█████████████████████████████████████████████████████████████████ █▒███ █ ▒ █ ▒ █ █ █▒█ █▒█                
██████▒███████▒███ █ █▒███▒███▒███████████████████████▒███████ █ ▒ ▒ █ ▒             █ ▒ █                 
███████████████████ █ ███████████████████████████████████████▒█▒█ █ █ █ █ █ █ █ █ █ █ █ █ █ ▒ █ █ █ █ █ █ █
▒███▒███▒███▒███▒█ ▒ ▒▒█▒███▒███▒███▒███▒███▒███████▒███▒███▒█ █     ▒    ██ ███ █▒█ █▒█ █▒                
███████████████████ █ ███████████████████████████████████████ █     █ █   █████████████████                
██▒███████▒███▒█▒█     ███▒███▒███▒███████ █▒█ █▒█▒███▒███▒█▒▒            ▒███▒█▒█ █▒█▒███                 
█████████████████ █ ▒ ███████████████████▒█▒█ █▒█ ███████████ ▒   ▒ ▒ █ ▒ █████████████████   ▒   ▒       ▒
▒███▒███▒███▒█ █ █ █ █ █▒███▒███▒█ █ █▒█ █ ▒ ▒ █ ▒ █ █ █ █▒█               █▒███ █▒█ █▒█ █ █ █ █ █▒█ █ █ █ 
███████████████████████ ███████████ ███ █▒█ █ █ █ █ █▒█ █████             ███████████████▒▒ █▒█▒█████▒█████
 █ █▒█ ███ █ █ █▒█ █ █ ▒▒█▒███████ ▒▒█▒▒ █           ▒   █ █               █▒█▒███▒███▒██▒   █ ▒ █ █ █ █▒█ 
█▒█▒█▒███▒█▒█ █▒█▒███▒  █▒███████ █ ███ █ ▒           █ ▒ █                ██████████▒███   ▒     █ ▒ █████
 ▒ █ █ █ ▒ ▒   ▒ ▒ █ █   ▒ █ █▒█ ▒   █                     ▒               █ █ █ █▒█ █ █               █ █ 
█ █ █ █▒█ █ █   █ █ █▒  █ █ ███▒█   ███                   ▒                ▒█▒█▒█▒█ █ █ █             ▒▒█▒█
       ▒             ▒       █ ▒     █                                     █▒█ ▒ █ ▒ ▒                 ▒ ▒ 
      █             ▒       █ █       ▒                                     █ ▒ ▒ █                     █  
                                                                                                           
                                                                            █

One ciphersuite

Last updated 2026-09-29

Group membership and content encryption are MLS, RFC 9420. The profile is pinned to a single ciphersuite, 0x0001, which is MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519. An implementation that offers a second suite is not conforming.

The pinned profile

Ciphersuite 0x0001 alone.
Credentials are basic.
The Weald extension set is empty.
The protocol version is mls10.

The profile pins one suite and negotiates nothing. A negotiated ciphersuite opens a downgrade path and a matrix of combinations nobody tests. The cost is that changing the suite is a breaking change.

Epochs

Adding, removing or updating a member advances the group's epoch and rotates its keys. After the epoch changes, a removed device no longer has the keys. The relay also stops serving it, because the access set moved with the epoch.

Members joining enter by external commit, so there is no waiting state and no half-joined member.

Changing the ciphersuite

The binding document carries the change path and a five stage deprecation calendar over eighteen months, with two named emergency exceptions. A ciphersuite change is a breaking change under the governance rules and is versioned as one.

That calendar exists so an implementer can plan. Versioning covers the rules it sits inside.

Documents

MLS binding. The pinned ciphersuite, credential type, extension set and change path.
Authentication. The handshake, the signed challenge and how a device is bound to a key.
Identity. Devices, delegated agent keys, and what a signature attributes.
Groups. The access set, epoch changes, and who a relay will accept a frame from.
Invites. Joining a workspace, and the one unauthenticated path a relay serves.
Transport. TLS requirements, certificate pinning and trust on first use.

What this does not cover

MLS secures the group's content. It does not hide that a group exists, how much traffic it carries or when it is busy. A relay operator sees all of that.

It also does not protect a device that has been compromised. A member device holds plaintext, and the MLS boundary ends at the edge of that device.

One ciphersuite

The pinned profile#

Epochs#

Changing the ciphersuite#

Documents#

What this does not cover#

The pinned profile

Epochs

Changing the ciphersuite

Documents

What this does not cover