feat(keys): halkyon_keys, an account's keys on the device

ADR 0017's step 1, on libsodium (sodium 4.1.0+1, whose build hook
compiles the libsodium 1.0.22 it ships: a C compiler and make wherever
it builds):
- Argon2id (64 MiB, 3 passes, kept with the account and never below
  that) makes a master key, which libsodium's KDF splits into SRP's
  secret (x) and the key-encryption key.
- The account's X25519 and Ed25519 key pairs, their private halves
  wrapped with XChaCha20-Poly1305 under the KEK and under the recovery
  key, bound to their public keys.
- A 24-word BIP-39 recovery phrase (the English list, MIT) and the
  recovery key derived from it.
- Data keys sealed to the account with crypto_box_seal, bound to their
  IDs; content in ADR 0002's envelope, encrypted with a data key and
  signed with Ed25519 (detached), bound to a context the caller names.
- Secrets in libsodium's guarded memory where its API takes them.
- Tests: libsodium's Argon2id known answers, BIP-39's English vectors,
  round trips and every refusal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_keys/test/password_keys_test.dart

@@ -0,0 +1,138 @@
+import 'dart:typed_data';
+
+import 'package:halkyon_keys/halkyon_keys.dart';
+import 'package:sodium/sodium_sumo.dart';
+import 'package:test/test.dart';
+
+Future<void> main() async {
+  final sodium = await SodiumSumoInit.init();
+  // Cheap costs for most tests; the production costs are checked once below.
+  const cheap = PasswordKdf(opsLimit: 1, memLimit: 8192);
+  final salt = Uint8List.fromList(List.generate(16, (i) => i));
+
+  PasswordKeys keysOf(String password, {Uint8List? withSalt}) =>
+      derivePasswordKeys(
+        sodium,
+        password: password,
+        salt: withSalt ?? salt,
+        kdf: cheap,
+      );
+
+  test('the same password and salt make the same keys, on any device', () {
+    final first = keysOf('correct horse battery staple');
+    final second = keysOf('correct horse battery staple');
+    expect(first.srpPrivateValue, second.srpPrivateValue);
+    expect(
+      first.keyEncryptionKey.extractBytes(),
+      second.keyEncryptionKey.extractBytes(),
+    );
+  });
+
+  test('another password, or another salt, makes other keys', () {
+    final keys = keysOf('correct horse battery staple');
+    final otherPassword = keysOf('correct horse battery stapler');
+    final otherSalt = keysOf(
+      'correct horse battery staple',
+      withSalt: Uint8List.fromList(List.generate(16, (i) => i + 1)),
+    );
+    for (final other in [otherPassword, otherSalt]) {
+      expect(other.srpPrivateValue, isNot(keys.srpPrivateValue));
+      expect(
+        other.keyEncryptionKey.extractBytes(),
+        isNot(keys.keyEncryptionKey.extractBytes()),
+      );
+    }
+  });
+
+  test("SRP's secret and the key-encryption key are unrelated halves", () {
+    final keys = keysOf('a password');
+    final srp = keys.srpSecret.extractBytes();
+    expect(srp, hasLength(32));
+    expect(keys.keyEncryptionKey.extractBytes(), hasLength(32));
+    expect(keys.keyEncryptionKey.extractBytes(), isNot(srp));
+    expect(keys.srpPrivateValue.bitLength, lessThanOrEqualTo(256));
+    expect(keys.srpPrivateValue, greaterThan(BigInt.zero));
+  });
+
+  test('a salt of another length is refused', () {
+    expect(
+      () => derivePasswordKeys(
+        sodium,
+        password: 'a password',
+        salt: Uint8List(15),
+        kdf: cheap,
+      ),
+      throwsArgumentError,
+    );
+  });
+
+  test('new salts are 16 random bytes', () {
+    final first = newPasswordSalt(sodium);
+    expect(first, hasLength(16));
+    expect(newPasswordSalt(sodium), isNot(first));
+  });
+
+  test('new passwords cost 64 MiB and 3 passes, and that works', () {
+    expect(PasswordKdf.current.memLimit, 64 * 1024 * 1024);
+    expect(PasswordKdf.current.opsLimit, 3);
+    // The floor is apart from what new passwords take, so raising the
+    // latter never locks out an account made before.
+    expect(PasswordKdf.minimum.memLimit, 64 * 1024 * 1024);
+    expect(PasswordKdf.minimum.opsLimit, 3);
+    expect(
+      PasswordKdf.current.memLimit,
+      greaterThanOrEqualTo(PasswordKdf.minimum.memLimit),
+    );
+    expect(
+      PasswordKdf.current.opsLimit,
+      greaterThanOrEqualTo(PasswordKdf.minimum.opsLimit),
+    );
+    final keys = derivePasswordKeys(
+      sodium,
+      password: 'a password',
+      salt: salt,
+    );
+    expect(keys.srpPrivateValue, greaterThan(BigInt.zero));
+    keys.dispose();
+  });
+
+  group('the costs kept with an account', () {
+    test('the floor itself is read', () {
+      final read = PasswordKdf.fromJson(PasswordKdf.minimum.toJson());
+      expect(read.opsLimit, PasswordKdf.minimum.opsLimit);
+      expect(read.memLimit, PasswordKdf.minimum.memLimit);
+    });
+
+    test('round-trip', () {
+      const raised = PasswordKdf(opsLimit: 4, memLimit: 128 * 1024 * 1024);
+      final json = raised.toJson();
+      expect(json['algorithm'], 'argon2id13');
+      final read = PasswordKdf.fromJson(json);
+      expect(read.opsLimit, 4);
+      expect(read.memLimit, 128 * 1024 * 1024);
+    });
+
+    test('below the floor, or of another algorithm, are refused: a register '
+        "can't make guessing cheaper", () {
+      for (final json in <Map<String, Object?>>[
+        {'algorithm': 'argon2id13', 'opsLimit': 2, 'memLimit': 64 << 20},
+        {'algorithm': 'argon2id13', 'opsLimit': 3, 'memLimit': 32 << 20},
+        {'algorithm': 'argon2i13', 'opsLimit': 3, 'memLimit': 64 << 20},
+        {'algorithm': 'argon2id13', 'opsLimit': '3', 'memLimit': 64 << 20},
+        {},
+      ]) {
+        expect(
+          () => PasswordKdf.fromJson(json),
+          throwsA(
+            isA<KeyRefused>().having(
+              (refused) => refused.reason,
+              'reason',
+              KeyRefusal.weakPasswordKdf,
+            ),
+          ),
+          reason: '$json',
+        );
+      }
+    });
+  });
+}