<p>At today's meeting we briefly discussed how we would go about updating the KEM algorithm used to establish MLS keys.</p> <p>I mentioned the BeeKEM (<a href="https://eprint.iacr.org/2026/1434" rel="nofollow ugc">https://eprint.iacr.org/2026/1434</a>, <a href="https://github.com/swicg/activitypub-e2ee/issues/95" rel="nofollow ugc">https://github.com/swicg/activitypub-e2ee/issues/95</a>) protocol as an example, though I have concerns about this particular protocol. The lead authors are currently PhD students, and this is potentially part of their program (no issue there). [...]</p>
At today's meeting we briefly discussed how we would go about updating the KEM algorithm used to establish MLS keys.
I mentioned the BeeKEM (https://eprint.iacr.org/2026/1434https://github.com/swicg/activitypub-e2ee/issues/95) protocol as an example, though I have concerns about this particular protocol. The lead authors are currently PhD students, and this is potentially part of their program (no issue there). My main problems are that there is a non-trivial amount of LLM use in their reference implementation, it is not clear to what extent LLMs were used to write the paper, and they weaken the Forward-Secrecy + Post-Compromise Security properties to support their newly introduced Consistency Under Concurrency property. The paper is still in pre-print, so I would be very interested to read any reviews from cryptographers in the field before incorporating/implementing the protocol in ActivityPub.
Other algorithms like dMLS (https://www.ietf.org/archive/id/draft-kohbrok-mls-dmls-02.html) and de-MLS (https://research.logos.co/rlog/de-mls-with-waku) could be used as well. Something built on FediE2EE-PKD (https://github.com/fedi-e2ee/public-key-directory-specification/blob/main/Specification.md#message-attribute-shreddability) could also be a solution, TBD.
To ensure we have a clear path to upgrade when more secure and/or private protocols are available, it would be good to specify some form of versioned cryptography similar to what is used in PASETO (https://github.com/paseto-standard/paseto-spec)
