@rapidmx/web-client 0.35.0 → 0.37.0

package/lib/crypto/keyExport.ts

@@ -0,0 +1,229 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * "Export keys for Outlook/phone" (restapi `specs/search.md` §3, *Clients that don't run RapidMX*): a passphrase-protected
+ * PKCS#12 file holding the private keys a mail client needs to read this mailbox's mail on its own - every zero-access key
+ * (mail at rest is S/MIME `enveloped-data` to these) and every end-to-end encryption key (current and retained), plus, only
+ * when asked, the active signing key. Built entirely here from a fresh master-password unlock: the session's own private
+ * keys are non-extractable, and the server never sees the file or the passphrase. restapi only records that an export
+ * happened (`key_vault.export`), with the fingerprints exported and nothing else.
+ */
+import "reflect-metadata";
+import * as asn1js from "asn1js";
+import * as pkijs from "pkijs";
+import type { ApiClient } from "../util/api.js";
+import { fromBase64 } from "./encoding.js";
+import { type KeyVault, type PublicKey, findActivePublicKey, isOpenPgpKey, recordKeyExport, type WrappedPrivateKey } from "./keyvaultApi.js";
+import {
+    ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE,
+    MAX_RETAINED_ENCRYPTION_KEYS,
+    openMasterKeyWithPassword,
+    SIGNING_PRIVATE_KEY_AAD_PURPOSE,
+    ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE,
+} from "./keySession.js";
+import { buildAad, openWithKey } from "./masterKey.js";
+
+/** PBKDF2 iterations for the shrouded key bags and the PKCS#12 MAC. Windows, macOS and iOS all accept this. */
+export const KEY_EXPORT_ITERATIONS = 100_000;
+
+/** The shortest export passphrase accepted. The file grants read access to all of this mailbox's mail. */
+export const MIN_EXPORT_PASSPHRASE_LENGTH = 12;
+
+const PKCS8_SHROUDED_KEY_BAG = "1.2.840.113549.1.12.10.1.2";
+const CERT_BAG = "1.2.840.113549.1.12.10.1.3";
+const X509_CERTIFICATE = "1.2.840.113549.1.9.22.1";
+const FRIENDLY_NAME = "1.2.840.113549.1.9.20";
+const LOCAL_KEY_ID = "1.2.840.113549.1.9.21";
+
+/** The shrouded key bags' cipher. pkijs's type wants an `iv`, but it generates a fresh one for every bag and ignores this one. */
+const AES_256_CBC = { name: "AES-CBC", length: 256, iv: new Uint8Array(16) } as pkijs.ContentEncryptionAlgorithm;
+
+/** Which key a bag holds, for its friendly name and the export's audit record. */
+export type ExportedKeyKind = "zero-access" | "encrypt" | "sign";
+
+/** What `exportKeysAsPkcs12()` takes. */
+export interface KeyExportInput {
+    mailboxUid: string;
+    /** The mailbox's address, used in each key's friendly name. */
+    mailboxAddress: string;
+    /** The mailbox's published keys (`Mailbox.keys`): the encryption and signing certificates. */
+    mailboxKeys: PublicKey[];
+    /** The master password, for the fresh unlock every export needs. */
+    masterPassword: string;
+    /** Protects the PKCS#12 file. At least `MIN_EXPORT_PASSPHRASE_LENGTH` characters. */
+    exportPassphrase: string;
+    /** Whether to include the active signing key, for clients that will sign. Off unless the user opts in. */
+    includeSigningKey?: boolean;
+}
+
+/** One key in the export. */
+export interface ExportedKey {
+    kind: ExportedKeyKind;
+    fingerprint: string;
+}
+
+/** What `exportKeysAsPkcs12()` resolves with. */
+export interface KeyExport {
+    /** The DER-encoded PKCS#12 (`.p12`) file. */
+    pkcs12: Uint8Array;
+    /** The keys it holds, zero-access keys first. */
+    keys: ExportedKey[];
+}
+
+/** One private key opened from the vault, before it goes into a bag. Its `pkcs8` is zeroed once the file is built. */
+interface OpenedKey extends ExportedKey {
+    certDer: Uint8Array;
+    pkcs8: Uint8Array;
+}
+
+/** The export has nothing to hold - the vault has no zero-access or encryption private key this password opens. */
+export class NothingToExportError extends Error {
+    constructor() {
+        super("This mailbox has no keys to export yet.");
+        this.name = "NothingToExportError";
+    }
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer;
+}
+
+function hexBytes(hex: string): Uint8Array {
+    const out = new Uint8Array(hex.length >> 1);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+
+function bagAttributes(friendlyName: string, localKeyId: Uint8Array): pkijs.Attribute[] {
+    return [
+        new pkijs.Attribute({ type: FRIENDLY_NAME, values: [new asn1js.BmpString({ value: friendlyName })] }),
+        new pkijs.Attribute({ type: LOCAL_KEY_ID, values: [new asn1js.OctetString({ valueHex: toArrayBuffer(localKeyId) })] }),
+    ];
+}
+
+function friendlyName(kind: ExportedKeyKind, address: string, index: number): string {
+    const label = kind === "zero-access" ? "zero-access key" : kind === "encrypt" ? "encryption key" : "signing key";
+    return `RapidMX ${label} (${address})${index > 0 ? ` ${index + 1}` : ""}`;
+}
+
+/** Opens one wrapped private key to its raw PKCS#8, or `undefined` when it won't open under this master key - an export
+ * carries what it can rather than failing on one stale wrap. */
+async function openPkcs8(masterKey: Uint8Array, wrapped: WrappedPrivateKey, aad: Uint8Array): Promise<Uint8Array | undefined> {
+    try {
+        return await openWithKey(masterKey, wrapped, aad);
+    } catch {
+        return undefined;
+    }
+}
+
+/** Opens every key the export holds, in order: zero-access keys (unrevoked newest first), the encryption keys (active
+ * first, then retained newest first), then the active signing key if asked. Each list is capped like the session's. */
+async function openExportedKeys(input: KeyExportInput, vault: KeyVault, masterKey: Uint8Array): Promise<OpenedKey[]> {
+    const opened: OpenedKey[] = [];
+    const wrappedFor = (fingerprint: string) => vault.wrappedKeys.find((k) => k.fingerprint === fingerprint);
+    const take = async (kind: ExportedKeyKind, keys: { fingerprint: string; publicKey: string }[], purpose: string, max: number) => {
+        const aad = buildAad(input.mailboxUid, purpose);
+        const seen = new Set<string>();
+        for (const key of keys) {
+            const wrapped = wrappedFor(key.fingerprint);
+            if (!wrapped || seen.has(key.fingerprint) || seen.size === max) {
+                continue;
+            }
+            const pkcs8 = await openPkcs8(masterKey, wrapped, aad);
+            if (pkcs8) {
+                seen.add(key.fingerprint);
+                opened.push({ kind, fingerprint: key.fingerprint, certDer: fromBase64(key.publicKey), pkcs8 });
+            }
+        }
+    };
+
+    const zeroAccess = [...(vault.zeroAccessKeys ?? [])].sort((a, b) => Number(!!a.revokedAt) - Number(!!b.revokedAt) || b.notBefore - a.notBefore);
+    await take("zero-access", zeroAccess, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE, MAX_RETAINED_ENCRYPTION_KEYS + 1);
+
+    const active = findActivePublicKey(input.mailboxKeys, "encrypt");
+    const encryption = [
+        ...(active ? [active] : []),
+        ...input.mailboxKeys.filter((k) => k.useType === "encrypt" && !isOpenPgpKey(k) && k !== active).sort((a, b) => b.notBefore - a.notBefore),
+    ];
+    await take("encrypt", encryption, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, MAX_RETAINED_ENCRYPTION_KEYS + 1);
+
+    if (input.includeSigningKey) {
+        const signing = findActivePublicKey(input.mailboxKeys, "sign");
+        await take("sign", signing ? [signing] : [], SIGNING_PRIVATE_KEY_AAD_PURPOSE, 1);
+    }
+    return opened;
+}
+
+/** Builds the PKCS#12 file: one PBES2 (PBKDF2-SHA256, AES-256-CBC) shrouded key bag and one certificate bag per key,
+ * paired by `localKeyID`, in an unencrypted SafeContents, under a SHA-256 MAC. */
+async function buildPkcs12(keys: OpenedKey[], address: string, passphrase: string): Promise<Uint8Array> {
+    const crypto = pkijs.getCrypto(true);
+    // UTF-8 for both: pkijs re-encodes it as the BMPString the PKCS#12 MAC derivation (RFC 7292 Appendix B) takes.
+    const utf8 = toArrayBuffer(new TextEncoder().encode(passphrase));
+    const bags: pkijs.SafeBag[] = [];
+    const shrouded: pkijs.PKCS8ShroudedKeyBag[] = [];
+    const counts: Record<ExportedKeyKind, number> = { "zero-access": 0, encrypt: 0, sign: 0 };
+
+    for (const key of keys) {
+        const name = friendlyName(key.kind, address, counts[key.kind]++);
+        const localKeyId = hexBytes(key.fingerprint).slice(0, 20);
+        const keyBag = new pkijs.PKCS8ShroudedKeyBag({ parsedValue: pkijs.PrivateKeyInfo.fromBER(toArrayBuffer(key.pkcs8)) });
+        shrouded.push(keyBag);
+        bags.push(new pkijs.SafeBag({ bagId: PKCS8_SHROUDED_KEY_BAG, bagValue: keyBag, bagAttributes: bagAttributes(name, localKeyId) }));
+        const certBag = new pkijs.CertBag({ certId: X509_CERTIFICATE, parsedValue: pkijs.Certificate.fromBER(toArrayBuffer(key.certDer)) });
+        bags.push(new pkijs.SafeBag({ bagId: CERT_BAG, bagValue: certBag, bagAttributes: bagAttributes(name, localKeyId) }));
+    }
+
+    for (const keyBag of shrouded) {
+        await keyBag.makeInternalValues(
+            { password: utf8, contentEncryptionAlgorithm: AES_256_CBC, hmacHashAlgorithm: "SHA-256", iterationCount: KEY_EXPORT_ITERATIONS },
+            crypto,
+        );
+    }
+
+    const pfx = new pkijs.PFX({
+        parsedValue: {
+            integrityMode: 0,
+            authenticatedSafe: new pkijs.AuthenticatedSafe({ parsedValue: { safeContents: [{ privacyMode: 0, value: new pkijs.SafeContents({ safeBags: bags }) }] } }),
+        },
+    });
+    await pfx.parsedValue!.authenticatedSafe!.makeInternalValues({ safeContents: [{}] }, crypto);
+    await pfx.makeInternalValues(
+        { password: utf8, iterations: KEY_EXPORT_ITERATIONS, pbkdf2HashAlgorithm: { name: "SHA-256" }, hmacHashAlgorithm: "SHA-256" },
+        crypto,
+    );
+    return new Uint8Array(pfx.toSchema().toBER(false));
+}
+
+/**
+ * Builds the "Export keys for Outlook/phone" PKCS#12 for `input.mailboxUid` (see this module's comment) and records the
+ * export with restapi. Re-opens the vault with `masterPassword` - rejecting as `unlockWithPassword()` does on a wrong
+ * one - and never touches the in-memory session. Every opened private key and the master key are zeroed before this
+ * returns, whether or not it succeeds. Throws `NothingToExportError` when no key opens.
+ */
+export async function exportKeysAsPkcs12(input: KeyExportInput, client?: ApiClient): Promise<KeyExport> {
+    if (input.exportPassphrase.length < MIN_EXPORT_PASSPHRASE_LENGTH) {
+        throw new Error(`The export passphrase must be at least ${MIN_EXPORT_PASSPHRASE_LENGTH} characters.`);
+    }
+    const { vault, masterKey } = await openMasterKeyWithPassword(input.mailboxUid, input.masterPassword, client);
+    let opened: OpenedKey[] = [];
+    try {
+        opened = await openExportedKeys(input, vault, masterKey);
+        if (!opened.some((k) => k.kind !== "sign")) {
+            throw new NothingToExportError();
+        }
+        const pkcs12 = await buildPkcs12(opened, input.mailboxAddress, input.exportPassphrase);
+        const keys = opened.map(({ kind, fingerprint }) => ({ kind, fingerprint }));
+        await recordKeyExport(input.mailboxUid, keys, client);
+        return { pkcs12, keys };
+    } finally {
+        masterKey.fill(0);
+        for (const key of opened) {
+            key.pkcs8.fill(0);
+        }
+    }
+}

package/lib/crypto/keyPairMatch.ts

@@ -0,0 +1,69 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Whether a certificate the server lists is really the one of a private key this device opened. A zero-access key's private half comes
+ * from an authenticated seal (or a member's wrap), but its certificate comes from the server as it is: what this device then encrypts
+ * to that certificate - the search index segments it builds from end-to-end mail, a protected meeting's key - must not go to a key the
+ * server swapped in. Plain WebCrypto and a few lines of DER, so the unlock path loads no certificate library.
+ */
+
+/** One DER element of `der` at `offset`: where its header starts, where its content starts, where it ends. */
+function element(der: Uint8Array, offset: number): { tag: number; header: number; content: number; end: number } {
+    const tag = der[offset];
+    let length = der[offset + 1];
+    let content = offset + 2;
+    if (length & 0x80) {
+        const bytes = length & 0x7f;
+        if (bytes === 0 || bytes > 4) {
+            throw new Error("Unsupported DER length.");
+        }
+        length = 0;
+        for (let i = 0; i < bytes; i++) {
+            length = length * 256 + der[content + i];
+        }
+        content += bytes;
+    }
+    const end = content + length;
+    if (tag === undefined || end > der.length) {
+        throw new Error("Truncated DER.");
+    }
+    return { tag, header: offset, content, end };
+}
+
+/** The children of the constructed element `parent`. */
+function children(der: Uint8Array, parent: { content: number; end: number }): ReturnType<typeof element>[] {
+    const found: ReturnType<typeof element>[] = [];
+    for (let offset = parent.content; offset < parent.end; offset = found[found.length - 1].end) {
+        found.push(element(der, offset));
+    }
+    return found;
+}
+
+/** The SubjectPublicKeyInfo of X.509 certificate `certDer` (RFC 5280: the seventh field of `tbsCertificate`, the sixth when it has no
+ * explicit version). */
+function subjectPublicKeyInfo(certDer: Uint8Array): Uint8Array {
+    const [tbs] = children(certDer, element(certDer, 0));
+    const fields = children(certDer, tbs);
+    const spki = fields[fields[0].tag === 0xa0 ? 6 : 5];
+    if (!spki || spki.tag !== 0x30) {
+        throw new Error("No subject public key.");
+    }
+    return certDer.subarray(spki.header, spki.end);
+}
+
+const P256_ECDH: EcKeyImportParams = { name: "ECDH", namedCurve: "P-256" };
+
+/** Whether `certDer` (a P-256 certificate) carries the public half of `pkcs8` (a P-256 private key). Never rejects: anything that won't
+ * parse or import is `false`. */
+export async function certificateHoldsKey(certDer: Uint8Array, pkcs8: Uint8Array): Promise<boolean> {
+    try {
+        const publicKey = await crypto.subtle.importKey("spki", subjectPublicKeyInfo(certDer) as BufferSource, P256_ECDH, true, []);
+        const privateKey = await crypto.subtle.importKey("pkcs8", pkcs8 as BufferSource, P256_ECDH, true, ["deriveBits"]);
+        const [certified, held] = await Promise.all([crypto.subtle.exportKey("jwk", publicKey), crypto.subtle.exportKey("jwk", privateKey)]);
+        return !!certified.x && certified.x === held.x && certified.y === held.y;
+    } catch {
+        return false;
+    }
+}

package/lib/crypto/keySession.ts

@@ -21,12 +21,15 @@
  * follow-up, not a silent gap: a mailbox enrolled *only* with a passkey has no way to unlock through this
  * module today.
  */
-import { type KeyVault, type PublicKey, type WrappedPrivateKey, findActivePublicKey, getKeyVault } from "./keyvaultApi.js";
+import { type KeyVault, type PublicKey, type WrappedPrivateKey, findActivePublicKey, getKeyVault, isOpenPgpKey } from "./keyvaultApi.js";
+import type { ApiClient } from "../util/api.js";
 import { fromBase64 } from "./encoding.js";
+import { certificateHoldsKey } from "./keyPairMatch.js";
 import { importPrivateKeyPkcs8 } from "./keys.js";
 import { KeysLockedError, buildAad, openWithKey } from "./masterKey.js";
 import { deriveFromPassword, parseArgon2idKdfLabel } from "./passwordUnlock.js";
 import { RECOVERY_KDF_LABEL, deriveFromRecoveryCode } from "./recoveryCode.js";
+import type { OpenPgpPrivateKey } from "./openpgp.js";
 
 /** AAD purpose labels — MUST exactly match what `KeyEnrollmentGate.tsx` used when it originally
  * sealed each of these values, or `openWithKey()` fails (GCM authenticates the AAD, not just the
@@ -34,6 +37,8 @@ import { RECOVERY_KDF_LABEL, deriveFromRecoveryCode } from "./recoveryCode.js";
 export const MASTER_KEY_AAD_PURPOSE = "master-key";
 export const SIGNING_PRIVATE_KEY_AAD_PURPOSE = "sign-private-key";
 export const ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE = "encrypt-private-key";
+export const ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE = "zero-access-private-key";
+export const OPENPGP_PRIVATE_KEY_AAD_PURPOSE = "openpgp-private-key";
 
 export { KeysLockedError };
 
@@ -73,6 +78,21 @@ export interface UnlockedKeys {
      * that). A compromised key is kept because reading one's own mail encrypted to it is still needed. Absent when there
      * are none. */
     retainedEncryptionKeys?: RetainedEncryptionKey[];
+    /** The mailbox's zero-access private keys (restapi `specs/search.md` §3) - the keys the server encrypts mail at rest,
+     * index entries and sealed summaries to - the active one first, then retained ones newest first, at most
+     * `MAX_RETAINED_ENCRYPTION_KEYS + 1`. Decryption only. Absent when the mailbox has none (or none opened). */
+    zeroAccessKeys?: RetainedEncryptionKey[];
+    /** The mailbox's OpenPGP secret keys (restapi `specs/end-to-end_encryption.md` *OpenPGP Interoperability*) - the active one
+     * first, then retained ones newest first, at most `MAX_RETAINED_ENCRYPTION_KEYS + 1`: what opens mail OpenPGP users encrypt to
+     * the mailbox, and signs what it sends them. Absent when the mailbox has none (or none opened). */
+    openPgpKeys?: { fingerprint: string; privateKey: OpenPgpPrivateKey }[];
+    /** A shared mailbox opened through this user's member key wraps (`sharedMailboxKeys.ts`), not with its own master key: it holds
+     * only `zeroAccessKeys`, and `masterKey` is a per-key secret derived from its zero-access private key (what the local search
+     * index's key is derived from), never a key that opens the mailbox's vault. */
+    shared?: boolean;
+    /** A shared session only: the user's own mailboxes whose zero-access keys opened its member key wraps. Locking any of them locks it too -
+     * it was opened with their keys, so it doesn't outlive them. */
+    openedWith?: string[];
 }
 
 const sessions = new Map<string, UnlockedKeys>();
@@ -146,6 +166,63 @@ export function subscribeKeySession(listener: KeySessionListener): () => void {
     };
 }
 
+/**
+ * Makes a zero-access key this device has just enrolled (`zeroAccessKey.ts`'s `provisionZeroAccessKey()`) the active one
+ * of `unlocked` - the session object the key's private half was sealed under - so zero-access mail encrypted to it reads
+ * without another unlock. Does nothing when `unlocked` is no longer this mailbox's session (it was locked or replaced
+ * meanwhile; the next unlock opens the key from the vault anyway).
+ */
+export function addZeroAccessKey(mailboxUid: string, unlocked: UnlockedKeys, key: RetainedEncryptionKey): void {
+    if (unlocked.destroyed || sessions.get(mailboxUid) !== unlocked) {
+        return;
+    }
+    unlocked.zeroAccessKeys = [key, ...(unlocked.zeroAccessKeys ?? []).filter((k) => k.fingerprint !== key.fingerprint)];
+}
+
+/**
+ * Makes an OpenPGP key this device has just enrolled (`openPgpKey.ts`'s `ensureOpenPgpKey()`) the active one of `unlocked`, so
+ * OpenPGP mail to it reads without another unlock - the same rules as `addZeroAccessKey()`.
+ */
+export function addOpenPgpKey(mailboxUid: string, unlocked: UnlockedKeys, key: { fingerprint: string; privateKey: OpenPgpPrivateKey }): void {
+    if (unlocked.destroyed || sessions.get(mailboxUid) !== unlocked) {
+        return;
+    }
+    unlocked.openPgpKeys = [key, ...(unlocked.openPgpKeys ?? []).filter((k) => k.fingerprint !== key.fingerprint)];
+}
+
+/**
+ * Stores the keys of a shared mailbox opened through member key wraps (`sharedMailboxKeys.ts`'s `unlockSharedMailbox()`) as that mailbox's
+ * session, exactly as an unlock would - tracked for `destroyUnlockedKeys()`, and notified - unless the mailbox was locked since `generation`
+ * was taken (`sharedUnlockGeneration()`), when they are destroyed instead and `KeysLockedError` is thrown.
+ */
+export function installSharedSession(mailboxUid: string, unlocked: UnlockedKeys, generation: string): void {
+    if (lockGeneration(mailboxUid) !== generation) {
+        destroyObject(unlocked);
+        throw new KeysLockedError();
+    }
+    unlocked.shared = true;
+    sessions.set(mailboxUid, unlocked);
+    const objects = issued.get(mailboxUid) ?? new Set<WeakHandle<UnlockedKeys>>();
+    objects.add(weakHandle(unlocked));
+    issued.set(mailboxUid, objects);
+    notify({ mailboxUid, state: "unlocked" });
+}
+
+/** The lock generation to pass `installSharedSession()`, taken before a shared unlock starts its requests. */
+export function sharedUnlockGeneration(mailboxUid: string): string {
+    return lockGeneration(mailboxUid);
+}
+
+/** Every mailbox unlocked this session with its own keys (not a shared one opened through member key wraps). */
+export function personallyUnlockedKeys(): UnlockedKeys[] {
+    return personalSessions().map((session) => session.unlocked);
+}
+
+/** `personallyUnlockedKeys()` with each mailbox's uid. */
+export function personalSessions(): { mailboxUid: string; unlocked: UnlockedKeys }[] {
+    return [...sessions].filter(([, unlocked]) => !unlocked.shared).map(([mailboxUid, unlocked]) => ({ mailboxUid, unlocked }));
+}
+
 /** Reads back a mailbox's already-unlocked keys this session, or `undefined` if it hasn't been
  * unlocked yet (or was destroyed). Never triggers an unlock itself. */
 export function getUnlockedKeys(mailboxUid: string): UnlockedKeys | undefined {
@@ -189,6 +266,14 @@ export function destroyUnlockedKeys(mailboxUid?: string): void {
         sessions.delete(uid);
         notify({ mailboxUid: uid, state: "locked" });
     }
+    // The shared mailboxes opened with this mailbox's keys go with it.
+    if (mailboxUid) {
+        for (const [uid, unlocked] of [...sessions]) {
+            if (unlocked.shared && unlocked.openedWith?.includes(mailboxUid)) {
+                destroyUnlockedKeys(uid);
+            }
+        }
+    }
 }
 
 function destroyObject(unlocked: UnlockedKeys): void {
@@ -201,6 +286,19 @@ function destroyObject(unlocked: UnlockedKeys): void {
         unlocked.retainedEncryptionKeys.length = 0;
         delete unlocked.retainedEncryptionKeys;
     }
+    if (unlocked.zeroAccessKeys) {
+        unlocked.zeroAccessKeys.length = 0;
+        delete unlocked.zeroAccessKeys;
+    }
+    if (unlocked.openPgpKeys) {
+        // OpenPGP.js keeps a decrypted secret key's material in its own objects: wipe it there too.
+        for (const { privateKey } of unlocked.openPgpKeys) {
+            // Present at runtime on every `PrivateKey`, missing from OpenPGP.js's type declarations.
+            (privateKey as unknown as { clearPrivateParams(): void }).clearPrivateParams();
+        }
+        unlocked.openPgpKeys.length = 0;
+        delete unlocked.openPgpKeys;
+    }
 }
 
 /** Finds the wrapped private key whose fingerprint matches a given published public key. */
@@ -238,7 +336,9 @@ export class UnopenableEncryptionKeyError extends Error {
 }
 
 /** Opens one wrapped PKCS#8 private key under `masterKey` and imports it (non-extractable by default, like
- * `importPrivateKeyPkcs8()` itself), zeroing the transient plaintext whether or not the import succeeds. */
+ * `importPrivateKeyPkcs8()` itself), zeroing the transient plaintext whether or not the import succeeds. With `certDer` - the server's
+ * certificate for it, unauthenticated - it rejects a key that certificate isn't the one of (`certificateHoldsKey()`), so a swapped
+ * certificate never pairs with the opened key. */
 async function openPrivateKey(
     masterKey: Uint8Array,
     wrapped: WrappedPrivateKey,
@@ -246,9 +346,13 @@ async function openPrivateKey(
     algorithm: EcKeyImportParams,
     usages: KeyUsage[],
     extractable = false,
+    certDer?: Uint8Array,
 ): Promise<CryptoKey> {
     const raw = await openWithKey(masterKey, wrapped, aad);
     try {
+        if (certDer && !(await certificateHoldsKey(certDer, raw))) {
+            throw new Error("The certificate isn't the key's.");
+        }
         return await importPrivateKeyPkcs8(raw, algorithm, usages, extractable);
     } finally {
         raw.fill(0);
@@ -259,7 +363,7 @@ async function openPrivateKey(
  * Opens the retained encryption keys onto `unlocked.retainedEncryptionKeys`: every published `encrypt` key in
  * `mailboxKeys` other than the active one (`activeFingerprint`), whatever its revocation or expiry, that has a wrapped
  * private key in the vault - de-duplicated by fingerprint, newest `notBefore` first, at most
- * `MAX_RETAINED_ENCRYPTION_KEYS`. A key that won't open or import, or whose certificate won't decode, is skipped and
+ * `MAX_RETAINED_ENCRYPTION_KEYS`. A key that won't open or import, or whose certificate won't decode or isn't the key's, is skipped and
  * added to `unopenableKeys`. Retained keys are imported non-extractable. Each key is attached as it opens, so a failed
  * unlock's `destroyObject()` drops those too.
  */
@@ -274,7 +378,8 @@ async function openRetainedEncryptionKeys(
     const seen = new Set<string>(activeFingerprint !== undefined ? [activeFingerprint] : []);
     const candidates: { publicKey: PublicKey; wrapped: WrappedPrivateKey }[] = [];
     for (const publicKey of [...mailboxKeys].sort((a, b) => b.notBefore - a.notBefore)) {
-        const wrapped = publicKey.useType === "encrypt" && !seen.has(publicKey.fingerprint) ? findWrappedPrivateKey(vault, publicKey.fingerprint) : undefined;
+        const wrapped =
+            publicKey.useType === "encrypt" && !isOpenPgpKey(publicKey) && !seen.has(publicKey.fingerprint) ? findWrappedPrivateKey(vault, publicKey.fingerprint) : undefined;
         if (!wrapped) {
             continue;
         }
@@ -289,7 +394,7 @@ async function openRetainedEncryptionKeys(
     for (const { publicKey, wrapped } of candidates) {
         try {
             const certDer = fromBase64(publicKey.publicKey);
-            const privateKey = await openPrivateKey(unlocked.masterKey, wrapped, aad, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false);
+            const privateKey = await openPrivateKey(unlocked.masterKey, wrapped, aad, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false, certDer);
             (unlocked.retainedEncryptionKeys ??= []).push({ fingerprint: publicKey.fingerprint, certDer, privateKey });
         } catch {
             unopenableKeys.push(publicKey.fingerprint);
@@ -297,6 +402,78 @@ async function openRetainedEncryptionKeys(
     }
 }
 
+/**
+ * Opens the mailbox's zero-access private keys into `unlocked.zeroAccessKeys`: the vault's `zeroAccessKeys` that have a
+ * wrapped private key, the unrevoked one with the latest `notBefore` first, then the rest newest first, at most
+ * `MAX_RETAINED_ENCRYPTION_KEYS + 1`. A key that won't open is listed in `unopenableKeys` and skipped - zero-access mail
+ * encrypted to it doesn't decrypt on this device, but nothing else about the unlock depends on it. So is one whose certificate (the
+ * server's, unauthenticated) isn't the private key's: this device seals to the active key's certificate - search index segments of
+ * end-to-end mail, protected meetings' keys - so a certificate swapped by the server must never become it.
+ */
+async function openZeroAccessKeys(mailboxUid: string, vault: KeyVault, unlocked: UnlockedKeys, unopenableKeys: string[]): Promise<void> {
+    const ordered = [...(vault.zeroAccessKeys ?? [])].sort(
+        (a, b) => Number(!!a.revokedAt) - Number(!!b.revokedAt) || b.notBefore - a.notBefore,
+    );
+    const aad = buildAad(mailboxUid, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE);
+    let opened = 0;
+    for (const publicKey of ordered) {
+        const wrapped = findWrappedPrivateKey(vault, publicKey.fingerprint);
+        if (!wrapped || wrapped.useType !== "zero-access") {
+            continue;
+        }
+        try {
+            const certDer = fromBase64(publicKey.publicKey);
+            const raw = await openWithKey(unlocked.masterKey, wrapped, aad);
+            try {
+                if (!(await certificateHoldsKey(certDer, raw))) {
+                    throw new Error("The zero-access certificate isn't the key's.");
+                }
+                const privateKey = await importPrivateKeyPkcs8(raw, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false);
+                (unlocked.zeroAccessKeys ??= []).push({ fingerprint: publicKey.fingerprint, certDer, privateKey });
+            } finally {
+                raw.fill(0);
+            }
+        } catch {
+            unopenableKeys.push(publicKey.fingerprint);
+        }
+        if (++opened === MAX_RETAINED_ENCRYPTION_KEYS + 1) {
+            break;
+        }
+    }
+}
+
+/**
+ * Opens the mailbox's OpenPGP secret keys into `unlocked.openPgpKeys`: its published OpenPGP certificates (`type: "openpgp"`) that
+ * have a wrapped secret key, the active one first (unrevoked, unexpired, latest `notBefore`), then the rest newest first, at most
+ * `MAX_RETAINED_ENCRYPTION_KEYS + 1`. OpenPGP.js is loaded only for a mailbox that has one. A key that won't open is listed in
+ * `unopenableKeys` and skipped.
+ */
+async function openOpenPgpKeys(mailboxUid: string, mailboxKeys: PublicKey[], vault: KeyVault, unlocked: UnlockedKeys, unopenableKeys: string[]): Promise<void> {
+    const now = Date.now();
+    const active = (key: PublicKey): boolean => !key.revokedAt && key.notAfter > now;
+    const ordered = mailboxKeys
+        .filter((key) => isOpenPgpKey(key) && findWrappedPrivateKey(vault, key.fingerprint))
+        .sort((a, b) => Number(active(b)) - Number(active(a)) || b.notBefore - a.notBefore)
+        .slice(0, MAX_RETAINED_ENCRYPTION_KEYS + 1);
+    if (ordered.length === 0) {
+        return;
+    }
+    const { readSecretKey } = await import("./openpgp.js");
+    const aad = buildAad(mailboxUid, OPENPGP_PRIVATE_KEY_AAD_PURPOSE);
+    for (const publicKey of ordered) {
+        try {
+            const raw = await openWithKey(unlocked.masterKey, findWrappedPrivateKey(vault, publicKey.fingerprint)!, aad);
+            try {
+                (unlocked.openPgpKeys ??= []).push({ fingerprint: publicKey.fingerprint, privateKey: await readSecretKey(raw) });
+            } finally {
+                raw.fill(0);
+            }
+        } catch {
+            unopenableKeys.push(publicKey.fingerprint);
+        }
+    }
+}
+
 /**
  * Unlocks a mailbox's key vault with its password unlock method: fetches the vault, derives the
  * wrapping key from `password` using the *exact* KDF parameters that wrap was created with, unwraps
@@ -309,13 +486,27 @@ async function openRetainedEncryptionKeys(
  * "incorrect password," not a generic error, but this module doesn't presume a specific UI's error copy.
  * Once the master key has opened, the password is known to be right: an active signing key that then
  * won't open is skipped and listed in `UnlockResult.unopenableKeys` (so is a retained encryption key); an active
- * encryption key that won't
- * open still fails the unlock, with `UnopenableEncryptionKeyError`. Throws `KeysLockedError` when
+ * encryption key that won't open, or whose certificate isn't its own,
+ * still fails the unlock, with `UnopenableEncryptionKeyError`. Throws `KeysLockedError` when
  * `destroyUnlockedKeys()` locked this mailbox (or all mailboxes) while the unlock was in flight.
  */
 export async function unlockWithPassword(mailboxUid: string, mailboxKeys: PublicKey[], password: string): Promise<UnlockResult> {
     const generation = lockGeneration(mailboxUid);
-    const vault = await getKeyVault(mailboxUid);
+    const { vault, masterKey } = await openMasterKeyWithPassword(mailboxUid, password);
+    return openSession(mailboxUid, mailboxKeys, vault, masterKey, generation);
+}
+
+/**
+ * Fetches `mailboxUid`'s vault and opens its master key with the password wrap, touching no session - for an operation that
+ * must re-prove the password even while the mailbox is unlocked (`keyExport.ts`). Rejects exactly as `unlockWithPassword()`
+ * does on a missing wrap, an unknown KDF or a wrong password. The caller owns the returned master key and must zero it.
+ */
+export async function openMasterKeyWithPassword(
+    mailboxUid: string,
+    password: string,
+    client?: ApiClient,
+): Promise<{ vault: KeyVault; masterKey: Uint8Array }> {
+    const vault = await getKeyVault(mailboxUid, client);
     const passwordWrap = vault.masterKeyWraps.find((w) => w.method === "password");
     if (!passwordWrap) {
         throw new Error("This mailbox has no password unlock method enrolled.");
@@ -332,8 +523,7 @@ export async function unlockWithPassword(mailboxUid: string, mailboxKeys: Public
         { ciphertext: passwordWrap.ciphertext, nonce: passwordWrap.nonce },
         buildAad(mailboxUid, MASTER_KEY_AAD_PURPOSE),
     );
-
-    return openSession(mailboxUid, mailboxKeys, vault, masterKey, generation);
+    return { vault, masterKey };
 }
 
 /** What `unlockWithRecoveryCode()` resolves with. */
@@ -442,17 +632,31 @@ async function openSession(
         const encryptionPublicKey = findActivePublicKey(mailboxKeys, "encrypt");
         const wrappedEncryptionKey = encryptionPublicKey && findWrappedPrivateKey(vault, encryptionPublicKey.fingerprint);
         if (encryptionPublicKey && wrappedEncryptionKey) {
+            let encryptionCertDer: Uint8Array;
             try {
+                // The certificate is the server's: one that isn't this key's - what this device encrypts its own copies to, and what it
+                // hands out as its S/MIME certificate - makes the key unopenable, exactly as a wrap that won't open.
+                encryptionCertDer = fromBase64(encryptionPublicKey.publicKey);
                 const aad = buildAad(mailboxUid, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE);
-                unlocked.encryptionPrivateKey = await openPrivateKey(masterKey, wrappedEncryptionKey, aad, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"]);
+                unlocked.encryptionPrivateKey = await openPrivateKey(
+                    masterKey,
+                    wrappedEncryptionKey,
+                    aad,
+                    { name: "ECDH", namedCurve: "P-256" },
+                    ["deriveBits"],
+                    false,
+                    encryptionCertDer,
+                );
             } catch (err) {
                 throw new UnopenableEncryptionKeyError(encryptionPublicKey.fingerprint, err);
             }
-            unlocked.encryptionCertDer = fromBase64(encryptionPublicKey.publicKey);
+            unlocked.encryptionCertDer = encryptionCertDer;
             unlocked.encryptionFingerprint = encryptionPublicKey.fingerprint;
         }
 
         await openRetainedEncryptionKeys(mailboxUid, mailboxKeys, vault, unlocked, encryptionPublicKey?.fingerprint, unopenableKeys);
+        await openZeroAccessKeys(mailboxUid, vault, unlocked, unopenableKeys);
+        await openOpenPgpKeys(mailboxUid, mailboxKeys, vault, unlocked, unopenableKeys);
         if (lockGeneration(mailboxUid) !== generation) {
             // Locked (e.g. logout) while this unlock was awaiting - never restore keys after that.
             throw new KeysLockedError();