melos 0.0.1 → 0.1.0

data/lib/melos/struct/base.rb

@@ -1,73 +1,75 @@
 module Melos::Struct; end
 
 class Melos::Struct::Base
-  def initialize(buf)
-    context, _ = deserialize(buf)
+  # external: values this struct's select fields depend on but which belong to an
+  # enclosing struct (e.g. FramedContent.content_type for FramedContentAuthData).
+  # They are seeded into the parse context and set as instance variables, but are
+  # not part of STRUCT and so are never serialized.
+  def initialize(stream, **external)
+    stream = StringIO.new(stream) if stream.is_a?(String)
+    context = deserialize(stream, external)
     set_instance_vars(context)
     self
   end
 
-  def self.new_and_rest(buf)
-    instance = self.allocate
-    context, buf = instance.send(:deserialize, buf)
-    instance.send(:set_instance_vars, context)
-    [instance, buf]
+  # build an instance from its field values. Structs with defaults or fields that
+  # depend on an enclosing struct define their own create.
+  def self.create(**fields)
+    unknown = fields.keys - self::STRUCT.map(&:first)
+    raise ArgumentError.new("#{name}: unknown fields #{unknown.join(', ')}") unless unknown.empty?
+    instance = allocate
+    fields.each { |field, value| instance.instance_variable_set("@#{field}", value) }
+    instance
   end
 
   def raw
     buf = ''
+    context = field_context
     self.class::STRUCT.each do |elem|
+      value = self.instance_variable_get("@#{elem[0]}")
       case elem[1]
       when :select
-        value = self.instance_variable_get("@#{elem[0]}")
-        buf += serialize_select_elem(value, elem[3])
+        buf += serialize_select_elem(elem[0], value, elem[2], elem[3], context)
       else
-        value = self.instance_variable_get("@#{elem[0]}")
         buf += serialize_elem(value, elem[1], elem[2])
       end
     end
     buf
   end
 
-  def self.vecs(buf)
-    value, buf = Melos::Vec.parse_vec(buf)
-    array = []
-    while (value.bytesize > 0)
-      current_instance, value = Melos::Vec.parse_vec(value)
-      array << current_instance
-    end
-    [array, buf]
-  end
-
   # context here takes a hash
-  # returns [value, rest_of_buffer]
+  # returns the deserialized value
   # value could return nil, which means predicate was not applicable
   # predicate takes the context and returns true or false
-  def deserialize_select_elem_with_context(buf, context, predicate, type, type_param)
+  def deserialize_select_elem_with_context(stream, context, predicate, type, type_param)
     if predicate.(context)
-      deserialize_elem(buf, type, type_param)
+      deserialize_elem(stream, type, type_param)
     else
-      [nil, buf]
+      nil
     end
   end
 
   private
-  def deserialize(buf)
-    context = []
+  # external is a Hash of values seeded into the context before parsing (see #initialize)
+  def deserialize(stream, external = {})
+    context = external.to_a
     self.class::STRUCT.each do |elem|
       case elem[1]
       when :select
-        value, buf = deserialize_select_elem_with_context(buf, context.to_h, elem[2], elem[3], elem[4])
+        value = deserialize_select_elem_with_context(stream, context.to_h, elem[2], elem[3], elem[4])
         context << [elem[0], value]
-      when :framed_content_auth_data
-        value, buf = Melos::Struct::FramedContentAuthData.new_and_rest_with_content_type(buf, context.to_h[:content].content_type)
+      when :class
+        # [:name, :class, Klass, ->(ctx){ {external_name: value} }]
+        # the optional 4th element derives external context for the child struct from this struct's context
+        external_for_child = elem[3] ? elem[3].(context.to_h) : {}
+        value = elem[2].new(stream, **external_for_child)
         context << [elem[0], value]
       else
-        value, buf = deserialize_elem(buf, elem[1], elem[2])
+        value = deserialize_elem(stream, elem[1], elem[2])
         context << [elem[0], value]
       end
     end
-    [context, buf]
+    context
   end
 
   def set_instance_vars(context)
@@ -76,57 +78,51 @@ class Melos::Struct::Base
     end
   end
 
-  def deserialize_elem(buf, type, type_param)
+  def deserialize_elem(stream, type, type_param)
     case type
     when :uint8
-      value = buf.byteslice(0, 1).unpack1('C')
-      buf = buf.byteslice(1..)
+      value = stream.read(1).unpack1('C')
     when :uint16
-      value = buf.byteslice(0, 2).unpack1('S>')
-      buf = buf.byteslice(2..)
+      value = stream.read(2).unpack1('S>')
     when :uint32
-      value = buf.byteslice(0, 4).unpack1('L>')
-      buf = buf.byteslice(4..)
+      value = stream.read(4).unpack1('L>')
     when :uint64
-      value = buf.byteslice(0, 8).unpack1('Q>')
-      buf = buf.byteslice(8..)
+      value = stream.read(8).unpack1('Q>')
     when :vec
-      value, buf = Melos::Vec.parse_vec(buf)
+      value = Melos::Vec.parse_stream(stream)
     when :vec_of_type
-      vec, buf = Melos::Vec.parse_vec(buf)
+      data = Melos::Vec.parse_stream(stream)
       value = []
-      while (vec.bytesize > 0)
-        current_instance, vec = deserialize_elem(vec, type_param, nil)
+      data_stream = StringIO.new(data)
+      while (!data_stream.eof?)
+        current_instance = deserialize_elem(data_stream, type_param, nil)
         value << current_instance
       end
     when :class
-      value, buf = type_param.send(:new_and_rest, buf)
+      value = type_param.send(:new, stream)
     when :classes
-      # prefix, length = buf.get_prefix_and_length
-      # puts "#{prefix}, #{length}"
-      vec, buf = Melos::Vec.parse_vec(buf)
+      data = Melos::Vec.parse_stream(stream)
       value = []
-      while (vec.bytesize > 0)
-        current_instance, vec = type_param.send(:new_and_rest, vec)
+      data_stream = StringIO.new(data)
+      while (!data_stream.eof?)
+        current_instance = type_param.send(:new, data_stream)
         value << current_instance
       end
     when :optional
-      presence = buf.byteslice(0, 1).unpack1('C')
-      buf = buf.byteslice(1..)
+      presence = stream.read(1).unpack1('C')
       case presence
       when 0
         value = nil
       when 1
         # as of RFC 9420, optional always takes a class
-        value, buf = type_param.send(:new_and_rest, buf)
+        value = type_param.send(:new, stream)
       end
     when :opaque
-      value = buf.byteslice(0, type_param.to_i)
-      buf = buf.byteslice((type_param.to_i)..)
+      value = stream.read(type_param.to_i)
     when :padding
-      value = buf
+      value = stream.read
     end
-    [value, buf]
+    value
   end
 
   # take a name and type
@@ -141,13 +137,13 @@ class Melos::Struct::Base
     when :uint64
       [value].pack('Q>')
     when :vec
-      Melos::Vec.from_string(value)
+      Melos::Vec.string_to_vec(value)
     when :vec_of_type
-      Melos::Vec.from_string(value.map { serialize_elem(_1, type_param, nil) }.join)
-    when :class, :framed_content_auth_data
+      Melos::Vec.string_to_vec(value.map { serialize_elem(_1, type_param, nil) }.join)
+    when :class
       value.raw
     when :classes
-      Melos::Vec.from_string(value.map(&:raw).join)
+      Melos::Vec.string_to_vec(value.map(&:raw).join)
     when :optional
       if value.nil?
         [0].pack('C')
@@ -162,11 +158,19 @@ class Melos::Struct::Base
     end
   end
 
-  def serialize_select_elem(value, type)
-    if value.nil?
-      ''
-    else
+  # every instance variable as a Hash, the same shape as the parse context,
+  # so that select predicates can be evaluated at serialization time
+  def field_context
+    instance_variables.to_h { [_1.to_s.delete_prefix('@').to_sym, instance_variable_get(_1)] }
+  end
+
+  # a select field is serialized only when its predicate holds; it must then be present
+  def serialize_select_elem(name, value, predicate, type, context)
+    if predicate.(context)
+      raise ArgumentError.new("#{self.class.name}##{name} is required by its select predicate but is nil") if value.nil?
       serialize_elem(value, type, nil)
+    else
+      ''
     end
   end
 end

data/lib/melos/struct/structs.rb

@@ -33,6 +33,13 @@ class Melos::Struct::Credential < Melos::Struct::Base
     [:identity,     :select, ->(ctx){ctx[:credential_type] == Melos::Constants::CredentialType::BASIC}, :vec],
     [:certificates, :select, ->(ctx){ctx[:credential_type] == Melos::Constants::CredentialType::X509},  :classes, Melos::Struct::Certificate]
   ]
+
+  def self.create_basic_credential(identity)
+    new_instance = self.allocate
+    new_instance.instance_variable_set(:@credential_type, Melos::Constants::CredentialType::BASIC)
+    new_instance.instance_variable_set(:@identity, identity)
+    new_instance
+  end
 end
 
 ## 6.3.2
@@ -84,6 +91,26 @@ class Melos::Struct::Capabilities < Melos::Struct::Base
     [:proposals, :vec],     # vec of ProposalTypes (uint16)
     [:credentials, :vec]    # vec of CredentialTypes (uint16)
   ]
+
+  def self.import(capabilities)
+    new_instance = self.allocate
+    new_instance.instance_variable_set(:@versions, capabilities.versions.pack('S>*'))
+    new_instance.instance_variable_set(:@cipher_suites, capabilities.cipher_suites.pack('S>*'))
+    new_instance.instance_variable_set(:@extensions, capabilities.extensions.pack('S>*'))
+    new_instance.instance_variable_set(:@proposals, capabilities.proposals.pack('S>*'))
+    new_instance.instance_variable_set(:@credentials, capabilities.credentials.pack('S>*'))
+    new_instance
+  end
+
+  def export
+    cap = Melos::Capabilities.new
+    cap.versions = versions.unpack('S>*')
+    cap.cipher_suites = cipher_suites.unpack('S>*')
+    cap.extensions = extensions.unpack('S>*')
+    cap.proposals = proposals.unpack('S>*')
+    cap.credentials = credentials.unpack('S>*')
+    cap
+  end
 end
 
 class Melos::Struct::Lifetime < Melos::Struct::Base
@@ -92,6 +119,13 @@ class Melos::Struct::Lifetime < Melos::Struct::Base
     [:not_before, :uint64],
     [:not_after, :uint64]
   ]
+
+  def self.create(not_before:, not_after:)
+    new_instance = self.allocate
+    new_instance.instance_variable_set(:@not_before, not_before)
+    new_instance.instance_variable_set(:@not_after, not_after)
+    new_instance
+  end
 end
 
 class Melos::Struct::Extension < Melos::Struct::Base
@@ -100,6 +134,13 @@ class Melos::Struct::Extension < Melos::Struct::Base
     [:extension_type, :uint16], # ExtensionType = uint16
     [:extension_data, :vec]
   ]
+
+  # 13.4: any list of extensions MUST NOT have more than one extension of a given type
+  def self.check_unique_types!(extensions, where)
+    duplicates = extensions.map(&:extension_type).tally.select { |_type, count| count > 1 }.keys
+    return if duplicates.empty?
+    raise ArgumentError.new("#{where} has more than one extension of type #{duplicates.map { '0x%04x' % _1 }.join(', ')}")
+  end
 end
 
 class Melos::Struct::LeafNode < Melos::Struct::Base
@@ -118,19 +159,19 @@ class Melos::Struct::LeafNode < Melos::Struct::Base
 
   def leaf_node_tbs(group_id, leaf_index)
     buf = ''
-    buf += Melos::Vec.from_string(encryption_key)
-    buf += Melos::Vec.from_string(signature_key)
+    buf += Melos::Vec.string_to_vec(encryption_key)
+    buf += Melos::Vec.string_to_vec(signature_key)
     buf += credential.raw
     buf += capabilities.raw
     buf += [leaf_node_source].pack('C')
     if leaf_node_source == Melos::Constants::LeafNodeSource::KEY_PACKAGE
       buf += lifetime.raw
     elsif leaf_node_source == Melos::Constants::LeafNodeSource::COMMIT
-      buf += Melos::Vec.from_string(parent_hash)
+      buf += Melos::Vec.string_to_vec(parent_hash)
     end
-    buf += Melos::Vec.from_string(extensions.map(&:raw).join)
+    buf += Melos::Vec.string_to_vec(extensions.map(&:raw).join)
     if leaf_node_source == Melos::Constants::LeafNodeSource::UPDATE || leaf_node_source == Melos::Constants::LeafNodeSource::COMMIT
-      buf += Melos::Vec.from_string(group_id)
+      buf += Melos::Vec.string_to_vec(group_id)
       buf += [leaf_index].pack('L>') # uint32
     end
     buf
@@ -344,6 +385,31 @@ class Melos::Struct::KeyPackage < Melos::Struct::Base
   def ref(suite)
     Melos::Crypto.make_keypackage_ref(suite, self.raw)
   end
+
+  def self.create(cipher_suite:, init_key:, leaf_node:)
+    new_instance = self.allocate
+    new_instance.instance_variable_set(:@version, 1)
+    new_instance.instance_variable_set(:@cipher_suite, cipher_suite)
+    new_instance.instance_variable_set(:@init_key, init_key)
+    new_instance.instance_variable_set(:@leaf_node, leaf_node)
+    new_instance.instance_variable_set(:@extensions, leaf_node.extensions)
+    new_instance.instance_variable_set(:@signature, '')
+    new_instance
+  end
+
+  def keypackage_tbs
+    [version].pack('S>') + [cipher_suite].pack('S>') + Melos::Vec.string_to_vec(init_key) + leaf_node.raw + Melos::Vec.string_to_vec(extensions.map(&:raw).join)
+  end
+
+  def sign(signature_private_key)
+    suite = Melos::Crypto::CipherSuite.new(@cipher_suite)
+    @signature = Melos::Crypto.sign_with_label(suite, signature_private_key, "KeyPackageTBS", keypackage_tbs)
+  end
+
+  def verify()
+    suite = Melos::Crypto::CipherSuite.new(@cipher_suite)
+    Melos::Crypto.verify_with_label(suite, leaf_node.signature_key, "KeyPackageTBS", keypackage_tbs, signature)
+  end
 end
 
 class Melos::Struct::KeyPackageTBS < Melos::Struct::Base
@@ -373,7 +439,7 @@ end
 ## 12.1.1 - 12.1.7
 
 class Melos::Struct::Add < Melos::Struct::Base
-  attr_reader :key_package
+  attr_accessor :key_package
   STRUCT = [
     [:key_package, :class, Melos::Struct::KeyPackage]
   ]
@@ -387,7 +453,7 @@ class Melos::Struct::Update < Melos::Struct::Base
 end
 
 class Melos::Struct::Remove < Melos::Struct::Base
-  attr_reader :removed
+  attr_accessor :removed
   STRUCT = [
     [:removed, :uint32]
   ]
@@ -437,7 +503,7 @@ end
 ## 12.1
 
 class Melos::Struct::Proposal < Melos::Struct::Base
-  attr_reader :proposal_type, :add, :update, :remove, :psk, :reinit, :external_init, :group_context_extensions
+  attr_accessor :proposal_type, :add, :update, :remove, :psk, :reinit, :external_init, :group_context_extensions
   STRUCT = [
     [:proposal_type, :uint16],
     [:add, :select, ->(ctx){ctx[:proposal_type] == Melos::Constants::ProposalType::ADD}, :class, Melos::Struct::Add],
@@ -463,6 +529,14 @@ class Melos::Struct::ProposalOrRef < Melos::Struct::Base
     [:proposal, :select,  ->(ctx){ctx[:type] == Melos::Constants::ProposalOrRefType::PROPOSAL}, :class, Melos::Struct::Proposal],
     [:reference, :select, ->(ctx){ctx[:type] == Melos::Constants::ProposalOrRefType::REFERENCE}, :vec] # ProposalRef is a HashReference, which is a :vec
   ]
+
+  def self.create(type:, proposal:, reference:)
+    new_instance = self.allocate
+    new_instance.instance_variable_set(:@type, type)
+    new_instance.instance_variable_set(:@proposal, proposal)
+    new_instance.instance_variable_set(:@reference, reference)
+    new_instance
+  end
 end
 
 class Melos::Struct::Commit < Melos::Struct::Base
@@ -471,6 +545,13 @@ class Melos::Struct::Commit < Melos::Struct::Base
     [:proposals, :classes, Melos::Struct::ProposalOrRef],
     [:path, :optional, Melos::Struct::UpdatePath]
   ]
+
+  def self.create(proposals:, path:)
+    new_instance = self.allocate
+    new_instance.instance_variable_set(:@proposals, proposals)
+    new_instance.instance_variable_set(:@path, path)
+    new_instance
+  end
 end
 
 ## 12.4.3
@@ -494,8 +575,8 @@ class Melos::Struct::GroupInfo < Melos::Struct::Base
     )
   end
 
-  def sign(suite, signer_private)
-    Melos::Crypto.sign_with_label(suite, signer_private_key, "GroupInfoTBS", group_info_tbs.raw)
+  def sign(suite, signer_private_key)
+    @signature = Melos::Crypto.sign_with_label(suite, signer_private_key, "GroupInfoTBS", group_info_tbs.raw)
   end
 
   def verify(suite, signer_public_key)
@@ -575,8 +656,9 @@ class Melos::Struct::Node < Melos::Struct::Base
     [:parent_node, :select, ->(ctx){ctx[:node_type] == Melos::Constants::NodeType::PARENT}, :class, Melos::Struct::ParentNode] # parent
   ]
 
+  # the parent_hash this node carries: nil for a leaf whose source is key_package or update (7.2)
   def parent_hash_in_node
-    @leaf_node&.parent_hash || @parent_node.parent_hash
+    @parent_node ? @parent_node.parent_hash : @leaf_node.parent_hash
   end
 
   def public_encryption_key
@@ -630,36 +712,17 @@ class Melos::Struct::Sender < Melos::Struct::Base
   end
 end
 
+# The select in FramedContentAuthData depends on FramedContent.content_type, a field of
+# the enclosing struct, so the parent passes it in as external context:
+#   [:auth, :class, Melos::Struct::FramedContentAuthData, ->(ctx){ {content_type: ctx[:content].content_type} }]
 class Melos::Struct::FramedContentAuthData < Melos::Struct::Base
   attr_reader :signature, :confirmation_tag, :content_type
 
   STRUCT = [
-    [:signature, :vec]
+    [:signature, :vec],
+    [:confirmation_tag, :select, ->(ctx){ctx[:content_type] == Melos::Constants::ContentType::COMMIT}, :vec] # MAC is opaque <V>
   ]
 
-  # initialize from stream
-  def self.new_and_rest_with_content_type(buf, content_type)
-    instance = self.allocate
-    context, buf = instance.send(:deserialize, buf)
-    # custom part based on instance variable
-    if content_type == Melos::Constants::ContentType::COMMIT # commit
-      # read MAC(opaque <V>) confirmation_tag
-      value, buf = Melos::Vec.parse_vec(buf)
-      context << [:confirmation_tag, value]
-    end
-    context << [:content_type, content_type]
-    instance.send(:set_instance_vars, context)
-    [instance, buf]
-  end
-
-  def raw
-    if @content_type == Melos::Constants::ContentType::COMMIT
-      Melos::Vec.from_string(@signature) + Melos::Vec.from_string(@confirmation_tag)
-    else
-      Melos::Vec.from_string(@signature)
-    end
-  end
-
   def self.create(signature:, content_type:, confirmation_tag:)
     instance = self.allocate
     instance.instance_variable_set(:@signature, signature)
@@ -669,6 +732,12 @@ class Melos::Struct::FramedContentAuthData < Melos::Struct::Base
     end
     instance
   end
+
+  # a commit's confirmation tag is computed after signing, once the next epoch's key schedule is known (8.2)
+  def confirmation_tag=(tag)
+    raise ArgumentError.new('only a commit carries a confirmation tag') unless @content_type == Melos::Constants::ContentType::COMMIT
+    @confirmation_tag = tag
+  end
 end
 
 class Melos::Struct::FramedContent < Melos::Struct::Base
@@ -719,7 +788,7 @@ class Melos::Struct::AuthenticatedContent < Melos::Struct::Base
   STRUCT = [
     [:wire_format, :uint16],
     [:content, :class, Melos::Struct::FramedContent],
-    [:auth, :framed_content_auth_data]
+    [:auth, :class, Melos::Struct::FramedContentAuthData, ->(ctx){ {content_type: ctx[:content].content_type} }]
   ]
 
   def content_tbm
@@ -750,15 +819,15 @@ class Melos::Struct::AuthenticatedContent < Melos::Struct::Base
     new_instance
   end
 
-  # populate auth with values
-  def sign(suite, signature_private_key, group_context)
+  # populate auth with the signature (6.1); a commit's confirmation_tag may be given here or set on auth later
+  def sign(suite, signature_private_key, group_context, confirmation_tag: nil)
     raise ArgumentError.new('Application data cannot be sent as a PublicMessage') if wire_format == Melos::Constants::WireFormat::MLS_PUBLIC_MESSAGE && content.content_type == Melos::Constants::ContentType::APPLICATION
     content_tbs = content.content_tbs(Melos::Constants::Version::MLS10, wire_format, group_context)
     signature = Melos::Crypto.sign_with_label(suite, signature_private_key, "FramedContentTBS", content_tbs)
     @auth = Melos::Struct::FramedContentAuthData.create(
       signature: signature,
       content_type: content.content_type,
-      confirmation_tag: nil
+      confirmation_tag: confirmation_tag
     )
   end
 end
@@ -769,7 +838,7 @@ class Melos::Struct::PublicMessage < Melos::Struct::Base
   attr_reader :content, :auth, :membership_tag
   STRUCT = [
     [:content, :class, Melos::Struct::FramedContent],
-    [:auth, :framed_content_auth_data],
+    [:auth, :class, Melos::Struct::FramedContentAuthData, ->(ctx){ {content_type: ctx[:content].content_type} }],
     [:membership_tag, :select, ->(ctx){ctx[:content].sender.sender_type == Melos::Constants::SenderType::MEMBER}, :vec] # MAC is opaque <V>
   ]
 
@@ -834,7 +903,7 @@ class Melos::Struct::PrivateMessage < Melos::Struct::Base
   end
 
   def self.sender_data_aad_impl(gid, ep, ct)
-    Melos::Vec.from_string(gid) + [ep].pack('Q>') + [ct].pack('C')
+    Melos::Vec.string_to_vec(gid) + [ep].pack('Q>') + [ct].pack('C')
   end
 
   def private_content_aad
@@ -842,17 +911,21 @@ class Melos::Struct::PrivateMessage < Melos::Struct::Base
   end
 
   def self.private_content_aad_impl(gid, ep, ct, ad)
-    Melos::Vec.from_string(gid) + [ep].pack('Q>') + [ct].pack('C') + Melos::Vec.from_string(ad)
+    Melos::Vec.string_to_vec(gid) + [ep].pack('Q>') + [ct].pack('C') + Melos::Vec.string_to_vec(ad)
   end
 
   def self.protect(authenticated_content, suite, secret_tree, sender_data_secret, padding_size)
     leaf_index = authenticated_content.content.sender.leaf_index
     content_type = authenticated_content.content.content_type
     reuse_guard = SecureRandom.random_bytes(4)
-    key, nonce, generation = Melos::SecretTree::ratchet_and_get(suite, content_type, secret_tree, leaf_index)
+    key, nonce, generation = secret_tree.ratchet_and_get(content_type, leaf_index)
     new_nonce = apply_nonce_reuse_guard(nonce, reuse_guard)
 
-    private_message_content_plain = serialize_private_message_content(authenticated_content.content, authenticated_content.auth, padding_size)
+    private_message_content_plain = Melos::Struct::PrivateMessageContent.create(
+      framed_content: authenticated_content.content,
+      auth: authenticated_content.auth,
+      padding_size: padding_size
+    ).raw
     aad = private_content_aad_impl(
       authenticated_content.content.group_id,
       authenticated_content.content.epoch,
@@ -885,9 +958,12 @@ class Melos::Struct::PrivateMessage < Melos::Struct::Base
 
   def unprotect(suite, secret_tree, sender_data_secret)
     sender_data = decrypt_sender_data(suite, sender_data_secret)
-    key, nonce, _ = Melos::SecretTree.ratchet_until_and_get(suite, content_type, secret_tree, sender_data.leaf_index, sender_data.generation)
+    key, nonce, _ = secret_tree.ratchet_until_and_get(content_type, sender_data.leaf_index, sender_data.generation)
     new_nonce = self.class.apply_nonce_reuse_guard(nonce, sender_data.reuse_guard)
-    pmc, _ = Melos::Struct::PrivateMessageContent.new_and_rest_with_content_type(Melos::Crypto.aead_decrypt(suite, key, new_nonce, private_content_aad, ciphertext), content_type)
+    stream = StringIO.new(Melos::Crypto.aead_decrypt(suite, key, new_nonce, private_content_aad, ciphertext))
+    pmc = Melos::Struct::PrivateMessageContent.new(stream, content_type: content_type)
+    # 6.3.1: the padding MUST be all zero bytes, otherwise the message is malformed
+    raise ArgumentError.new('PrivateMessage padding is not all zero') unless pmc.padding_zero?
 
     fc = Melos::Struct::FramedContent.create(
       group_id: group_id,
@@ -921,56 +997,44 @@ class Melos::Struct::PrivateMessage < Melos::Struct::Base
     nonce_arr.pack('C*')
   end
 
-  def self.serialize_private_message_content(framed_content, framed_content_auth_data, padding_size)
-    buf = ''
-    case framed_content.content_type
-    when Melos::Constants::ContentType::APPLICATION
-      buf += Melos::Vec.from_string(framed_content.application_data)
-    when Melos::Constants::ContentType::PROPOSAL
-      buf += framed_content.proposal.raw
-    when Melos::Constants::ContentType::COMMIT
-      buf += framed_content.commit.raw
-    end
-    buf += Melos::Vec.from_string(framed_content_auth_data.signature)
-    if framed_content.content_type == Melos::Constants::ContentType::COMMIT
-      buf += Melos::Vec.from_string(framed_content_auth_data.confirmation_tag)
-    end
-    buf += Melos::Crypto::Util.zero_vector(padding_size)
-    buf
-  end
 end
 
+# The selects in PrivateMessageContent depend on PrivateMessage.content_type, a field of
+# the enclosing struct, so the caller passes it in:
+#   Melos::Struct::PrivateMessageContent.new(stream, content_type: content_type)
 class Melos::Struct::PrivateMessageContent < Melos::Struct::Base
-  attr_accessor :application_data, :proposal, :commit, :auth, :padding
-  # bytes -> struct: decode the content and auth field, rest is padding
-  # struct -> bytes: encode content and auth field, add set amount of padding (zero bytes)
+  attr_reader :application_data, :proposal, :commit, :auth, :padding, :content_type
+  STRUCT = [
+    [:application_data, :select, ->(ctx){ctx[:content_type] == Melos::Constants::ContentType::APPLICATION}, :vec],
+    [:proposal,         :select, ->(ctx){ctx[:content_type] == Melos::Constants::ContentType::PROPOSAL}, :class, Melos::Struct::Proposal],
+    [:commit,           :select, ->(ctx){ctx[:content_type] == Melos::Constants::ContentType::COMMIT}, :class, Melos::Struct::Commit],
+    [:auth, :class, Melos::Struct::FramedContentAuthData, ->(ctx){ {content_type: ctx[:content_type]} }],
+    [:padding, :padding] # the rest of the stream; zero bytes
+  ]
 
-  def self.new_and_rest_with_content_type(buf, content_type)
-    instance = self.allocate
-    context = []
-    # deserialize application_data/proposal/commit
-    case content_type
+  def self.create(framed_content:, auth:, padding_size:)
+    new_instance = self.allocate
+    new_instance.instance_variable_set(:@content_type, framed_content.content_type)
+    case framed_content.content_type
     when Melos::Constants::ContentType::APPLICATION
-      value, buf = Melos::Vec.parse_vec(buf)
-      context << [:application_data, value]
+      new_instance.instance_variable_set(:@application_data, framed_content.application_data)
     when Melos::Constants::ContentType::PROPOSAL
-      value, buf = Melos::Struct::Proposal.new_and_rest(buf)
-      context << [:proposal, value]
+      new_instance.instance_variable_set(:@proposal, framed_content.proposal)
     when Melos::Constants::ContentType::COMMIT
-      value, buf = Melos::Struct::Commit.new_and_rest(buf)
-      context << [:commit, value]
+      new_instance.instance_variable_set(:@commit, framed_content.commit)
     end
-    fcad, buf = Melos::Struct::FramedContentAuthData.new_and_rest_with_content_type(buf, content_type)
-    context << [:auth, fcad]
-    # assume rest is padding
-    context << [:padding, buf]
-    instance.send(:set_instance_vars, context)
-    [instance, '']
+    new_instance.instance_variable_set(:@auth, auth)
+    new_instance.instance_variable_set(:@padding, Melos::Crypto::Util.zero_vector(padding_size))
+    new_instance
   end
 
   def content
     @application_data || @proposal || @commit
   end
+
+  def padding_zero?
+    @padding.each_byte.all?(&:zero?)
+  end
 end
 
 ## 8.2
@@ -1011,9 +1075,21 @@ class Melos::Struct::MLSMessage < Melos::Struct::Base
     [:key_package,     :select, ->(ctx){ctx[:wire_format] == Melos::Constants::WireFormat::MLS_KEY_PACKAGE}, :class, Melos::Struct::KeyPackage]
   ]
 
-  def verify(suite, signer_public_key, group_context)
-    if wire_format == Melos::Constants::WireFormat::MLS_PUBLIC_MESSAGE
-      public_message.verify(suite, signer_public_key, version, wire_format, group_context)
-    end
+  # wrap exactly one of the message types; the wire format follows from which one is given
+  def self.create(public_message: nil, private_message: nil, welcome: nil, group_info: nil, key_package: nil)
+    given = {
+      public_message: [Melos::Constants::WireFormat::MLS_PUBLIC_MESSAGE, public_message],
+      private_message: [Melos::Constants::WireFormat::MLS_PRIVATE_MESSAGE, private_message],
+      welcome: [Melos::Constants::WireFormat::MLS_WELCOME, welcome],
+      group_info: [Melos::Constants::WireFormat::MLS_GROUP_INFO, group_info],
+      key_package: [Melos::Constants::WireFormat::MLS_KEY_PACKAGE, key_package]
+    }.reject { |_, (_, value)| value.nil? }
+    raise ArgumentError.new('exactly one message must be given') unless given.size == 1
+    field, (wire_format, value) = given.first
+    instance = allocate
+    instance.instance_variable_set(:@version, Melos::Constants::Version::MLS10)
+    instance.instance_variable_set(:@wire_format, wire_format)
+    instance.instance_variable_set("@#{field}", value)
+    instance
   end
 end