12/08/26 Bi-Weeky libp2p Spec Meeting

[johannamoran]

Attendees

@seetadev
@johannamoran
@gmelodie

Spec Lifecycle Stages

1. RFC [piloting]
2. Working Draft [POC in implement + Spec PR]
3. Candidate recommendation [ >2 implementations with interop recommended]
4. Recommendation [> 3 implementations and interop completed with applicable]

Agenda

Two new PRs discuss on previous Bi-Weekly Spec call. : Encrypted Client Hello (ECH) and topic extensions for QUIC announced. See directly below. Number 1 and 2 below.

---

1. [TLS Handshake to enable support for RFC 9849: TLS Encrypted Client Hello}]

Relevant Links
#730

UPDATE SINCE 29/07

• Inviting maintainer implementations to review and experiment with QUIC and ECH.

---

2. [Topic Streams Extension addition in Gossipsub: moves topic scoped application messages to separate long-lived streams] [link]

Relevant Links
libp2p/test-plans#860

UPDATE SINCE 29/07

• Recommending other implementation maintainers to review Spec PR and participate in Gossip Interop Testplans. For reference, please see feat(gossipsub-interop): add topic-streams HoL scenario test-plans#860 @gmelodie FYI.

---

WebRTC Direct V2 [Now at candidate recommendation]

Relevant Links

• [Summary] by lidel on WebRTC-Direct + Chrome changes (specs#672 comment at WebRTC-Direct: Chrome may be removing ICE credential munging #672 (comment) )
• [Spec PR Link] docs: webrtc-direct-v2 #715
• [Issue Link] WebRTC-Direct transport at risk due to Chrome changes (ICE credential munging): alignment and next steps go-libp2p#3499
• [js-libp2p PR Link] feat: webrtc-direct-v2 js-libp2p#3480
• [py-libp2p PR Link] feat(webrtc): add WebRTC transport scaffolding (spec compliance + tests) py-libp2p#1309 (comment)
• [go-libp2p Reference Link] feat(webrtc): stable /certhash across restarts go-libp2p#3512

UPDATE SINCE 29/07 Spec meeting

• WebRTC Direct V2 was implemented and available for general use in new go-libp2p go-libp2p (v0.49.0) and py-libp2p (py-libp2p 0.7.0) releases.

Next Steps

• Waiting on js-libp2p @dozyio to implement minor modifications and add it to the Spec.
• @lidel completed WebRTC Direct V2 Transport Interop testing between go-libp2p and js-libp2p sucessfully.
• Spec PR almost ready for merge and therefore moving towards Spec Lifecycle Stage 4: Recommendation.

---

[SECURITY] GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions [RFC Stage]

• [Advisory Link 1] https://vulnerability.circl.lu/vuln/ghsa-4f8r-922h-2vgv
• [Advisory Link 2] GHSA-4f8r-922h-2vgv
• [cpp-libp2p PR Issue Link] Security: GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions cpp-libp2p#349

UPDATE SINCE 29/07 Spec meeting

• Spec PR on memory exhaustion has been completed in c-libp2p and go-libp2p
• Plan to move this into candidate recommendation as this is implemented in cpp-libp2p, py-libp2p in progress

Next Steps

• Looking forward to discussing with @lidel and other implementation maintainers on the current state of the pr and checking suitability to land in Spec repo.

---

Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely

• [Issue Link] Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely go-libp2p-pubsub#705

UPDATE SINCE 29/07 Spec meeting

• CVE published [link]

---

datagrams: Add initial datagram draft (datagram that require acknowledgment)

[Spec PR] #680

UPDATE SINCE 29/07 Spec meeting

• @gmelodie @richard-ramos from nim-libp2p team actively reviewing this.

Next Steps

---

gossipsub: add SPREAD extension spec

[Spec PR] #726

UPDATE SINCE 29/07 Spec meeting

• @seetadev shared roadmap to implementing SPREAD extension spec in py-libp2p

Next Steps

---

New Spec PRs

###Object Cache [link]

Background
Introduces the initial Waggle specification for libp2p. It defines a mechanism for disseminating objects through incremental publication of their constituent pieces, allowing different peers to propagate pieces they possess and progressively build a complete view of an object across the network. The draft also covers peer discovery/dissemination behavior, object and piece state, and the protobuf message structure.

The PR is currently being refined through review. Feedback has already led to changes around restricting dissemination to peers subscribed to the relevant topic, removing unnecessary requirements around randomness, and updating the protobuf schema. One of the main remaining design discussions is around object caching, specifically whether caching should be managed by Waggle itself or left to the application, including how TTL and resource constraints should be handled.

Overall, this is an early protocol-design PR intended to start the specifications discussion, gather implementation and interoperability feedback, and converge on the core Waggle semantics before the specification is considered mature.

Next Steps

---

noise: hybrid post-quantum handshake (X25519 + ML-KEM-768)

Background
This PR introduces a concrete draft specification for a hybrid post-quantum Noise handshake that combines X25519 with ML-KEM-768.
The proposal builds on the Noise XX pattern and uses Noise HFS to mix ML-KEM-768 into the handshake. It is designed as an additive, separately negotiated extension to the existing /noise protocol, allowing implementations to support the hybrid handshake without requiring a flag day.

Relevant Links
[link]

Next Steps

• Requesting @dozyio, @tabcat, @seetadev to review pls :)

---

AOB