fix(storage-encrypted): tilfeldig AES-GCM-nonce + vault-nøkkelgren

To endringer i samme krypto-filer.

G0-P0: deriveNonce() lagde nonce som en ren funksjon av radens identitet.
saveSession re-forsegler ved hvert ratchet-steg, så (key, nonce) gjentok seg
per konstruksjon over ULIK plaintext — GCM forbidden attack, som lekker både
XOR-en av plaintekstene og GHASH-subnøkkelen. Fire kallesteder: sealString og
sealBytes tar nå randomNonce(), openString/openBytes slutter å tvinge den.

Ingen migrering: aeadOpen har alltid lest nonce fra blob-prefikset, så
eksisterende data åpnes uendret. Testet eksplisitt. deriveNonce og
expectedNonce beholdt som deprecated — begge er del av den publiserte flaten.
Android var aldri rammet; KeystoreStorage bruker cipher.iv, som Android
Keystore alltid genererer tilfeldig.

V4.13: egen HKDF-gren for vault (shade-vault-{id,content,sig}-v1). Ikke
gjenbruk av shade-blob-*-v1: en vault-nøkkel leser hver eneste fil, en
profil-blob-nøkkel leser en vertsliste. Delt derivasjon ville gjort ett
kompromiss om til det andre.

9 nye tester; testene er bevist å ha verdi ved å reversere fiksen —
nøyaktig de tre som beskriver feilen faller. 87 grønne totalt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/shade-storage-encrypted/tests/nonce-reuse.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Regression tests for the AES-GCM nonce-reuse fix (G0).
+ *
+ * The codec used to derive its nonce from (fieldKey, table, pk) alone. That
+ * is a pure function of row identity, so every re-seal of a mutable row —
+ * `saveSession` runs on each ratchet step — reused (key, nonce) across
+ * different plaintexts. AES-GCM forbids exactly that: it leaks the XOR of
+ * the plaintexts and the GHASH subkey, which yields tag forgery under that
+ * key. These tests fail if the derivation ever comes back.
+ */
+import { describe, test, expect } from 'bun:test';
+import { KeyManager } from '../src/crypto/key-manager.js';
+import { AEAD_NONCE_LEN, aeadSeal } from '../src/crypto/aead.js';
+import { buildAad, deriveNonce } from '../src/crypto/kdf.js';
+import {
+  COL,
+  TBL,
+  openBytes,
+  openString,
+  sealBytes,
+  sealString,
+} from '../src/crypto/row-codec.js';
+
+const TEXT = new TextEncoder();
+
+function km(): Promise<KeyManager> {
+  return KeyManager.open({ kind: 'injected', key: new Uint8Array(32).fill(0x42) });
+}
+
+const nonceOf = (blob: Uint8Array) => blob.subarray(0, AEAD_NONCE_LEN);
+const hex = (b: Uint8Array) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+
+describe('nonce uniqueness across re-saves', () => {
+  test('two seals of the same row do not share a nonce', async () => {
+    const k = await km();
+    // The real shape of the bug: same (table, column, pk), different
+    // plaintext, as a session row is re-sealed on every ratchet step.
+    const first = await sealString(k, TBL.sessions, COL.session, 'alice', '{"messageCount":1}');
+    const second = await sealString(k, TBL.sessions, COL.session, 'alice', '{"messageCount":2}');
+    expect(hex(nonceOf(first))).not.toBe(hex(nonceOf(second)));
+    k.destroy();
+  });
+
+  test('a long run of re-saves produces all-distinct nonces', async () => {
+    const k = await km();
+    const seen = new Set<string>();
+    for (let i = 0; i < 200; i++) {
+      const blob = await sealString(k, TBL.sessions, COL.session, 'alice', `state-${i}`);
+      seen.add(hex(nonceOf(blob)));
+    }
+    expect(seen.size).toBe(200);
+    k.destroy();
+  });
+
+  test('sealBytes is covered by the same rule', async () => {
+    const k = await km();
+    const a = await sealBytes(k, TBL.config, COL.config, 'cfg', TEXT.encode('one'));
+    const b = await sealBytes(k, TBL.config, COL.config, 'cfg', TEXT.encode('two'));
+    expect(hex(nonceOf(a))).not.toBe(hex(nonceOf(b)));
+    k.destroy();
+  });
+
+  test('the nonce is not the derived one', async () => {
+    const k = await km();
+    const blob = await sealString(k, TBL.sessions, COL.session, 'alice', 'payload');
+    const derived = deriveNonce(k.fieldKey(TBL.sessions, COL.session), TBL.sessions, 'alice');
+    expect(hex(nonceOf(blob))).not.toBe(hex(derived));
+    k.destroy();
+  });
+});
+
+describe('backward compatibility with deterministically-sealed blobs', () => {
+  // `aeadOpen` has always read the nonce from the blob prefix, so data
+  // written before the fix opens unchanged and needs no migration. This
+  // test reproduces an old blob by sealing with the deprecated derivation.
+  test('a blob sealed with the old derived nonce still opens', async () => {
+    const k = await km();
+    const key = k.fieldKey(TBL.sessions, COL.session);
+    const legacy = await aeadSeal(
+      key,
+      deriveNonce(key, TBL.sessions, 'alice'),
+      TEXT.encode('written before the fix'),
+      buildAad(TBL.sessions, COL.session, 'alice'),
+    );
+
+    const opened = await openString(k, TBL.sessions, COL.session, 'alice', legacy);
+    expect(opened).toBe('written before the fix');
+    k.destroy();
+  });
+
+  test('openBytes reads an old blob too', async () => {
+    const k = await km();
+    const key = k.fieldKey(TBL.config, COL.config);
+    const payload = TEXT.encode('legacy bytes');
+    const legacy = await aeadSeal(
+      key,
+      deriveNonce(key, TBL.config, 'cfg'),
+      payload,
+      buildAad(TBL.config, COL.config, 'cfg'),
+    );
+
+    expect(await openBytes(k, TBL.config, COL.config, 'cfg', legacy)).toEqual(payload);
+    k.destroy();
+  });
+
+  test('new and old blobs are both readable under one key', async () => {
+    const k = await km();
+    const key = k.fieldKey(TBL.sessions, COL.session);
+    const legacy = await aeadSeal(
+      key,
+      deriveNonce(key, TBL.sessions, 'bob'),
+      TEXT.encode('old'),
+      buildAad(TBL.sessions, COL.session, 'bob'),
+    );
+    const fresh = await sealString(k, TBL.sessions, COL.session, 'bob', 'new');
+
+    expect(await openString(k, TBL.sessions, COL.session, 'bob', legacy)).toBe('old');
+    expect(await openString(k, TBL.sessions, COL.session, 'bob', fresh)).toBe('new');
+    k.destroy();
+  });
+});
+
+describe('tamper detection survives the switch', () => {
+  // The dropped `expectedNonce` check was the stated reason for the
+  // deterministic nonce. It detected nothing the AEAD tag misses.
+  test('a flipped nonce byte is still rejected', async () => {
+    const k = await km();
+    const blob = await sealString(k, TBL.sessions, COL.session, 'alice', 'payload');
+    const tampered = new Uint8Array(blob);
+    tampered[0]! ^= 0x01;
+    await expect(openString(k, TBL.sessions, COL.session, 'alice', tampered)).rejects.toThrow();
+    k.destroy();
+  });
+
+  test('a blob moved to another row is still rejected (AAD binding)', async () => {
+    const k = await km();
+    const blob = await sealString(k, TBL.sessions, COL.session, 'alice', 'alice-secret');
+    await expect(openString(k, TBL.sessions, COL.session, 'bob', blob)).rejects.toThrow();
+    k.destroy();
+  });
+});