mirror of
https://github.com/ancsemi/Haven.git
synced 2026-10-27 00:54:56 +00:00
AmnibroandCursor
daefc658f2
* Group DM E2E: crypto core, key distribution, and tests Implements the design in docs/group-dm-e2e-plan.md far enough to prove the properties hold. No UI yet — this is the layer everything else sits on. public/js/e2e-group.js holds the primitives, deliberately free of storage, sockets and DOM so the same file runs in the browser and under node --test. Confidentiality comes from an AES-256 epoch key wrapped per member over the pairwise ECDH secret that already exists; authenticity from an ECDSA P-256 signature over a digest binding channel, epoch, sender and the previous message. Verification happens before decryption and a rejected message returns null plaintext, so a forgery cannot be rendered by mistake. The signature is what makes one shared group key safe: every member can decrypt, only a key holder can author. src/socketHandlers/groupE2E.js distributes wrapped blobs the server cannot open, while enforcing what no client can check for itself — only a member may publish an epoch, epochs are strictly sequential, a member reads only their own blob, and an epoch must cover exactly the current membership. That last rule stops a member publishing an epoch that silently omits someone, locking them out of a conversation the UI still shows them in. Two suites, 28 tests, runnable with npm test. The crypto suite is written as attacks rather than happy paths: forging as another member, re-attributing a genuine message, tampering, stripping the signature, replaying into another channel or epoch, reading an epoch you were not given, and unwrapping a key not wrapped for you. It also asserts scrollback still decrypts across several rotations, which is the regression a per-message ratchet would have caused, and that concurrent sends sharing a prev do not false-alarm. Confirmed the suite is load-bearing by disabling the signature check: exactly the five attack tests fail and nothing else. * Group DMs invite instead of auto-joining, and rewraps require a request. Addresses review on #5499: drop leftover setup.js, consent plus roster dedup on start-group-dm, and pin rewraps to a prior request plus the recipient's TOFU public key. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>