree”. The tree nodes have a parent hash field, which is of course part of the ratchet tree but shouldn’t be necessary for the description of the tree structure. Also, the description of the tree hash (Section 7.5) follows the definition of the parenthash extension in Section 7.4 such that it is not entirely clear which parenthash is used there (extension or node value). Section 5 also talks about commit messages without linking to them or introducing them. Having to talk about commit messages in this section is also a little confusing. The term “handshake message” is first used in Section 7.8 (Key Schedule) but never introduced. This should probably happen in 10 (Group Evolution), which doesn’t talk about handshake messages at all until 10.3 (Ratchet Tree Extension). There are probably plenty more issues like this. But I don’t think addressing any of these issues individually makes sense. I therefore suggest having an overhaul of the document structure. The way I see MLS there are a set of high-level structures and components that should be clearly described and built upon each other. There’s a data structure (tree) that is used to represent a group. Then there is the MLS group that implements a specific semantic on the tree. Operations to modify the group are specified in the handshake protocol. And application messages define messages encrypted with keys derived in the handshake protocol with the key schedule. The tree is a basic left-balanced binary tree and defines functions to create a tree, and add and remove nodes. A group is the main part of MLS, a tree with nodes of a certain type. So this part should describe what nodes look like and how the tree is used to compute tree invariants and keys. The handshake protocol defines all messages needed to perform operations on the MLS group. This is certainly not exhaustive and would need further refinement. But it’s the high-level structure I’d expect from the document. I’m sure other structures would work as well. But what we currently have isn’t what is needed to implement MLS imho. Cheers, Franziskus

Revised text:
provides FS with regard to any removed members and PCS for the committer and any updated members. <ins> 11.2.1. </ins> When creating or processing a Commit, three different ratchet trees and their associated GroupContexts are used: "epoch": The epoch that the group will be in after this Commit <ins> 11.2.2. </ins> A member of the group applies a Commit message by taking the following steps: The confirmation tag value confirms that the members of the group have arrived at the same state of the group:  <ins> 11.2.3. </ins> New members can join the group in two ways.  Either by being added by a group member, or by adding themselves through an external Commit. "signer".  The signature covers the following structure, comprising all the fields in the GroupInfo above "signature":  <ins> 11.2.3.1. </ins> External Commits are a mechanism for new members (external parties that want to become members of the group) to add themselves to a application will need to ensure that continuing, non-resync'ing members have the required PSK.  <ins> 11.2.3.2. </ins> The sender of a Commit message is responsible for sending a Welcome message to any new members added via Add proposals.  The Welcome