feat(keys): halkyon_keys, an account's keys on the device
ADR 0017's step 1, on libsodium (sodium 4.1.0+1, whose build hook
compiles the libsodium 1.0.22 it ships: a C compiler and make wherever
it builds):
- Argon2id (64 MiB, 3 passes, kept with the account and never below
that) makes a master key, which libsodium's KDF splits into SRP's
secret (x) and the key-encryption key.
- The account's X25519 and Ed25519 key pairs, their private halves
wrapped with XChaCha20-Poly1305 under the KEK and under the recovery
key, bound to their public keys.
- A 24-word BIP-39 recovery phrase (the English list, MIT) and the
recovery key derived from it.
- Data keys sealed to the account with crypto_box_seal, bound to their
IDs; content in ADR 0002's envelope, encrypted with a data key and
signed with Ed25519 (detached), bound to a context the caller names.
- Secrets in libsodium's guarded memory where its API takes them.
- Tests: libsodium's Argon2id known answers, BIP-39's English vectors,
round trips and every refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-20 12:01:52 +02:00
|
|
|
/// An account's keys on the device (ADR 0017): what the password unlocks
|
|
|
|
|
/// (Argon2id, split into SRP's x and the key-encryption key), the account's
|
|
|
|
|
/// key pairs and their wrapping, the recovery phrase and its key, data keys
|
|
|
|
|
/// sealed to the account, and content sealed and signed in ADR 0002's
|
|
|
|
|
/// envelope. libsodium (the `sodium` package, its sumo API for Argon2id)
|
|
|
|
|
/// does every primitive; nothing here is ever sent but what is wrapped,
|
|
|
|
|
/// sealed or public.
|
|
|
|
|
library;
|
|
|
|
|
|
|
|
|
|
export 'src/account_keys.dart'
|
|
|
|
|
show AccountKeys, WrappedAccountKeys, unwrapAccountKeys, wrapAccountKeys;
|
|
|
|
|
export 'src/data_keys.dart' show DataKey, openDataKey, sealDataKey;
|
|
|
|
|
export 'src/key_refused.dart';
|
|
|
|
|
export 'src/password_keys.dart'
|
|
|
|
|
show PasswordKdf, PasswordKeys, derivePasswordKeys, newPasswordSalt;
|
2026-10-20 12:28:56 +02:00
|
|
|
export 'src/password_text.dart'
|
2026-10-20 21:25:47 +02:00
|
|
|
show
|
|
|
|
|
PasswordRefusal,
|
|
|
|
|
PasswordRefused,
|
|
|
|
|
checkNewPassword,
|
|
|
|
|
newPasswordMinLength,
|
|
|
|
|
normalizePassword;
|
feat(keys): halkyon_keys, an account's keys on the device
ADR 0017's step 1, on libsodium (sodium 4.1.0+1, whose build hook
compiles the libsodium 1.0.22 it ships: a C compiler and make wherever
it builds):
- Argon2id (64 MiB, 3 passes, kept with the account and never below
that) makes a master key, which libsodium's KDF splits into SRP's
secret (x) and the key-encryption key.
- The account's X25519 and Ed25519 key pairs, their private halves
wrapped with XChaCha20-Poly1305 under the KEK and under the recovery
key, bound to their public keys.
- A 24-word BIP-39 recovery phrase (the English list, MIT) and the
recovery key derived from it.
- Data keys sealed to the account with crypto_box_seal, bound to their
IDs; content in ADR 0002's envelope, encrypted with a data key and
signed with Ed25519 (detached), bound to a context the caller names.
- Secrets in libsodium's guarded memory where its API takes them.
- Tests: libsodium's Argon2id known answers, BIP-39's English vectors,
round trips and every refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-20 12:01:52 +02:00
|
|
|
export 'src/recovery_phrase.dart'
|
|
|
|
|
show
|
|
|
|
|
entropyOfRecoveryPhrase,
|
|
|
|
|
newRecoveryPhrase,
|
|
|
|
|
recoveryEntropyBytes,
|
|
|
|
|
recoveryKeyOf,
|
fix(auth)!: the recovery phrase is proved by a key of its own
A key proof was a signature by the account's signing key, which every
signed-in device keeps in its keyring: whoever could read one, with a
code from its authenticator, set a new password without the password or
the phrase (the second reading's H1). The phrase now proves itself with
an Ed25519 key derived from its bits alone (halkyon_keys'
recoveryProofKeysOf, KDF context hlkrprf1, a sibling of the recovery
key), whose public half every setup, new phrase and account reset sends
and the register keeps (account_password.recoveryProofKey); the device
derives the secret half only while the phrase is typed. An account
without one (none exist outside development) proves no phrase until it
sets a new one; decoys check against a decoy proof key alike.
Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "account_password" ADD COLUMN "recoveryProofKey" bytea;
nullable, so rows made before keep working and no data is touched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-20 21:03:15 +02:00
|
|
|
recoveryPhraseOf,
|
|
|
|
|
recoveryProofKeysOf,
|
|
|
|
|
recoveryProofPublicKeyOf;
|
feat(keys): halkyon_keys, an account's keys on the device
ADR 0017's step 1, on libsodium (sodium 4.1.0+1, whose build hook
compiles the libsodium 1.0.22 it ships: a C compiler and make wherever
it builds):
- Argon2id (64 MiB, 3 passes, kept with the account and never below
that) makes a master key, which libsodium's KDF splits into SRP's
secret (x) and the key-encryption key.
- The account's X25519 and Ed25519 key pairs, their private halves
wrapped with XChaCha20-Poly1305 under the KEK and under the recovery
key, bound to their public keys.
- A 24-word BIP-39 recovery phrase (the English list, MIT) and the
recovery key derived from it.
- Data keys sealed to the account with crypto_box_seal, bound to their
IDs; content in ADR 0002's envelope, encrypted with a data key and
signed with Ed25519 (detached), bound to a context the caller names.
- Secrets in libsodium's guarded memory where its API takes them.
- Tests: libsodium's Argon2id known answers, BIP-39's English vectors,
round trips and every refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-20 12:01:52 +02:00
|
|
|
export 'src/sealed_content.dart' show SealedContent, openContent, sealContent;
|