fix(storage-encrypted): tilfeldig AES-GCM-nonce + vault-nøkkelgren

To endringer i samme krypto-filer.

G0-P0: deriveNonce() lagde nonce som en ren funksjon av radens identitet.
saveSession re-forsegler ved hvert ratchet-steg, så (key, nonce) gjentok seg
per konstruksjon over ULIK plaintext — GCM forbidden attack, som lekker både
XOR-en av plaintekstene og GHASH-subnøkkelen. Fire kallesteder: sealString og
sealBytes tar nå randomNonce(), openString/openBytes slutter å tvinge den.

Ingen migrering: aeadOpen har alltid lest nonce fra blob-prefikset, så
eksisterende data åpnes uendret. Testet eksplisitt. deriveNonce og
expectedNonce beholdt som deprecated — begge er del av den publiserte flaten.
Android var aldri rammet; KeystoreStorage bruker cipher.iv, som Android
Keystore alltid genererer tilfeldig.

V4.13: egen HKDF-gren for vault (shade-vault-{id,content,sig}-v1). Ikke
gjenbruk av shade-blob-*-v1: en vault-nøkkel leser hver eneste fil, en
profil-blob-nøkkel leser en vertsliste. Delt derivasjon ville gjort ett
kompromiss om til det andre.

9 nye tester; testene er bevist å ha verdi ved å reversere fiksen —
nøyaktig de tre som beskriver feilen faller. 87 grønne totalt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/shade-storage-encrypted/src/crypto.ts

@@ -34,12 +34,16 @@ export {
   deriveBlobSlotId,
   deriveBlobKey,
   deriveBlobSigningSeed,
+  deriveVaultId,
+  deriveVaultContentKey,
+  deriveVaultSigningSeed,
 } from './crypto/kdf.js';
 export {
   AEAD_NONCE_LEN,
   AEAD_TAG_LEN,
   aeadSeal,
   aeadOpen,
+  randomNonce,
 } from './crypto/aead.js';
 export {
   COL,

packages/shade-storage-encrypted/src/crypto/aead.ts

@@ -33,9 +33,32 @@ async function importKey(key: Uint8Array, usages: WebCryptoKeyUsage[]): Promise<
 }
 
 /**
- * Encrypt a plaintext blob with the given key and a deterministic nonce.
- * Returns `nonce || ct||tag` as a single Uint8Array suitable for direct
- * BLOB storage.
+ * A fresh random 12-byte nonce.
+ *
+ * AES-GCM tolerates key reuse but not (key, nonce) reuse: two ciphertexts
+ * sealed under the same pair leak the XOR of their plaintexts and, worse,
+ * the GHASH authentication subkey — the "forbidden attack", which yields
+ * tag forgery for that key. Mutable rows are re-sealed on every change
+ * (`saveSession` runs on each ratchet step), so a nonce derived from row
+ * identity alone repeats by construction.
+ *
+ * Random beats a counter here because the codec is shared across SQLite
+ * and Postgres and has no durable per-row write counter to lean on. At
+ * 96 bits, collision probability stays negligible far past any realistic
+ * number of re-saves.
+ */
+export function randomNonce(): Uint8Array {
+  return globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LEN));
+}
+
+/**
+ * Encrypt a plaintext blob with the given key and nonce. Returns
+ * `nonce || ct||tag` as a single Uint8Array suitable for direct BLOB
+ * storage.
+ *
+ * Callers must pass a nonce that is fresh for this key — see
+ * {@link randomNonce}. Never derive one deterministically from row
+ * identity for a row that can be written more than once.
  */
 export async function aeadSeal(
   key: Uint8Array,
@@ -58,9 +81,19 @@ export async function aeadSeal(
 }
 
 /**
- * Decrypt a `nonce || ct||tag` blob. The expected nonce is verified against
- * the prefix to detect tampering before we even reach the AEAD; if the
- * caller passes a `expectedNonce`, mismatch throws before SubtleCrypto runs.
+ * Decrypt a `nonce || ct||tag` blob.
+ *
+ * The nonce always comes from the blob prefix, which is what makes the
+ * move to random nonces backward compatible: a blob sealed under the old
+ * deterministic scheme opens unchanged, because its nonce was already
+ * stored the same way.
+ *
+ * @param expectedNonce **Deprecated.** Only meaningful when the nonce is
+ * a pure function of row identity, which is exactly the pattern that made
+ * (key, nonce) repeat. It adds no tamper detection that the AEAD tag and
+ * the (table, column, pk) AAD do not already provide — a flipped bit in
+ * the nonce fails the tag. Retained so existing callers keep compiling;
+ * pass nothing.
  */
 export async function aeadOpen(
   key: Uint8Array,

packages/shade-storage-encrypted/src/crypto/kdf.ts

@@ -106,12 +106,20 @@ export function deriveFieldKey(storageKey: Uint8Array, table: string, column: st
 }
 
 /**
- * Derive a deterministic 12-byte AEAD nonce from a row key (typically the
- * field key) plus (table, pk) binding. With per-field keys, deterministic
- * nonces are safe because each (key, plaintext) pair appears at most once
- * — re-saving the same row reuses the (nonce, key) pair only because the
- * plaintext also changes (chain ratchet, prekey state, etc.). The AAD
- * also binds (table, column, pk) so swapping is rejected on decrypt.
+ * Derive a deterministic 12-byte AEAD nonce from a row key plus (table, pk).
+ *
+ * @deprecated Unsafe for anything that can be written twice, which is every
+ * mutable row. The original rationale held that re-saving a row was fine
+ * "because the plaintext also changes" — but that is precisely the case
+ * AES-GCM forbids: reusing (key, nonce) across *different* plaintexts leaks
+ * their XOR and the GHASH subkey (the forbidden attack), enabling tag
+ * forgery. `saveSession` re-seals on every ratchet step, so the pair
+ * repeated by construction. Use {@link randomNonce} from `./aead.js`.
+ *
+ * Kept exported (it is part of the published surface via `index.ts` and
+ * `crypto.ts`) so consumers keep compiling. No caller inside this package
+ * uses it any more. Reading old data needs no migration: `aeadOpen` has
+ * always taken the nonce from the blob prefix.
  */
 export function deriveNonce(rowKey: Uint8Array, table: string, pk: string): Uint8Array {
   const out = hkdfDerive(rowKey, `shade-row-nonce-v1:${table}:${pk}`, 12);
@@ -161,3 +169,42 @@ export function deriveBlobKey(masterKey: Uint8Array, app: string): Uint8Array {
 export function deriveBlobSigningSeed(masterKey: Uint8Array, app: string): Uint8Array {
   return hkdfDerive(masterKey, `shade-blob-sig-v1:${app}`, 32);
 }
+
+// ─── V4.13 — vault (server-side encrypted file store) ──────────
+//
+// The blob primitive above holds ONE small blob per slot. A vault holds
+// a whole collection — a project workspace, a mailbox, a drive folder —
+// as content-addressed objects plus an append-only log of manifests.
+//
+// Its own HKDF branch rather than a reuse of `shade-blob-*-v1`, for two
+// reasons. A vault key is used on far more ciphertext than a profile
+// blob ever is, and the two have different blast radii: whoever holds
+// the vault key can read every file, while the profile key exposes only
+// the host list. Separate labels mean compromising one cannot be turned
+// into the other, even though both hang off the same master.
+//
+//   vaultId    = HKDF(masterKey, info=`shade-vault-id-v1:${app}`)
+//   contentKey = HKDF(masterKey, info=`shade-vault-content-v1:${app}`)
+//   sigSeed    = HKDF(masterKey, info=`shade-vault-sig-v1:${app}`)
+
+/** 32-byte vault identifier. Opaque to the relay, like a slotId. */
+export function deriveVaultId(masterKey: Uint8Array, app: string): Uint8Array {
+  return hkdfDerive(masterKey, `shade-vault-id-v1:${app}`, 32);
+}
+
+/**
+ * AEAD key for the vault's objects and manifests.
+ *
+ * One key for the whole collection, not one per file: per-file keys would
+ * have to be stored somewhere, and that somewhere would be a manifest
+ * encrypted under a collection key anyway. Object AAD binds the content
+ * hash, so a ciphertext cannot be moved to another object's name.
+ */
+export function deriveVaultContentKey(masterKey: Uint8Array, app: string): Uint8Array {
+  return hkdfDerive(masterKey, `shade-vault-content-v1:${app}`, 32);
+}
+
+/** 32-byte Ed25519 signing seed; TOFU-pinned by the relay on first write. */
+export function deriveVaultSigningSeed(masterKey: Uint8Array, app: string): Uint8Array {
+  return hkdfDerive(masterKey, `shade-vault-sig-v1:${app}`, 32);
+}

packages/shade-storage-encrypted/src/crypto/row-codec.ts

@@ -22,8 +22,8 @@ import {
   serializeSignedPreKey, deserializeSignedPreKey,
   toBase64, fromBase64,
 } from '@shade/core';
-import { aeadOpen, aeadSeal } from './aead.js';
-import { buildAad, deriveNonce } from './kdf.js';
+import { aeadOpen, aeadSeal, randomNonce } from './aead.js';
+import { buildAad } from './kdf.js';
 import type { KeyManager } from './key-manager.js';
 
 const TEXT_ENCODER = new TextEncoder();
@@ -64,9 +64,8 @@ export async function sealString(
   plaintext: string,
 ): Promise<Uint8Array> {
   const key = km.fieldKey(table, column);
-  const nonce = deriveNonce(key, table, pk);
   const aad = buildAad(table, column, pk);
-  return aeadSeal(key, nonce, TEXT_ENCODER.encode(plaintext), aad);
+  return aeadSeal(key, randomNonce(), TEXT_ENCODER.encode(plaintext), aad);
 }
 
 /** Decrypt a blob into a string, reconstructing AAD from (table, column, pk). */
@@ -78,9 +77,8 @@ export async function openString(
   blob: Uint8Array,
 ): Promise<string> {
   const key = km.fieldKey(table, column);
-  const expectedNonce = deriveNonce(key, table, pk);
   const aad = buildAad(table, column, pk);
-  const pt = await aeadOpen(key, blob, aad, expectedNonce);
+  const pt = await aeadOpen(key, blob, aad);
   return TEXT_DECODER.decode(pt);
 }
 
@@ -93,9 +91,8 @@ export async function sealBytes(
   plaintext: Uint8Array,
 ): Promise<Uint8Array> {
   const key = km.fieldKey(table, column);
-  const nonce = deriveNonce(key, table, pk);
   const aad = buildAad(table, column, pk);
-  return aeadSeal(key, nonce, plaintext, aad);
+  return aeadSeal(key, randomNonce(), plaintext, aad);
 }
 
 /** Decrypt arbitrary bytes payload. */
@@ -107,9 +104,8 @@ export async function openBytes(
   blob: Uint8Array,
 ): Promise<Uint8Array> {
   const key = km.fieldKey(table, column);
-  const expectedNonce = deriveNonce(key, table, pk);
   const aad = buildAad(table, column, pk);
-  return aeadOpen(key, blob, aad, expectedNonce);
+  return aeadOpen(key, blob, aad);
 }
 
 // ─── Typed encoders for each StorageProvider entity ──────────────────────

packages/shade-storage-encrypted/src/index.ts

@@ -19,12 +19,16 @@ export {
   deriveBlobSlotId,
   deriveBlobKey,
   deriveBlobSigningSeed,
+  deriveVaultId,
+  deriveVaultContentKey,
+  deriveVaultSigningSeed,
 } from './crypto/kdf.js';
 export {
   AEAD_NONCE_LEN,
   AEAD_TAG_LEN,
   aeadSeal,
   aeadOpen,
+  randomNonce,
 } from './crypto/aead.js';
 export { EncryptedSQLiteStorage } from './storage/encrypted-sqlite.js';
 export {