Openmls

We’re releasing OpenMLS 0.9.0, our latest step toward a stable, standards-compliant implementation of Messaging Layer Security (MLS, RFC 9420). 📦 https://crates.io/crates/openmls Migrating storage between formats If you’ve been running OpenMLS in production, you’ve probably had to think about how group state is serialized on disk. 0.9.0 adds an opt-in migration-import feature that gives you a path to move existing group state to a storage provider using a different serde codec. For example, from bincode to CBOR. MlsGroup and PublicGroup both gain import entry points that re-read state with the old codec and fully rewrite it with the new one. We’ve also added a new book chapter walking through the eager and lazy per-group migration strategies. ...

OpenMLS has undergone a security audit sponsored by the Sovereign Tech Agency. The audit was conducted by SRLabs who have finished their work earlier this year. In summary, 8 issues were found, one of them (improper authentication of MACs) rated “High” severity. All issues were remediated for OpenMLS versions 8.1 and 7.3 with the exception of one “Low” rated issue the fix for which is still in the works. You can find the full report here. ...

In February, we merged 17 pull requests. The TreeSync module now has public accessors to make it easier for developers to inspect, the state of the Ratchet Tree. This may be used to optimize commit behaviour. We also released new point releases for OpenMLS, picking up security fixes in dependencies. We recommend everyone to update. v0.8.1 New features #1955: Expose functions that allow access to (blank) leaves and parent nodes Changed #1964: update libcrux and rust_crypto provider dependencies, due to https://github.com/cryspen/libcrux/security/advisories/GHSA-435g-fcv3-8j26 and https://github.com/cryspen/hpke-rs/security/advisories/GHSA-g433-pq76-6cmf Links Github Release Crate v0.7.4 The security fixes for libcrux and rust_crypto provider dependencies were backported to the v0.7 release as v0.7.4. ...

January 2026 brought steady progress (15 PRs merged) on robustness and APIs: dependency and CI updates, wasm bindings and API improvements, protocol feature additions (AppData mechanisms and GREASE handling), better TreeSync error handling and PSK checks, plus work to store pending proposals. We also released two new versions of OpenMLS (technically in February on the 4th not in January). v0.7.2 This release includes critical security patches addressing vulnerabilities identified through external security research. We recommend all users update to the latest version immediately. ...

December with the holiday season was a quiet month for OpenMLS. Merged PRs December 2025 #1919: chore: update hpke-rs to 0.5.0 #1911: bump hpke to 0.4 #1910: fix: correction in tree operations KAT Contributors @raphaelrobert @franziskuskiefer

We merged 22 PRs in November. New Features and Fixes 🚀 We added a couple features from the MLS exntesions draft. OpenMLS now supports safe HPKE encrypt/decrypt with label, allowing applications to safely encrypt to public keys. It also supports the AppEphemeral proposal. The AppAck handling was updated in line with the extensions draft. Other parts of the supporting crates got updated to work with the features from the extensions draft. All features from the extensions draft are behind the extensions-draft-08 for now. ...

We merged 10 PRs in October. New Features and Fixes 🚀 This month saw a number of improvements and additions. New sqlx based storage provider: A new storage provider based on sqlx has been added, offering a another robust and feature-rich alternative for persistence (1854). Performance improvements: We’ve added a new from_components method to TreeNode to avoid unnecessary allocations, which should give a nice performance boost in tree operations (1864). PSK Validation: Pre-shared key validation has been improved, especially when processing Welcome messages (1862, 1863). API Re-addition: Make it easier to re-add clients that got forked (1855). Validation Fixes: We continue to improve our validation logic. This month we updated the validation for extension types in leaf node extensions (1831) and fixed references to the validation dashboard in some of our tests (1861). Contributors 🎉 We are also thrilled to welcome @WaterWhisperer as a new contributor. ...

We merged 15 PRs in September and released OpenMLSv0.7.1. v0.7.1 Release 🔐 The most critical update this month was the release of v0.7.1, which addresses a security vulnerability. We urge all users to upgrade to this version as soon as possible to ensure their applications remains secure. You can find more details about the vulnerability in the official security advisory: GHSA-qr9h-x63w-vqfm. New Features and Fixes 🚀 September and this release also saw the addition of some handy new features and important bug fixes: ...

We merged 8 PRs in August. Not bad for a summer month 🌞. We welcome @tbehner as a first time contributor, solving a long standing issue by adding the hmac function to OpenMlsCrypto trait. Thanks to @kkohbrok it is now also much easier to build external commits with the new external commit builder. let (mut dave_group, _bundle) = MlsGroup::external_commit_builder() .with_config(mls_group_config.clone()) .build_group(provider, verifiable_group_info, dave_credential) .unwrap() .load_psks(provider.storage()) .unwrap() .build( provider.rand(), provider.crypto(), &dave_signature_keys, |_| true, ) .unwrap() .finalize(provider) .expect("Error joining from external commit"); Merged PRs August 2025 #1829: Doc fixes #1828: disable large tree test #1825: adding the hmac function to OpenMlsCrypto #1824: make clippy happy #1823: Update README.md in sqlite storage #1822: chore: Add TryFrom for VerifiableCiphersuite #1814: Allow configuration of leaf node lifetime checks on join #1801: External commit builder Contributors @wysiwys @franziskuskiefer @tbehner @kkohbrok

We merged 16 PRs in July with fixes to documentation and code improvements, and most importantly, OpenMLS v0.7 got released 🎉. Important fixes that got merged in July are #1797, which ensures that the ratchet tree is trimmed correctly after processing proposals, and #1793, which corrects the calculation of the free index when inserting a new leaf node into the ratchet tree in certain cases. OpenMLS now also supports GroupContextExtensions in external proposals. ...