mlswg / mls-protocol

MLS protocol
https://messaginglayersecurity.rocks
Other
234 stars 60 forks source link

Make the ratchet tree non-malleable #868

Closed TWal closed 1 year ago

TWal commented 1 year ago

As discussed in mlswg/mls-implementations#102 .

Currently, there are several valid ratchet_tree for one tree: the sender can choose ("SHOULD") to omit some (but not all) blank nodes at the right of the tree. This PR changes this: the sender MUST omit all the blank nodes at the right of the tree, and the receiver MUST check that it was done correctly (i.e., the last node of ratchet_tree is non-blank).