# Membership

> Weald pins one MLS ciphersuite, RFC 9420 with X25519, AES-128-GCM and Ed25519. The binding, the handshake and device identity, published.

Source: https://getweald.com/docs/protocol/mls
Last modified: 2026-08-03

---

## One ciphersuite

Last updated 2026-08-03

Group membership and content encryption are MLS, RFC 9420. The profile is pinned to a single ciphersuite, 0x0001, which is MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519. An implementation that offers a second suite is not conforming.

## The pinned profile

- Ciphersuite 0x0001, and no other.
- Credentials are basic.
- The Weald extension set is empty.
- The protocol version is mls10.

One suite rather than a negotiation, because a negotiated ciphersuite is a downgrade surface and a matrix of combinations nobody tests. The cost is that changing it is a breaking change.

## What an epoch buys

Adding, removing or updating a member advances the group's epoch and rotates its keys. That is what makes a revocation real rather than a flag somebody could ignore: after the epoch changes, the removed device no longer has the keys, and the relay stops serving it because the access set moved with it.

Members joining enter by external commit, so there is no waiting state and no half-joined member.

## Changing the ciphersuite

The binding document carries the change path and a five stage deprecation calendar over eighteen months, with two named emergency exceptions. A ciphersuite change is a breaking change under the governance rules and is versioned as one.

That calendar exists so an implementer can plan. Versioning covers the rules it sits inside.

## Documents

- MLS binding. The pinned ciphersuite, credential type, extension set and change path.
- Authentication. The handshake, the signed challenge and how a device is bound to a key.
- Identity. Devices, delegated agent keys, and what a signature attributes.
- Groups. The access set, epoch changes, and who a relay will accept a frame from.
- Invites. Joining a workspace, and the one unauthenticated path a relay serves.
- Transport. TLS requirements, certificate pinning and trust on first use.

## What this does not cover

MLS secures the group. It does not hide that a group exists, how large its traffic is, or when it is busy, and a relay operator sees all three.

It also does not protect a device that has been compromised. A member device holds plaintext, and the boundary this section describes ends at the edge of that device.