sync-identity.ts

1// Sync identity — long-term X25519 keypair tied to the vault, not the2// device installation.3//4//   sync_identity_keypair = X25519-keygen(HKDF(master_key,5//                              salt="peach-sync-identity-v1",6//                              info=device_id))7//8//   vault_id = BLAKE3(master_key || "peach-vault-id"), hex (64 chars / 32 bytes)9//10// Determinism is the point: losing and reinstalling Peach against the same11// vault recovers the same sync identity, so paired peers do not need to12// re-pair after a reinstall. The master_key must be the same byte buffer13// that the vault layer holds in memory after unlock — not the user-typed14// password, not the password-derived key.15//16// device_id is a per-installation UUID v4. Two devices that share the17// same vault always derive distinct identities; the device_id is the18// salt that breaks the symmetry.1920import { HKDF } from "@stablelib/hkdf";21import { SHA256 } from "@stablelib/sha256";22import { generateKeyPairFromSeed } from "@stablelib/x25519";23import { blake3 } from "hash-wasm";2425const SYNC_IDENTITY_SALT = new TextEncoder().encode("peach-sync-identity-v1");26const SYNC_SIGNING_SALT = new TextEncoder().encode("peach-sync-signing-v1");27const VAULT_ID_INFO = new TextEncoder().encode("peach-vault-id");28const VAULT_ID_HEX_LENGTH = 64; // full 32-byte BLAKE3 digest → 64 hex chars2930// PKCS#8 prefix for a raw 32-byte Ed25519 seed (RFC 8410 §7).31//   SEQUENCE(46) { INTEGER 0, AlgorithmIdentifier(id-Ed25519),32//                  OCTET STRING(34) { OCTET STRING(32) <seed> } }33const ED25519_PKCS8_PREFIX = Uint8Array.of(34  0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,35  0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,36);3738export interface SyncIdentityKeypair {39  publicKey: Uint8Array; // 32 bytes40  secretKey: Uint8Array; // 32 bytes — sensitive; treat as key material41}4243/**44 * Derive the deterministic sync identity keypair for a vault on a given45 * installation. Always returns the same keypair for the same46 * (masterKey, deviceId) pair across runs and reinstalls.47 */48export function deriveSyncIdentityKeypair(49  masterKey: Uint8Array,50  deviceId: string,51): SyncIdentityKeypair {52  if (masterKey.length === 0) throw new Error("masterKey must not be empty");53  if (!deviceId) throw new Error("deviceId must not be empty");54  const info = new TextEncoder().encode(deviceId);55  // HKDF-SHA256(salt="peach-sync-identity-v1", ikm=master_key, info=device_id)56  // → 32 bytes used directly as the X25519 secret key seed.57  const seed = new HKDF(SHA256, masterKey, SYNC_IDENTITY_SALT, info).expand(32);58  const kp = generateKeyPairFromSeed(seed);59  return { publicKey: kp.publicKey, secretKey: kp.secretKey };60}6162/**63 * Stable per-vault identifier carried in the mDNS TXT record and the64 * first WebSocket handshake. Receiver rejects the connection if its65 * own vault_id differs — prevents a paired-but-different-vault peer66 * from corrupting the registry.67 */68export async function computeVaultId(masterKey: Uint8Array): Promise<string> {69  if (masterKey.length === 0) throw new Error("masterKey must not be empty");70  const buf = new Uint8Array(masterKey.length + VAULT_ID_INFO.length);71  buf.set(masterKey, 0);72  buf.set(VAULT_ID_INFO, masterKey.length);73  const fullHex = await blake3(buf);74  return fullHex.slice(0, VAULT_ID_HEX_LENGTH);75}7677/**78 * Derive the deterministic Ed25519 signing keypair used to sign device79 * manifests (v2 brief §4.3). Distinct from the X25519 sync identity so80 * each key class stays single-purpose; both derive from the same master81 * key under a different HKDF salt.82 *83 * Returns Web Crypto `CryptoKey` handles; private key is non-extractable84 * so it can be passed around freely without risking leakage. The 32-byte85 * raw public key is also returned for inclusion in pairing payloads.86 */87export async function deriveSyncSigningKeypair(88  masterKey: Uint8Array,89  deviceId: string,90): Promise<{ privateKey: CryptoKey; publicKeyRaw: Uint8Array }> {91  if (masterKey.length === 0) throw new Error("masterKey must not be empty");92  if (!deviceId) throw new Error("deviceId must not be empty");93  const info = new TextEncoder().encode(deviceId);94  const seed = new HKDF(SHA256, masterKey, SYNC_SIGNING_SALT, info).expand(32);9596  const pkcs8 = new Uint8Array(ED25519_PKCS8_PREFIX.length + 32);97  pkcs8.set(ED25519_PKCS8_PREFIX, 0);98  pkcs8.set(seed, ED25519_PKCS8_PREFIX.length);99100  // The seed is already in memory so making the private key extractable101  // costs nothing in terms of attack surface, and the JWK export is the102  // portable way to recover the matching public key in Web Crypto engines103  // that don't expose `publicKey` directly from a `pkcs8`-imported handle.104  const privateKey = await crypto.subtle.importKey(105    "pkcs8",106    pkcs8 as Uint8Array<ArrayBuffer>,107    { name: "Ed25519" },108    true,109    ["sign"],110  );111  const jwk = (await crypto.subtle.exportKey("jwk", privateKey)) as JsonWebKey & { x?: string };112  if (!jwk.x) throw new Error("Ed25519 JWK missing 'x' component");113  const publicKeyRaw = base64UrlToBytes(jwk.x);114  return { privateKey, publicKeyRaw };115}116117/**118 * Verify an Ed25519 signature against a raw 32-byte public key. Returns119 * true if the signature is valid. Used to validate incoming device120 * manifests (v2 brief §4.3).121 */122export async function verifyEd25519(123  publicKeyRaw: Uint8Array,124  message: Uint8Array,125  signature: Uint8Array,126): Promise<boolean> {127  if (publicKeyRaw.length !== 32) return false;128  if (signature.length !== 64) return false;129  try {130    const key = await crypto.subtle.importKey(131      "raw",132      publicKeyRaw as Uint8Array<ArrayBuffer>,133      { name: "Ed25519" },134      false,135      ["verify"],136    );137    return await crypto.subtle.verify(138      "Ed25519",139      key,140      signature as Uint8Array<ArrayBuffer>,141      message as Uint8Array<ArrayBuffer>,142    );143  } catch {144    return false;145  }146}147148/** Sign with a private Ed25519 CryptoKey from `deriveSyncSigningKeypair`. */149export async function signEd25519(150  privateKey: CryptoKey,151  message: Uint8Array,152): Promise<Uint8Array> {153  const sig = await crypto.subtle.sign(154    "Ed25519",155    privateKey,156    message as Uint8Array<ArrayBuffer>,157  );158  return new Uint8Array(sig);159}160161function base64UrlToBytes(b64url: string): Uint8Array {162  const pad = (4 - (b64url.length % 4)) % 4;163  const b64 = b64url.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat(pad);164  const bin = atob(b64);165  const out = new Uint8Array(bin.length);166  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);167  return out;168}169170export function pubkeyToHex(pk: Uint8Array): string {171  let s = "";172  for (let i = 0; i < pk.length; i++) {173    s += pk[i].toString(16).padStart(2, "0");174  }175  return s;176}177178export function hexToPubkey(hex: string): Uint8Array {179  if (hex.length % 2 !== 0) throw new Error("hex length must be even");180  const out = new Uint8Array(hex.length / 2);181  for (let i = 0; i < out.length; i++) {182    const byte = parseInt(hex.slice(i * 2, i * 2 + 2), 16);183    if (Number.isNaN(byte)) throw new Error(`invalid hex at offset ${i * 2}`);184    out[i] = byte;185  }186  return out;187}