23/06/26 Bi-Weeky libp2p Spec Meeting

[johannamoran]

Meeting Link

https://huddle01.app/room/ktc-hnfs-aop

Attendees

@seetadev
@johannamoran
@jxs
@yiannisbot
@cortze
Mathias
@sumanjeet0012

Spec Lifecycle Stages

1. RFC [piloting]
2. Working Draft [POC in implement + Spec PR]
3. Candidate recommendation [ >2 implementations with interop recommended]
4. Recommendation [> 3 implementations and interop completed with applicable]

Agenda

WebRTC Direct V2 [Reaching candidate recommendation]
Relevant Links

• [Summary] by lidel on WebRTC-Direct + Chrome changes (specs#672 comment at WebRTC-Direct: Chrome may be removing ICE credential munging #672 (comment) )
• [Spec PR Link] docs: webrtc-direct-v2 #715
• [Issue Link] WebRTC-Direct transport at risk due to Chrome changes (ICE credential munging): alignment and next steps go-libp2p#3499
• [js-libp2p PR Link] feat: webrtc-direct-v2 js-libp2p#3480
• [py-libp2p PR Link] feat(webrtc): add WebRTC transport scaffolding (spec compliance + tests) py-libp2p#1309 (comment)
• [go-libp2p Reference Link] feat(webrtc): stable /certhash across restarts go-libp2p#3512

UPDATE SINCE 06/06 Spec meeting

go-libp2p: libp2p/go-libp2p#3520 [Complete- ready for review]
js-libp2p: libp2p/js-libp2p#3480 [Almost complete - final polishing by Ste]
py activity: libp2p/py-libp2p#1309 [Aligning with go and js]

Recent updates in Specs - #715 (review)

Next Steps

• @dozyio to implement in V2 first and then V1 fallback.
• @jxs to look into what's needed to implement in rust.
• py also aligning with go and js.
• PRs for final review and merge to Specs as a candidate recommendation
• Alignment with other libp2p maintainers to upgrade webRTC Direct V2 [dotnet, nim, zig, cpp, c]
• Alignment with other contributors to do transport interop using webRTC Direct V2 with a view to moving this to candidate recommendation [interop testing]
• Make explicit in Spec to implement in V1 or V2. @seetadev to confirm and share broadly.
• Get clarity on deprecation date @seetadev.

---

PQC [RFC Stage]

• [Spec PR Link] docs: pkix #717
• [js-libp2p PR Link] feat: Post quantum identities with ML-DSA js-libp2p#3432

###Update
Currently PKIX is where we are heading. ML-DSA and PKCS have been discussed.

Next Steps

• Consenus building on PQC technique or Algorithm to be adopted in libp2p.
• Investigate other blockchains who have implemented and feedback to Spec group.

---

[SECURITY] GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions [RFC Stage]

• [Advisory Link 1] https://vulnerability.circl.lu/vuln/ghsa-4f8r-922h-2vgv
• [Advisory Link 2] GHSA-4f8r-922h-2vgv
• [cpp-libp2p PR Issue Link] Security: GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions cpp-libp2p#349

###Update

• rpc limits added in GossipSub - feat(gossip): Add RPC limits cpp-libp2p#350

Next Steps

• @johannamoran to raise a Spec PR with a view to moving this to Working Draft stage

---

Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely

• [Issue Link] Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely go-libp2p-pubsub#705

Update

• Clean up empty topic state maps go-libp2p-pubsub#708 [Complete and merged]

Next Steps

• @johannamoran to raise a Spec PR with a view to moving this to Working Draft stage

---

datagrams: Add initial datagram draft (datagram that require acknowledgment)

[Spec PR] #680

Update

• PR open and @jxs would like to merge.

Next Steps

• @johannamoran to share in py, js, cpp, nim.

---

AOB