07/07/26 Bi-Weeky libp2p Spec Meeting

[johannamoran]

Attendees

@seetadev
@johannamoran

Spec Lifecycle Stages

1. RFC [piloting]
2. Working Draft [POC in implement + Spec PR]
3. Candidate recommendation [ >2 implementations with interop recommended]
4. Recommendation [> 3 implementations and interop completed with applicable]

Agenda

WebRTC Direct V2 [Reaching candidate recommendation]
Relevant Links

• [Summary] by lidel on WebRTC-Direct + Chrome changes (specs#672 comment at WebRTC-Direct: Chrome may be removing ICE credential munging #672 (comment) )
• [Spec PR Link] docs: webrtc-direct-v2 #715
• [Issue Link] WebRTC-Direct transport at risk due to Chrome changes (ICE credential munging): alignment and next steps go-libp2p#3499
• [js-libp2p PR Link] feat: webrtc-direct-v2 js-libp2p#3480
• [py-libp2p PR Link] feat(webrtc): add WebRTC transport scaffolding (spec compliance + tests) py-libp2p#1309 (comment)
• [go-libp2p Reference Link] feat(webrtc): stable /certhash across restarts go-libp2p#3512

UPDATE SINCE 23/06 Spec meeting

• Both Spec PR and js-libp2p PR are ready for merge.
• Changes approved by @lidel and @seetadev and waiting on minor improvements before @dozyio merges.
• @dozyio to implement in V2 first and then V1 fallback.
• py PR has been merge. See link.
• Alignment with other libp2p maintainers to upgrade webRTC Direct V2 [dotnet, nim, zig, cpp, c]

Next Steps

• Get clarity on deprecation date @seetadev.
• Make explicit in Spec to implement in V1 or V2. @seetadev to confirm and share broadly.
• @jxs to look into what's needed to implement in rust.

---

PQC [RFC Stage]

• [Spec PR Link] docs: pkix #717
• [js-libp2p PR Link] feat: Post quantum identities with ML-DSA js-libp2p#3432

###Update
Currently PKIX is where we are heading. ML-DSA and PKCS have been discussed.

UPDATE SINCE 23/06 Spec meeting

• New Spec addition on Noise module link

Next Steps

• @dozyio to align with PKIX PR
• Awaiting feedback from other implementations (py-libp2p, dotnet-libp2p and c-libp2p) to follow PR and spec proposal.

---

[SECURITY] GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions [RFC Stage]

• [Advisory Link 1] https://vulnerability.circl.lu/vuln/ghsa-4f8r-922h-2vgv
• [Advisory Link 2] GHSA-4f8r-922h-2vgv
• [cpp-libp2p PR Issue Link] Security: GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions cpp-libp2p#349

UPDATE SINCE 23/06 Spec meeting

• rpc limits added in GossipSub - feat(gossip): Add RPC limits cpp-libp2p#350

Next Steps

• @johannamoran to raise a Spec PR with a view to moving this to Working Draft stage

---

Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely

• [Issue Link] Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely go-libp2p-pubsub#705

UPDATE SINCE 23/06 Spec meeting

• Clean up empty topic state maps go-libp2p-pubsub#708 [Complete and merged]

Next Steps

• @johannamoran to raise a Spec PR with a view to moving this to Working Draft stage

---

datagrams: Add initial datagram draft (datagram that require acknowledgment)

[Spec PR] #680

Update

• PR open and @jxs would like to merge.

Next Steps

• @johannamoran to share in py, js, cpp, nim.

---

gossipsub: add SPREAD extension spec

[Spec PR] #726

Next Steps

To be discussed

AOB