mailcycle 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 335f0b7efcc3477484330570f7429ab5b02110bddcf744da2c22b5fc924b7dbe
-  data.tar.gz: c119a992721686b72afa4973aa0504066d0b41cdc6c20bad031b5fce460fd1e0
+  metadata.gz: 00ac2000980d75a7daff3d987843ec8a7f55f8901972343322a96c73180834b4
+  data.tar.gz: c1f1d87eca6363dbd6d304f7fceef45ddc82ba6cb0ae0dadab8498dc84c1b8d6
 SHA512:
-  metadata.gz: c41cce333ffe2bf99e02528ee4e95ddefea75d268d97c22a5a18474ddacb72bc6690d893e15eb6052c77f570cd2f0a99f285d490a19ae79fd19ce2b280bcf877
-  data.tar.gz: 682bb34d733d5872529ff1bb80e223e419f52cb63e755f74e9e0f4f35512eab22b0dccd896f7123c5a3732cab1eb79d47b5cf72cd5278a0eef242e2a114c1090
+  metadata.gz: d9794b89fd4d79c0b6db76614fc3483862a933f792b198d5b748cd7fe203515f4c6c1170d07a71480db73102cedf42632947ff8ba6cbaab03e525696ee6ecd0a
+  data.tar.gz: b29ab90068d15725085ab6eb2034d53eb59ec500acd5647e93f4f5636125ba17f288fbfa1a5fb1e7d7c4e2473e141849923d1329695b8ee1d85d85550abf7dd9

data/README.md

@@ -205,4 +205,4 @@ The encryption is checked against Mailcycle's published test vectors (https://do
 
 ## Licence
 
-Apache License 2.0. Copyright (c) 2026 Northlab Studios Ltd. You may use, modify and redistribute this gem, including inside your own applications, under the terms in [LICENSE](LICENSE). Using the Mailcycle API itself is governed by the [Terms of Service](https://mailcycle.email/legal/terms/). Never ship an API key in software you distribute.
+Apache License 2.0. Copyright (c) 2026 Northlab Studios Ltd. You may use, modify and redistribute this gem, including inside your own applications, under the terms in the LICENSE file included with it. Using the Mailcycle API itself is governed by the [Terms of Service](https://mailcycle.email/legal/terms/). Never ship an API key in software you distribute.

data/lib/mailcycle/client.rb

@@ -81,8 +81,7 @@ module Mailcycle
   # that this machine holds the matching private one.
   #
   # Every constructor takes the same options: `api_url` (the live API by
-  # default), `passphrase` (empty unless the account was made with one) and
-  # `timeout` in seconds (30).
+  # default) and `timeout` in seconds (30).
   class Client
     attr_reader :http, :keys
 
@@ -96,8 +95,8 @@ module Mailcycle
     # The same challenge-response the app uses, in which nothing secret
     # crosses the wire. Sessions last 30 days; keep `session_token` and pass
     # it to `resume` rather than deriving the keys again every run.
-    def self.sign_in(phrase, api_url: Http::DEFAULT_API_URL, passphrase: "", timeout: Http::DEFAULT_TIMEOUT_SECONDS)
-      keys = Keys.from_phrase(phrase, passphrase)
+    def self.sign_in(phrase, api_url: Http::DEFAULT_API_URL, timeout: Http::DEFAULT_TIMEOUT_SECONDS)
+      keys = Keys.from_phrase(phrase)
       http = Http.new(api_url, nil, timeout)
 
       challenge = Wire.object(http.request("POST", "/accounts/challenge", body: { "accountId" => keys.account_id }))
@@ -116,9 +115,9 @@ module Mailcycle
     #
     # The phrase is still needed to open mail, and is checked against the
     # session's account before it is used.
-    def self.resume(session_token, phrase, api_url: Http::DEFAULT_API_URL, passphrase: "",
+    def self.resume(session_token, phrase, api_url: Http::DEFAULT_API_URL,
                     timeout: Http::DEFAULT_TIMEOUT_SECONDS)
-      keys = Keys.from_phrase(phrase, passphrase)
+      keys = Keys.from_phrase(phrase)
       client = new(Http.new(api_url, session_token, timeout), keys, api_key: false)
       client.__send__(:check_phrase_matches, "session")
       client
@@ -128,9 +127,9 @@ module Mailcycle
     #
     # With the phrase as well, the client can open mail and create addresses
     # that receive it; the phrase is checked against the key's account first.
-    def self.with_api_key(api_key, phrase: nil, api_url: Http::DEFAULT_API_URL, passphrase: "",
+    def self.with_api_key(api_key, phrase: nil, api_url: Http::DEFAULT_API_URL,
                           timeout: Http::DEFAULT_TIMEOUT_SECONDS)
-      keys = phrase.nil? ? nil : Keys.from_phrase(phrase, passphrase)
+      keys = phrase.nil? ? nil : Keys.from_phrase(phrase)
       client = new(Http.new(api_url, api_key, timeout), keys, api_key: true)
       client.__send__(:check_phrase_matches, "API key") if keys
       client
@@ -140,10 +139,10 @@ module Mailcycle
     #
     # Keep the phrase. Nothing can recover the account without it, and nobody
     # at Mailcycle can help.
-    def self.create_account(phrase = nil, api_url: Http::DEFAULT_API_URL, passphrase: "",
+    def self.create_account(phrase = nil, api_url: Http::DEFAULT_API_URL,
                             timeout: Http::DEFAULT_TIMEOUT_SECONDS)
       words = phrase || generate_phrase
-      keys = Keys.from_phrase(words, passphrase)
+      keys = Keys.from_phrase(words)
       http = Http.new(api_url, nil, timeout)
       session = Wire.object(http.request("POST", "/accounts", body: {
                                            "accountId" => keys.account_id,

data/lib/mailcycle/crypto/identity.rb

@@ -90,8 +90,8 @@ module Mailcycle
         )
       end
 
-      def identity_from_phrase(phrase, passphrase = "")
-        identity_from_seed(Mnemonic.phrase_to_seed(phrase, passphrase))
+      def identity_from_phrase(phrase)
+        identity_from_seed(Mnemonic.phrase_to_seed(phrase))
       end
 
       # The verifier the server is allowed to store.

data/lib/mailcycle/crypto/mnemonic.rb

@@ -19,9 +19,7 @@ module Mailcycle
       # Derivation cost.
       #
       # Changing it changes every account id ever derived, so this number is
-      # part of the format, not a tuning knob. Stretching buys little over a
-      # 128-bit phrase and earns its keep only for the optional passphrase,
-      # which may be low entropy.
+      # part of the format, not a tuning knob.
       SEED_ITERATIONS = 120_000
       SEED_BYTES = 64
       SEED_SALT_PREFIX = "mailcycle-seed"
@@ -112,14 +110,9 @@ module Mailcycle
       end
 
       # Phrase to 64-byte root seed.
-      #
-      # The optional passphrase is BIP-39's "25th word": it changes which
-      # account the phrase opens, and nothing anywhere records whether one was
-      # used.
-      def phrase_to_seed(phrase, passphrase = "")
+      def phrase_to_seed(phrase)
         words = normalize(phrase).join(" ")
-        salt = SEED_SALT_PREFIX.b + passphrase.to_s.b
-        Primitives.pbkdf2_sha256(words, salt, SEED_ITERATIONS, SEED_BYTES)
+        Primitives.pbkdf2_sha256(words, SEED_SALT_PREFIX.b, SEED_ITERATIONS, SEED_BYTES)
       end
     end
   end

data/lib/mailcycle/keys.rb

@@ -9,11 +9,11 @@ module Mailcycle
   # the iteration count is the format either way, and changing it would change
   # every account id ever derived.
   class Keys
-    def self.from_phrase(phrase, passphrase = "")
+    def self.from_phrase(phrase)
       problem = Crypto::Mnemonic.validate(phrase)
       raise PhraseError, problem unless problem.nil?
 
-      new(Crypto::Identity.identity_from_seed(Crypto::Mnemonic.phrase_to_seed(phrase, passphrase)))
+      new(Crypto::Identity.identity_from_seed(Crypto::Mnemonic.phrase_to_seed(phrase)))
     end
 
     def initialize(identity)

data/lib/mailcycle/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mailcycle
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mailcycle
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Northlab Studios Ltd