ciphermesh 2.10.0 → 2.11.0

package/src/client/ChatController.js

@@ -29,7 +29,14 @@ import {
   isRoomWrapped,
   freeRoomSecrets,
 } from '../crypto/RoomKey.js';
-import { KEY_ROTATION_INTERVAL_MS, EMOJI_MAP, COVER_CONSTANT_MS } from '../shared/constants.js';
+import {
+  KEY_ROTATION_INTERVAL_MS,
+  EMOJI_MAP,
+  COVER_CONSTANT_MS,
+  OWN_CAPABILITIES,
+} from '../shared/constants.js';
+import { normalizeCaps, roomSupports } from '../protocol/capabilities.js';
+import { GroupSession } from '../crypto/SenderKey.js';
 import { KeyManager } from '../crypto/KeyManager.js';
 import { Handshake } from '../crypto/Handshake.js';
 import { NonceManager } from '../crypto/NonceManager.js';
@@ -76,7 +83,10 @@ export class ChatController {
   #handshake;
   #nonceManager;
   #sessionId;
-  #peers; // Map<sessionId, { nickname, publicKey }>
+  #peers; // Map<sessionId, { nickname, publicKey, caps }>
+  #groups = new Map(); // room -> GroupSession (sender keys; receive only for now)
+  #groupBuffer = new Map(); // keyId -> group msgs waiting on their sender key
+  #serverCaps = []; // what the relay advertised in join_ack
   #lastTypingSent;
   #peerTypingTimers; // Map<sessionId, timeoutId>
   #fileTransfer;
@@ -220,7 +230,12 @@ export class ChatController {
     this.#reconnectAttempts = 0;
     this.#ui.setConnectionState('online');
     this.#connection.send(
-      createJoin(this.#nickname, this.#keyManager.publicKeyB64, this.#keyManager.pqPublicKeyB64),
+      createJoin(
+        this.#nickname,
+        this.#keyManager.publicKeyB64,
+        this.#keyManager.pqPublicKeyB64,
+        OWN_CAPABILITIES,
+      ),
     );
   }
 
@@ -454,6 +469,10 @@ export class ChatController {
         this.#onEncryptedMessage(msg);
         break;
 
+      case MSG.GROUP_MESSAGE:
+        this.#onGroupMessage(msg);
+        break;
+
       case MSG.PEER_KEY_UPDATED:
         this.#onPeerKeyUpdated(msg);
         break;
@@ -542,6 +561,10 @@ export class ChatController {
   // ── JOIN_ACK: registered with server ──────────────────────────
   #onJoinAck(msg) {
     this.#sessionId = msg.sessionId;
+    // What the relay itself can do. No client can advertise this on its behalf,
+    // and the fan-out for a room-addressed message is the relay's job — so a
+    // capable room on an older hub is still not a room that can switch paths.
+    this.#serverCaps = normalizeCaps(msg.serverCaps);
     const room = msg.room || 'general';
     const hadPrivateBuffers = [...this.#buffers.values()].some((b) => b.secrets);
 
@@ -562,6 +585,7 @@ export class ChatController {
       this.#allPeers.set(peer.sessionId, {
         nickname: peer.nickname,
         publicKey: peer.publicKey,
+        caps: normalizeCaps(peer.caps),
         rooms: new Set([room]),
       });
 
@@ -699,13 +723,33 @@ export class ChatController {
     this.#peers.clear();
     for (const [sid, p] of this.#allPeers) {
       if (p.rooms.has(this.#currentRoom)) {
-        this.#peers.set(sid, { nickname: p.nickname, publicKey: p.publicKey });
+        this.#peers.set(sid, {
+          nickname: p.nickname,
+          publicKey: p.publicKey,
+          caps: p.caps || [],
+        });
       }
     }
     this.#ui.setOnlineCount(this.#peers.size + 1);
     this.#ui.setPeerNames([...this.#peers.values()].map((p) => p.nickname));
   }
 
+  // Can every member of the active room speak `cap`? Nothing calls this on a
+  // send path yet — group send/receive is the next step, and this is the switch
+  // it will be gated on. Kept here so the negotiation is testable before the
+  // feature that depends on it exists; `own` is overridable for exactly that,
+  // since this build advertises nothing yet.
+  roomSupportsCapability(cap, own = OWN_CAPABILITIES) {
+    return roomSupports(this.#peers.values(), cap, own);
+  }
+
+  // Did the relay say it can do this? Separate from the room check on purpose:
+  // both have to hold before a send path may switch, and they fail for
+  // different reasons — an old peer versus an old hub.
+  relaySupportsCapability(cap) {
+    return this.#serverCaps.includes(cap);
+  }
+
   #applyTopicToUI() {
     const topic = this.#buffers.get(this.#currentRoom)?.topic;
     this.#ui.setTopic(topic?.text || null);
@@ -788,6 +832,7 @@ export class ChatController {
       this.#allPeers.set(peer.sessionId, {
         nickname: peer.nickname,
         publicKey: peer.publicKey,
+        caps: normalizeCaps(peer.caps),
         rooms: new Set([room]),
       });
       this.#handshake.registerPeer(peer.sessionId, peer.publicKey, peer.pqPublicKey);
@@ -851,11 +896,21 @@ export class ChatController {
     }
     const goneEntirely = !entry || !room || entry.rooms.size === 0;
 
+    // Drop their sender chain for the room they left. Their own rotation is what
+    // gives forward secrecy — this only stops us holding a key we can no longer
+    // be sent anything on.
+    if (room) {
+      this.#groups.get(room)?.removeMember(msg.sessionId);
+    }
+
     if (goneEntirely) {
       this.#hidePeerTyping(msg.sessionId, nickname);
       this.#handshake.removePeer(msg.sessionId);
       this.#nonceManager.removePeer(msg.sessionId);
       this.#allPeers.delete(msg.sessionId);
+      for (const group of this.#groups.values()) {
+        group.removeMember(msg.sessionId);
+      }
     }
 
     if (!room || room === this.#currentRoom) {
@@ -869,8 +924,101 @@ export class ChatController {
     this.#auditLog.log(AuditEvent.PEER_DISCONNECTED, { nickname });
   }
 
+  // ── Sender keys on the relay: the receive half ────────────────
+  //
+  // Sending is deliberately absent — #broadcastPayload still seals one envelope
+  // per peer. This is the half that has to be in the field first: a room only
+  // switches to group sending once every member advertises it, so the ability to
+  // read one must ship a release before the ability to write one, or the switch
+  // never becomes true for anybody.
+
+  #getGroup(room) {
+    let group = this.#groups.get(room);
+    if (!group) {
+      group = new GroupSession();
+      this.#groups.set(room, group);
+    }
+    return group;
+  }
+
+  // A member handed us their sender key. This arrives over the pairwise sealed
+  // channel, so `fromSessionId` was authenticated by opening the envelope —
+  // never asserted by the relay, which is the whole reason distribution does not
+  // ride on the group path itself.
+  #onSenderKeyDistribution(fromSessionId, data) {
+    if (typeof data.room !== 'string' || !data.dist || typeof data.dist !== 'object') {
+      return;
+    }
+    this.#getGroup(data.room).addMember(fromSessionId, data.dist);
+    this.#flushGroupBuffer(data.dist.keyId);
+  }
+
+  #onGroupMessage(msg) {
+    const group = this.#groups.get(msg.room);
+    const from = group ? group.memberForKeyId(msg.keyId) : null;
+
+    // A label we hold no distribution for. Usually a race — the fan-out beat the
+    // sender key through a different path — so hold it rather than drop it.
+    if (!from || !this.#allPeers.has(from)) {
+      this.#bufferGroupMessage(msg);
+      return;
+    }
+
+    const plaintext = group.decrypt(from, {
+      keyId: msg.keyId,
+      counter: msg.counter,
+      ciphertext: msg.ciphertext,
+      nonce: msg.nonce,
+      signature: msg.signature,
+    });
+    if (!plaintext) {
+      // A replayed counter, a chain that rotated without us being told yet, or a
+      // signature that does not check out. The first two resolve on the next
+      // distribution; the third never will, and buffering it costs one slot in a
+      // bounded map rather than a decision made on too little information here.
+      this.#bufferGroupMessage(msg);
+      return;
+    }
+
+    // Hand it to the one path that knows what a payload means. `payload` is
+    // empty because there was no pairwise envelope: the group chain replaced it.
+    this.#onEncryptedMessage({ from, payload: {} }, plaintext);
+  }
+
+  #bufferGroupMessage(msg) {
+    // Bounded twice over: a hostile relay can invent keyIds all day, and each
+    // one must not become a place to park memory.
+    if (!this.#groupBuffer.has(msg.keyId) && this.#groupBuffer.size >= 32) {
+      return;
+    }
+    let buf = this.#groupBuffer.get(msg.keyId);
+    if (!buf) {
+      buf = [];
+      this.#groupBuffer.set(msg.keyId, buf);
+    }
+    if (buf.length < 20) {
+      buf.push(msg);
+    }
+  }
+
+  #flushGroupBuffer(keyId) {
+    const buf = this.#groupBuffer.get(keyId);
+    if (!buf) {
+      return;
+    }
+    this.#groupBuffer.delete(keyId);
+    for (const msg of buf) {
+      this.#onGroupMessage(msg);
+    }
+  }
+
   // ── Received encrypted message ────────────────────────────────
-  #onEncryptedMessage(msg) {
+  // `preDecrypted` is the group path handing over plaintext it already opened
+  // with a sender chain (see #onGroupMessage). Everything after the decryption
+  // step is shared on purpose: a group message must land in history, buffers,
+  // receipts and the action dispatch exactly like a pairwise one, and the way to
+  // guarantee that is for there to be only one copy of it.
+  #onEncryptedMessage(msg, preDecrypted = null) {
     // Sealed sender: the relay handed us only `to` + an opaque blob. Open it
     // with our identity key to recover the real sender + payload; from here the
     // rest of the handler is unchanged. A blob that isn't for us (or is tampered)
@@ -904,51 +1052,74 @@ export class ChatController {
       return;
     }
 
-    const ciphertext = Buffer.from(msg.payload.ciphertext, 'base64');
-    const nonce = Buffer.from(msg.payload.nonce, 'base64');
+    let plaintext = preDecrypted;
+    // A group message is never deniable — deniable sends stay pairwise, as they
+    // do in P2P — and carries no pairwise envelope to inspect.
+    const isDeniable = !preDecrypted && !!msg.payload.deniable;
 
-    let plaintext = null;
-    const isDeniable = !!msg.payload.deniable;
+    if (!plaintext) {
+      const ciphertext = Buffer.from(msg.payload.ciphertext, 'base64');
+      const nonce = Buffer.from(msg.payload.nonce, 'base64');
 
-    // Deniable message path (symmetric crypto_secretbox)
-    if (isDeniable) {
-      // Anti-replay: deniable sends already use a structured NonceManager nonce.
-      if (!this.#nonceManager.validate(msg.from, nonce)) {
-        this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname, deniable: true });
-        this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
-        return;
-      }
-      const sharedKey = deriveSharedKey(this.#handshake.secretKey, senderPublicKey);
-      plaintext = decryptDeniable(ciphertext, nonce, sharedKey);
-      if (!plaintext) {
-        this.#auditLog.log(AuditEvent.DECRYPT_FAILURE, { nickname: peer.nickname, deniable: true });
-        this.#ui.addErrorMessage(`Failed to decrypt deniable message from ${peer.nickname}`);
-        return;
+      // Deniable message path (symmetric crypto_secretbox)
+      if (isDeniable) {
+        // Anti-replay: deniable sends already use a structured NonceManager nonce.
+        if (!this.#nonceManager.validate(msg.from, nonce)) {
+          this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname, deniable: true });
+          this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
+          return;
+        }
+        const sharedKey = deriveSharedKey(this.#handshake.secretKey, senderPublicKey);
+        plaintext = decryptDeniable(ciphertext, nonce, sharedKey);
+        if (!plaintext) {
+          this.#auditLog.log(AuditEvent.DECRYPT_FAILURE, {
+            nickname: peer.nickname,
+            deniable: true,
+          });
+          this.#ui.addErrorMessage(`Failed to decrypt deniable message from ${peer.nickname}`);
+          return;
+        }
       }
-    }
 
-    // Ratcheted message path (has ephemeralPublicKey)
-    if (!isDeniable && msg.payload.ephemeralPublicKey) {
-      const ratchet = this.#handshake.getRatchet(msg.from);
-      if (ratchet) {
-        const ephPub = Buffer.from(msg.payload.ephemeralPublicKey, 'base64');
-        plaintext = ratchet.decrypt(
-          ciphertext,
-          nonce,
-          ephPub,
-          msg.payload.counter,
-          msg.payload.previousCounter,
-          msg.payload.pqCiphertext ? Buffer.from(msg.payload.pqCiphertext, 'base64') : null,
-        );
-      }
+      // Ratcheted message path (has ephemeralPublicKey)
+      if (!isDeniable && msg.payload.ephemeralPublicKey) {
+        const ratchet = this.#handshake.getRatchet(msg.from);
+        if (ratchet) {
+          const ephPub = Buffer.from(msg.payload.ephemeralPublicKey, 'base64');
+          plaintext = ratchet.decrypt(
+            ciphertext,
+            nonce,
+            ephPub,
+            msg.payload.counter,
+            msg.payload.previousCounter,
+            msg.payload.pqCiphertext ? Buffer.from(msg.payload.pqCiphertext, 'base64') : null,
+          );
+        }
 
-      // Fallback to static decrypt if ratchet failed
-      if (!plaintext) {
+        // Fallback to static decrypt if ratchet failed
+        if (!plaintext) {
+          if (!this.#nonceManager.validate(msg.from, nonce)) {
+            this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname });
+            this.#ui.addErrorMessage(`Failed to decrypt message from ${peer.nickname}`);
+            return;
+          }
+          plaintext = MessageCrypto.decryptWithFallback(
+            ciphertext,
+            nonce,
+            senderPublicKey,
+            this.#handshake.secretKey,
+            this.#handshake.getPreviousPeerPublicKey(msg.from),
+            this.#handshake.previousSecretKey,
+          );
+        }
+      } else if (!isDeniable) {
+        // Static message path (no ephemeralPublicKey)
         if (!this.#nonceManager.validate(msg.from, nonce)) {
           this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname });
-          this.#ui.addErrorMessage(`Failed to decrypt message from ${peer.nickname}`);
+          this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
           return;
         }
+
         plaintext = MessageCrypto.decryptWithFallback(
           ciphertext,
           nonce,
@@ -958,22 +1129,6 @@ export class ChatController {
           this.#handshake.previousSecretKey,
         );
       }
-    } else if (!isDeniable) {
-      // Static message path (no ephemeralPublicKey)
-      if (!this.#nonceManager.validate(msg.from, nonce)) {
-        this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname });
-        this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
-        return;
-      }
-
-      plaintext = MessageCrypto.decryptWithFallback(
-        ciphertext,
-        nonce,
-        senderPublicKey,
-        this.#handshake.secretKey,
-        this.#handshake.getPreviousPeerPublicKey(msg.from),
-        this.#handshake.previousSecretKey,
-      );
     }
 
     if (!plaintext) {
@@ -1012,6 +1167,14 @@ export class ChatController {
         return;
       }
 
+      // A sender key. Never surfaced to the user and never carried on the group
+      // path itself — it has to arrive pairwise, where the envelope proves who
+      // sent it.
+      if (data.action === 'sk_dist') {
+        this.#onSenderKeyDistribution(msg.from, data);
+        return;
+      }
+
       // Which buffer this belongs to (the tag rides inside the E2EE envelope).
       const msgRoom = this.#roomForIncoming(data, msg.from);
       const roomActive = msgRoom === this.#currentRoom;
@@ -2776,7 +2939,12 @@ export class ChatController {
         this.#nickname = newNick;
         this.#ui.setNickname(newNick);
         this.#connection.send(
-          createJoin(newNick, this.#keyManager.publicKeyB64, this.#keyManager.pqPublicKeyB64),
+          createJoin(
+            newNick,
+            this.#keyManager.publicKeyB64,
+            this.#keyManager.pqPublicKeyB64,
+            OWN_CAPABILITIES,
+          ),
         );
         this.#ui.addSystemMessage(`Trying to join as ${newNick}...`);
         break;
@@ -3642,6 +3810,11 @@ export class ChatController {
       this.#historyStore.destroy();
     }
     this.#fileTransfer.destroy();
+    for (const group of this.#groups.values()) {
+      group.destroy();
+    }
+    this.#groups.clear();
+    this.#groupBuffer.clear();
     this.#handshake.destroy();
     this.#keyManager.destroy();
     this.#connection.close();

package/src/crypto/SenderKey.js

@@ -14,6 +14,62 @@ const KEY_SIZE = 32;
 const MSG_KEY_TAG = Buffer.from([0x01]);
 const CHAIN_KEY_TAG = Buffer.from([0x02]);
 const DEFAULT_MAX_SKIP = 1000; // bound out-of-order / skipped message keys
+const KEY_ID_SIZE = 16;
+
+// An opaque label for a sender chain, handed out with the distribution.
+//
+// On the relay path a group message arrives by fan-out with no sender on it —
+// the relay must not stamp one, or it would be asserting an identity that today
+// is only ever carried sealed inside the envelope. So the packet names its
+// *chain* instead of its sender, and only members who hold the distribution can
+// map the two. To the relay it is a random string; it already knows which socket
+// sent the frame, so this tells it nothing new. It is drawn fresh on every
+// rotate(), so it never outlives the chain it labels.
+function newKeyId() {
+  const buf = Buffer.alloc(KEY_ID_SIZE);
+  sodium.randombytes_buf(buf);
+  return buf.toString('base64');
+}
+
+// ── Per-sender signatures ───────────────────────────────────────
+// A sender key is symmetric: every member of the room holds the chain that
+// decrypts a given sender, which means every member can also *produce*
+// ciphertext on it. Without something asymmetric on top, "Alice said this" is
+// only ever "somebody in this room said this" — and on a public relay, where
+// `general` has no owner and no admission control, that is a much wider set of
+// somebodies than in a P2P mesh.
+//
+// So each sender also holds an Ed25519 keypair for the life of its chain. The
+// public half travels in the distribution, over the pairwise sealed channel that
+// already authenticates who sent it; every packet carries a detached signature.
+// Forging a member now needs their signing key, not just membership.
+function newSigningKeypair() {
+  const publicKey = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES);
+  const secretKey = sodium.sodium_malloc(sodium.crypto_sign_SECRETKEYBYTES);
+  sodium.crypto_sign_keypair(publicKey, secretKey);
+  return { publicKey, secretKey };
+}
+
+// What the signature covers. Every field the relay could tamper with or replay
+// across chains: the label, the position in the chain, and the box itself.
+// Length-prefixed so no two different packets can serialise to the same bytes.
+function signedBytes({ keyId, counter, ciphertext, nonce }) {
+  const parts = [keyId, String(counter), ciphertext, nonce];
+  return Buffer.from(parts.map((p) => `${p.length}:${p}`).join('|'), 'utf-8');
+}
+
+function decodeSignPk(b64) {
+  if (typeof b64 !== 'string') {
+    return null;
+  }
+  let buf;
+  try {
+    buf = Buffer.from(b64, 'base64');
+  } catch {
+    return null;
+  }
+  return buf.length === sodium.crypto_sign_PUBLICKEYBYTES ? buf : null;
+}
 
 // A single sender's ratchet chain. Used to *send* (deriveNext) when it's your
 // own chain, or to *receive* (messageKeyFor) when it's a peer's distributed one.
@@ -129,28 +185,51 @@ export function groupDecrypt(messageKey, ciphertext, nonce) {
 // member. encrypt() runs once; every member decrypt()s the same ciphertext.
 export class GroupSession {
   #own;
+  #ownKeyId;
+  #signPk; // Ed25519 — proves *which member* wrote a packet
+  #signSk;
   #members; // Map<memberId, SenderChain>
+  #byKeyId; // Map<keyId, memberId> — which chain opens an incoming packet
+  #memberSignPk; // Map<memberId, Buffer> — who is allowed to have written it
 
   constructor() {
     this.#own = new SenderChain();
+    this.#ownKeyId = newKeyId();
+    ({ publicKey: this.#signPk, secretKey: this.#signSk } = newSigningKeypair());
     this.#members = new Map();
+    this.#byKeyId = new Map();
+    this.#memberSignPk = new Map();
   }
 
   encrypt(plaintext) {
     const { messageKey, counter } = this.#own.deriveNext();
     const { ciphertext, nonce } = groupEncrypt(messageKey, plaintext);
-    return {
+    const packet = {
+      keyId: this.#ownKeyId,
       counter,
       ciphertext: ciphertext.toString('base64'),
       nonce: nonce.toString('base64'),
     };
+    const signature = Buffer.alloc(sodium.crypto_sign_BYTES);
+    sodium.crypto_sign_detached(signature, signedBytes(packet), this.#signSk);
+    packet.signature = signature.toString('base64');
+    return packet;
   }
 
-  decrypt(memberId, { counter, ciphertext, nonce }) {
+  decrypt(memberId, { keyId, counter, ciphertext, nonce, signature }) {
     const chain = this.#members.get(memberId);
     if (!chain) {
       return null;
     }
+
+    // Verify BEFORE touching the chain. Two reasons, and the second is the one
+    // that is easy to miss: a bad signature must not be able to advance the
+    // ratchet or fill the skipped-key cache, or an unauthenticated packet with a
+    // large counter becomes a way to make the receiver derive a thousand keys.
+    if (!this.#verify(memberId, { keyId, counter, ciphertext, nonce, signature })) {
+      return null;
+    }
+
     const messageKey = chain.messageKeyFor(counter);
     if (!messageKey) {
       return null;
@@ -162,9 +241,51 @@ export class GroupSession {
     );
   }
 
+  #verify(memberId, packet) {
+    const signPk = this.#memberSignPk.get(memberId);
+    if (!signPk || typeof packet.signature !== 'string' || typeof packet.keyId !== 'string') {
+      return false;
+    }
+    // The label on the packet has to be the one this member distributed.
+    // Verifying against the stored label instead would leave keyId outside
+    // everything that protects it — the AEAD does not cover it either — so
+    // decrypt() could be talked into checking one member's signature against
+    // another member's label.
+    if (this.#byKeyId.get(packet.keyId) !== memberId) {
+      return false;
+    }
+    let sig;
+    try {
+      sig = Buffer.from(packet.signature, 'base64');
+    } catch {
+      return false;
+    }
+    if (sig.length !== sodium.crypto_sign_BYTES) {
+      return false;
+    }
+    return sodium.crypto_sign_verify_detached(sig, signedBytes(packet), signPk);
+  }
+
   // The distribution message to hand a (new) member so they can decrypt you.
+  // `keyId` labels the chain; `signPk` is what stops any *other* member using
+  // that chain to write in your name.
   distribution() {
-    return this.#own.serialize();
+    return {
+      ...this.#own.serialize(),
+      keyId: this.#ownKeyId,
+      signPk: this.#signPk.toString('base64'),
+    };
+  }
+
+  // Which member does an incoming packet's keyId belong to? Null for a label we
+  // were never given a distribution for — an unknown sender, or one that
+  // rotated without telling us yet.
+  memberForKeyId(keyId) {
+    return this.#byKeyId.get(keyId) ?? null;
+  }
+
+  get keyId() {
+    return this.#ownKeyId;
   }
 
   addMember(memberId, distribution) {
@@ -172,7 +293,23 @@ export class GroupSession {
     if (existing) {
       existing.destroy();
     }
+    // Drop any label this member held before — a redistribution after rotate()
+    // replaces the chain, and leaving the old keyId mapped would route the
+    // member's next packet to a chain that can no longer open it.
+    this.#forgetKeyIdsOf(memberId);
     this.#members.set(memberId, SenderChain.deserialize(distribution));
+    if (typeof distribution?.keyId === 'string') {
+      this.#byKeyId.set(distribution.keyId, memberId);
+    }
+    // A distribution without a usable signing key leaves the member registered
+    // but unreadable: #verify fails closed, so nothing they send is accepted.
+    // Better a member who cannot be heard than one who cannot be attributed.
+    const signPk = decodeSignPk(distribution?.signPk);
+    if (signPk) {
+      this.#memberSignPk.set(memberId, signPk);
+    } else {
+      this.#memberSignPk.delete(memberId);
+    }
   }
 
   removeMember(memberId) {
@@ -181,6 +318,16 @@ export class GroupSession {
       chain.destroy();
       this.#members.delete(memberId);
     }
+    this.#forgetKeyIdsOf(memberId);
+    this.#memberSignPk.delete(memberId);
+  }
+
+  #forgetKeyIdsOf(memberId) {
+    for (const [id, owner] of this.#byKeyId) {
+      if (owner === memberId) {
+        this.#byKeyId.delete(id);
+      }
+    }
   }
 
   hasMember(memberId) {
@@ -192,13 +339,22 @@ export class GroupSession {
   rotate() {
     this.#own.destroy();
     this.#own = new SenderChain();
+    this.#ownKeyId = newKeyId();
+    // The signing key rotates with the chain it authenticates. Keeping it would
+    // let anyone holding the old public key keep attributing new packets to a
+    // chain that was rotated precisely because the room membership changed.
+    sodium.sodium_memzero(this.#signSk);
+    ({ publicKey: this.#signPk, secretKey: this.#signSk } = newSigningKeypair());
   }
 
   destroy() {
     this.#own.destroy();
+    sodium.sodium_memzero(this.#signSk);
     for (const chain of this.#members.values()) {
       chain.destroy();
     }
     this.#members.clear();
+    this.#byKeyId.clear();
+    this.#memberSignPk.clear();
   }
 }

package/src/p2p/P2PChatController.js

@@ -2392,9 +2392,11 @@ export class P2PChatController {
       return;
     }
     const plaintext = this.#getGroup(msg.room).decrypt(fromNickname, {
+      keyId: msg.keyId,
       counter: msg.counter,
       ciphertext: msg.ciphertext,
       nonce: msg.nonce,
+      signature: msg.signature,
     });
     if (!plaintext) {
       // No sender key yet (rare race) — buffer until sk_dist arrives.