# Glossary

Alphabetical glossary of terms used throughout the quicproquo documentation.
Each entry includes a brief definition and, where applicable, a reference to the
relevant specification or documentation page.

---

**AEAD** -- Authenticated Encryption with Associated Data. A symmetric encryption
scheme that provides both confidentiality and integrity. quicproquo uses
AES-128-GCM (in the MLS ciphersuite). See [Cryptography Overview](../cryptography/overview.md).

**ALPN** -- Application-Layer Protocol Negotiation. A TLS extension that allows
the client and server to agree on an application protocol during the TLS
handshake. quicproquo uses the ALPN token `b"capnp"` to identify Cap'n Proto
RPC connections. See [QUIC + TLS 1.3](../protocol-layers/quic-tls.md).

**AS** -- Authentication Service. The server component that stores and
distributes single-use MLS KeyPackages. Clients upload KeyPackages after identity
generation; peers fetch them to add new members to a group.
See [Architecture Overview](../architecture/overview.md).

**Cap'n Proto** -- A zero-copy serialisation format with a built-in RPC system.
quicproquo uses Cap'n Proto for all wire messages and service RPCs. Schemas
live in `schemas/*.capnp` and are compiled to Rust at build time.
See [Cap'n Proto Serialisation and RPC](../protocol-layers/capn-proto.md).

**Commit** -- An MLS message type that advances the group to a new epoch. When a
member sends a Commit (e.g., after adding or removing a member), all group
participants update their key schedule. Commits are the mechanism for both
forward secrecy and post-compromise security.
See [MLS (RFC 9420)](../protocol-layers/mls.md).

**Credential** -- An MLS identity binding that associates a member's signing key
with their identity. quicproquo uses `BasicCredential`, which contains the
raw Ed25519 public key bytes. See
[Ed25519 Identity Keys](../cryptography/identity-keys.md).

**DER** -- Distinguished Encoding Rules. A binary encoding format for ASN.1
structures, used for X.509 certificates and TLS certificate chains. The
self-signed TLS certificate generated by quicproquo is DER-encoded.

**DS** -- Delivery Service. The server component that provides store-and-forward
relay for opaque MLS payloads. The DS never inspects ciphertext -- it routes
solely by recipient public key and optional channel ID.
See [Architecture Overview](../architecture/overview.md).

**Ed25519** -- Edwards-curve Digital Signature Algorithm on Curve25519. Used for
MLS identity credentials and signing (KeyPackages, Commits, group operations).
quicproquo uses the `ed25519-dalek` crate.
See [Ed25519 Identity Keys](../cryptography/identity-keys.md).

**Epoch** -- The version number of an MLS group's key state. Each Commit
advances the epoch by one. Messages encrypted under epoch *n* cannot be
decrypted by members who have advanced to epoch *n+1*, providing forward secrecy.
See [Forward Secrecy](../cryptography/forward-secrecy.md).

**Forward Secrecy (FS)** -- The property that past sessions remain secure even
if long-term keys are later compromised. In MLS, forward secrecy is achieved by
the epoch ratchet: key material from earlier epochs is deleted when the epoch
advances. See [Forward Secrecy](../cryptography/forward-secrecy.md).

**HKDF** -- HMAC-based Key Derivation Function. Used in MLS to derive symmetric
keys from shared secrets. quicproquo uses HKDF-SHA256.

**HPKE** -- Hybrid Public Key Encryption. The public-key encryption scheme used
in MLS for key exchange (encrypting to a KeyPackage's init key). Defined in
RFC 9180. In quicproquo, HPKE uses DHKEM(X25519, HKDF-SHA256).
See [Hybrid KEM](../protocol-layers/hybrid-kem.md).

**KEM** -- Key Encapsulation Mechanism. A cryptographic primitive that generates
a shared secret and an encapsulated (encrypted) version of that secret. Used in
HPKE and in the hybrid post-quantum construction (X25519 + ML-KEM-768).

**KeyPackage** -- An MLS structure containing a member's public key material
(HPKE init key, signing key, credential) that peers use to add the member to a
group. KeyPackages are single-use per the MLS specification (RFC 9420) -- each
is consumed on fetch. See
[ADR-005: Single-Use KeyPackages](../design-rationale/adr-005-single-use-keypackages.md).

**ML-KEM-768** -- Module-Lattice-based Key Encapsulation Mechanism, security
level 3 (NIST FIPS 203). A post-quantum KEM based on the hardness of the
module learning-with-errors (MLWE) problem. quicproquo plans to use ML-KEM-768
in a hybrid construction with X25519 at milestone M7.
See [Post-Quantum Readiness](../cryptography/post-quantum-readiness.md).

**MLS** -- Messaging Layer Security. A protocol for group key agreement defined
in RFC 9420. MLS provides forward secrecy and post-compromise security for
groups of any size through an efficient tree-based key schedule.
See [MLS (RFC 9420)](../protocol-layers/mls.md).

**PCS** -- Post-Compromise Security. The property that a protocol recovers
security after a member's state is compromised. In MLS, once a compromised
member sends an Update or Commit, subsequent epochs are secure again (assuming
the attacker does not maintain persistent access).
See [Post-Compromise Security](../cryptography/post-compromise-security.md).

**PIR** -- Private Information Retrieval. A cryptographic technique that allows
a client to fetch a record from a database without the server learning which
record was requested. Explored as a future enhancement for metadata-hiding
KeyPackage and message fetch.
See [Future Research](../roadmap/future-research.md).

**QUIC** -- A UDP-based, multiplexed, encrypted transport protocol defined in
RFC 9000. QUIC integrates TLS 1.3 for authentication and confidentiality and
provides 0-RTT connection establishment, stream multiplexing, and built-in
congestion control. quicproquo uses the `quinn` crate.
See [QUIC + TLS 1.3](../protocol-layers/quic-tls.md).

**Ratchet Tree** -- The binary tree data structure used in MLS for efficient
group key derivation. Each leaf corresponds to a group member; internal nodes
hold derived key material. Updates propagate along the path from a leaf to the
root, giving O(log N) cost for key updates in a group of N members.

**TLS 1.3** -- Transport Layer Security version 1.3, defined in RFC 8446. The
standard for authenticated, encrypted transport. quicproquo uses TLS 1.3
exclusively (via `rustls` with `TLS13` cipher suites only) as part of the QUIC
transport. See [QUIC + TLS 1.3](../protocol-layers/quic-tls.md).

**Welcome** -- An MLS message sent to new members when they are added to a
group. The Welcome contains the group state (ratchet tree, group context,
epoch secrets) encrypted under the new member's HPKE init key from their
KeyPackage. See [MLS (RFC 9420)](../protocol-layers/mls.md).

**X25519** -- Elliptic curve Diffie-Hellman key exchange on Curve25519 (using
the Montgomery form). Used as the classical component of DHKEM in MLS HPKE
and in the hybrid KEM (X25519 + ML-KEM-768).
quicproquo uses the `x25519-dalek` crate.
See [Cryptography Overview](../cryptography/overview.md).

**Zeroize** -- The practice of securely clearing sensitive data (private keys,
shared secrets) from memory when it is no longer needed. quicproquo uses the
`zeroize` crate with the `ZeroizeOnDrop` derive macro to ensure that key material
is overwritten on drop.
See [Key Lifecycle and Zeroization](../cryptography/key-lifecycle.md).
