ciphermesh 2.11.0 → 2.13.0

package/src/crypto/DeviceIdentity.js

@@ -0,0 +1,307 @@
+import sodium from 'sodium-native';
+
+// ── Device identity ─────────────────────────────────────────────
+//
+// Step 1 of multi-device (docs/design/multi-device.md, item 4 of #481). This
+// module has no callers on purpose. The sender-key rollout worked because the
+// asymmetric half landed before the wire that carries it existed — "it cost a
+// field on a wire nobody was using yet" — and the same trick applies here.
+//
+// The model, in one paragraph. Today the X25519 box key *is* the identity: it
+// is what a fingerprint is computed from, what a SAS compares, and what a ban
+// keys on. That works for one machine and breaks for two, because two machines
+// can only share it by sharing the secret — which is what `/backup` plus the
+// restore prompt actually does today, and it cannot be revoked. So identity
+// moves up a level: a long-term **Ed25519 key that only ever signs**, and one
+// **X25519 box key per device**, listed and signed by it. A device is added by
+// signing a longer list; revoked by signing a shorter one with a higher
+// counter.
+//
+// Nothing here encrypts. That separation is the point: a signing key that never
+// touches a message is a key that can be kept somewhere a message key cannot.
+
+const DEVICE_ID_SIZE = 16;
+const MAX_DEVICES = 8;
+const MAX_LABEL_LENGTH = 32;
+
+// Domain separation. Two different structures must never produce the same
+// bytes to sign, or a signature over one is a signature over the other.
+const LIST_DOMAIN = 'CipherMesh-DeviceList-v1';
+const FINGERPRINT_DOMAIN = 'CipherMesh-IdentityFingerprint-v1';
+
+// Release a key allocated with sodium_malloc.
+//
+// Same reasoning as SenderKey.js: sodium_malloc'd pages are mlock'd, the OS
+// caps how much a process may lock, and zeroing alone leaves them locked until
+// a finaliser happens to run. sodium_free zeroes before releasing.
+function freeKey(buf) {
+  if (buf) {
+    sodium.sodium_free(buf);
+  }
+}
+
+/**
+ * A stable name for one device, drawn once and kept.
+ *
+ * Deliberately *not* derived from the device's box key. A box key rotates
+ * (`KeyManager.rotate`) and the device is still the same device; an id derived
+ * from the key would rename it on every rotation, which is precisely when a
+ * peer most needs to recognise it. Forging an id buys nothing on its own —
+ * only a list signed by the identity key binds an id to a key.
+ */
+export function newDeviceId() {
+  const buf = Buffer.alloc(DEVICE_ID_SIZE);
+  sodium.randombytes_buf(buf);
+  return buf.toString('hex');
+}
+
+/**
+ * The long-term signing key. Signs device lists; never encrypts anything.
+ */
+export class DeviceIdentity {
+  #publicKey;
+  #secretKey;
+
+  constructor(secretKey = null) {
+    this.#publicKey = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES);
+    this.#secretKey = sodium.sodium_malloc(sodium.crypto_sign_SECRETKEYBYTES);
+
+    if (secretKey) {
+      // An Ed25519 secret key carries its public half in the last 32 bytes, so
+      // restoring one cannot disagree with the public key it is paired with.
+      secretKey.copy(this.#secretKey);
+      this.#secretKey
+        .subarray(sodium.crypto_sign_SECRETKEYBYTES - sodium.crypto_sign_PUBLICKEYBYTES)
+        .copy(this.#publicKey);
+    } else {
+      sodium.crypto_sign_keypair(this.#publicKey, this.#secretKey);
+    }
+  }
+
+  get publicKey() {
+    return this.#publicKey;
+  }
+
+  get publicKeyB64() {
+    return this.#publicKey.toString('base64');
+  }
+
+  get fingerprint() {
+    return identityFingerprint(this.#publicKey);
+  }
+
+  /** Detached signature over arbitrary bytes. */
+  sign(bytes) {
+    const signature = Buffer.alloc(sodium.crypto_sign_BYTES);
+    sodium.crypto_sign_detached(signature, bytes, this.#secretKey);
+    return signature;
+  }
+
+  serialize() {
+    return { secretKey: this.#secretKey.toString('base64') };
+  }
+
+  static deserialize(data) {
+    const secretKey = decodeKey(data?.secretKey, sodium.crypto_sign_SECRETKEYBYTES);
+    return secretKey ? new DeviceIdentity(secretKey) : null;
+  }
+
+  destroy() {
+    freeKey(this.#secretKey);
+    this.#secretKey = null;
+    this.#publicKey = null;
+  }
+}
+
+/**
+ * The identity fingerprint, as a human compares it.
+ *
+ * 128 bits, not the 32 the box-key fingerprint uses. That difference is
+ * deliberate: `KeyManager.computeFingerprint` is a display aid sitting next to
+ * a 40-bit SAS that does the real work, whereas the plan (step 4) is for *this*
+ * value to become what a person verifies. `computeSAS` already carries a note
+ * that 20 bits was grindable offline; 32 is not enough to inherit that job.
+ */
+export function identityFingerprint(publicKey) {
+  const key = Buffer.isBuffer(publicKey) ? publicKey : Buffer.from(publicKey, 'base64');
+  const hash = Buffer.alloc(32);
+  sodium.crypto_generichash(hash, Buffer.concat([Buffer.from(FINGERPRINT_DOMAIN), key]));
+
+  const parts = [];
+  for (let i = 0; i < 16; i += 2) {
+    parts.push(
+      hash
+        .subarray(i, i + 2)
+        .toString('hex')
+        .toUpperCase(),
+    );
+  }
+  return parts.join(':');
+}
+
+function decodeKey(b64, size) {
+  if (typeof b64 !== 'string') {
+    return null;
+  }
+  let buf;
+  try {
+    buf = Buffer.from(b64, 'base64');
+  } catch {
+    return null;
+  }
+  return buf.length === size ? buf : null;
+}
+
+// Length-prefixed on the *byte* count, so a label with a multi-byte character
+// cannot make two different lists serialise the same way. The separator is
+// cosmetic — the prefixes are what make the encoding injective.
+const lp = (value) => `${Buffer.byteLength(String(value), 'utf-8')}:${value}`;
+
+/**
+ * What the signature covers.
+ *
+ * Everything a relay or a peer could tamper with: which identity the list
+ * belongs to, its position in the sequence, how many devices it names, and
+ * every field of every device. The count is in there so devices cannot be
+ * dropped from the end without breaking the signature.
+ *
+ * The ML-KEM key is deliberately *not* in a descriptor. A list is a set of
+ * claims about identity, and a KEM key is not one — it is transport material,
+ * already advertised per session in JOIN, and a device could change it without
+ * changing who it is. Carrying it here also cost 1584 bytes of base64 per
+ * device, which is the difference between a provisioning grant that fits in a
+ * QR code and one that does not.
+ */
+export function deviceListBytes({ identityPk, counter, devices }) {
+  const parts = [LIST_DOMAIN, identityPk, String(counter), String(devices.length)];
+  for (const device of devices) {
+    parts.push(device.deviceId, device.boxPk, device.label, String(device.createdAt));
+  }
+  return Buffer.from(parts.map(lp).join('|'), 'utf-8');
+}
+
+/**
+ * Sign a set of devices as the current list for this identity.
+ *
+ * `counter` is the caller's responsibility and must only ever go up — see
+ * `isNewerList`. A list is a statement about *now*, so adding a device and
+ * revoking one are the same operation with a different array.
+ */
+export function signDeviceList(identity, counter, devices) {
+  const list = {
+    identityPk: identity.publicKeyB64,
+    counter,
+    devices: devices.map(normaliseDevice),
+  };
+  const signature = identity.sign(deviceListBytes(list));
+  return { ...list, signature: signature.toString('base64') };
+}
+
+function normaliseDevice(device) {
+  return {
+    deviceId: device.deviceId,
+    boxPk: device.boxPk,
+    label: device.label ?? '',
+    createdAt: device.createdAt,
+  };
+}
+
+/**
+ * Read a device list that arrived from somewhere else.
+ *
+ * Returns the normalised list, or `null`. Never throws and never partially
+ * accepts: a list is one signed statement, so half of it is not usable and
+ * "the good devices out of a bad list" is exactly the shape of bug the
+ * capability validator was written to avoid.
+ *
+ * The signature is checked *last*, after the structure, because verifying a
+ * signature over a shape we would reject anyway is work an unauthenticated
+ * peer gets to ask for.
+ */
+export function verifyDeviceList(envelope) {
+  if (!envelope || typeof envelope !== 'object') {
+    return null;
+  }
+
+  const identityKey = decodeKey(envelope.identityPk, sodium.crypto_sign_PUBLICKEYBYTES);
+  const signature = decodeKey(envelope.signature, sodium.crypto_sign_BYTES);
+  if (!identityKey || !signature) {
+    return null;
+  }
+
+  if (!Number.isSafeInteger(envelope.counter) || envelope.counter < 0) {
+    return null;
+  }
+
+  if (!Array.isArray(envelope.devices) || envelope.devices.length === 0) {
+    return null;
+  }
+  if (envelope.devices.length > MAX_DEVICES) {
+    return null;
+  }
+
+  const devices = [];
+  const ids = new Set();
+  const boxKeys = new Set();
+
+  for (const device of envelope.devices) {
+    if (!device || typeof device !== 'object') {
+      return null;
+    }
+    if (typeof device.deviceId !== 'string' || !/^[0-9a-f]{32}$/.test(device.deviceId)) {
+      return null;
+    }
+    if (!decodeKey(device.boxPk, sodium.crypto_box_PUBLICKEYBYTES)) {
+      return null;
+    }
+    if (typeof device.label !== 'string' || device.label.length > MAX_LABEL_LENGTH) {
+      return null;
+    }
+    if (!Number.isSafeInteger(device.createdAt) || device.createdAt < 0) {
+      return null;
+    }
+
+    // Two entries naming one device, or one key under two device ids, would
+    // make "which device is this" ambiguous for every reader.
+    if (ids.has(device.deviceId) || boxKeys.has(device.boxPk)) {
+      return null;
+    }
+    ids.add(device.deviceId);
+    boxKeys.add(device.boxPk);
+
+    devices.push(normaliseDevice(device));
+  }
+
+  const list = { identityPk: envelope.identityPk, counter: envelope.counter, devices };
+  if (!sodium.crypto_sign_verify_detached(signature, deviceListBytes(list), identityKey)) {
+    return null;
+  }
+
+  return { ...list, signature: envelope.signature };
+}
+
+/**
+ * Should `candidate` replace `held`?
+ *
+ * Highest counter wins, and it is enforced here — on receipt — rather than
+ * trusted from the sender. Without it, a relay that kept a copy of an older
+ * list could replay it to put a revoked device back.
+ *
+ * A candidate for a different identity is never newer; it is a different
+ * question, and answering it here would let one identity's list displace
+ * another's.
+ */
+export function isNewerList(candidate, held) {
+  if (!candidate) {
+    return false;
+  }
+  if (!held) {
+    return true;
+  }
+  if (candidate.identityPk !== held.identityPk) {
+    return false;
+  }
+  return candidate.counter > held.counter;
+}
+
+export const DEVICE_LIMITS = { MAX_DEVICES, MAX_LABEL_LENGTH, DEVICE_ID_SIZE };

package/src/crypto/KeyManager.js

@@ -3,7 +3,18 @@ import sodium from 'sodium-native';
 import { createHash } from 'node:crypto';
 import { KEY_ROTATION_GRACE_MS } from '../shared/constants.js';
 import { generatePQKeyPair } from './PQHybrid.js';
+import { DeviceIdentity, identityFingerprint, newDeviceId } from './DeviceIdentity.js';
 
+// Guarded memory is released with sodium_free, never merely zeroed.
+//
+// sodium_malloc'd pages are mlock'd and the OS caps how much a process may lock
+// (RLIMIT_MEMLOCK — small on Linux, unlimited on macOS, which is why the ceiling
+// is invisible here and fatal in CI). Zeroing leaves the pages locked until the
+// garbage collector runs the buffer's finaliser; sodium_free zeroes *and*
+// releases, so it is strictly stronger than the memzero it replaces. Every
+// caller nulls its reference immediately after, so nothing can reach freed
+// memory. Same reasoning as SenderKey.js, and the same failure it was written
+// for: an allocation that fails lands as a SIGABRT in whatever allocated next.
 export class KeyManager {
   #publicKey;
   #secretKey;
@@ -12,6 +23,26 @@ export class KeyManager {
   #previousSecretKey;
   #graceTimer;
   #pqKeyPair; // ML-KEM-768 — the hybrid half (see crypto/PQHybrid.js)
+  // Multi-device, step 2 (docs/design/multi-device.md). Carried, persisted,
+  // backed up and advertised — and read by nobody. The box key above is still
+  // the identity as far as every fingerprint, SAS and ban is concerned; this
+  // pair exists so that the field is already on the wire when step 3 starts
+  // signing device lists with it, the way the Ed25519 sender key landed before
+  // the send path that needed it.
+  // Ed25519 — signs device lists, never encrypts. **Null on a secondary
+  // device**, which holds only the public half: the identity secret never
+  // leaves the device that provisions. See shared/deviceProvisioning.js.
+  #identity;
+  #identityPk; // the public half, whether or not we hold the secret
+  #grantedList; // a secondary cannot sign, so it publishes what it was given
+  #deviceId; // names *this* device across box-key rotations
+  #deviceCreatedAt; // when this device id was drawn
+  // Version of the device list this device publishes. Persisted, and only ever
+  // increased. A peer keeps the highest counter it has seen, so a list that
+  // came back with a smaller one is a replay and is ignored — which also means
+  // a counter that failed to grow after the descriptor changed would leave
+  // every peer holding a list that no longer describes this device.
+  #listCounter;
 
   constructor() {
     this.#publicKey = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES);
@@ -22,10 +53,92 @@ export class KeyManager {
 
     sodium.crypto_box_keypair(this.#publicKey, this.#secretKey);
     this.#pqKeyPair = generatePQKeyPair();
+    this.#identity = new DeviceIdentity();
+    this.#identityPk = this.#identity.publicKeyB64;
+    this.#grantedList = null;
+    this.#deviceId = newDeviceId();
+    this.#deviceCreatedAt = Date.now();
+    this.#listCounter = 1;
 
     this.#fingerprint = KeyManager.computeFingerprint(this.#publicKey);
   }
 
+  /** The signing identity. Survives box-key rotation; that is the point. */
+  get identity() {
+    return this.#identity;
+  }
+
+  get identityPublicKeyB64() {
+    return this.#identityPk;
+  }
+
+  /** True when this device holds the identity secret and can sign for it. */
+  get isPrimaryDevice() {
+    return this.#identity !== null;
+  }
+
+  /** The list a secondary was granted, or null on a primary. */
+  get grantedList() {
+    return this.#grantedList;
+  }
+
+  /**
+   * Adopt an identity we do not hold the secret for.
+   *
+   * The caller has already checked that the list is signed by `identityPk` and
+   * names this device; this only records the outcome. The identity we generated
+   * for ourselves is destroyed rather than kept — two identities on one device
+   * is a state nothing else in the code expects, and keeping a secret nobody
+   * will ever use is the definition of a liability.
+   */
+  adoptIdentity(identityPk, grantedList) {
+    this.#identity?.destroy();
+    this.#identity = null;
+    this.#identityPk = identityPk;
+    this.#grantedList = grantedList;
+  }
+
+  /**
+   * The 128-bit identity fingerprint.
+   *
+   * Not what `/fingerprint` shows and not what a SAS compares — those stay on
+   * the box key until step 4 moves them deliberately, with a migration. Two
+   * fingerprints on screen before then would only teach people to compare the
+   * wrong one.
+   */
+  get identityFingerprint() {
+    return identityFingerprint(this.#identityPk);
+  }
+
+  get deviceId() {
+    return this.#deviceId;
+  }
+
+  get listCounter() {
+    return this.#listCounter;
+  }
+
+  /** The list changed for a reason other than a rotation — adding a device. */
+  bumpListCounter() {
+    this.#listCounter += 1;
+  }
+
+  /**
+   * This device, as a device list names it.
+   *
+   * The label is empty and stays empty until there is a second device to tell
+   * apart. A hostname would be the obvious filler and is exactly the kind of
+   * thing this project does not put on a wire.
+   */
+  deviceDescriptor() {
+    return {
+      deviceId: this.#deviceId,
+      boxPk: this.publicKeyB64,
+      label: '',
+      createdAt: this.#deviceCreatedAt,
+    };
+  }
+
   // The identity fingerprint stays X25519-only on purpose: it is what users
   // already verified out-of-band, and the KEM key adds no authentication.
   get pqPublicKey() {
@@ -65,9 +178,24 @@ export class KeyManager {
   }
 
   /**
-   * Generate a new keypair, keeping the old one for a grace period.
+   * Generate a new box keypair, keeping the old one for a grace period.
+   *
+   * The identity key and the device id are deliberately untouched. Rotating the
+   * box key is a routine hygiene step; rotating an identity is a claim that you
+   * are somebody new, and once device lists exist it would invalidate every one
+   * of them. A device that rotates is the same device.
    */
   rotate() {
+    // A secondary cannot rotate. Its box key is named in a list signed by an
+    // identity whose secret lives somewhere else, so a new key would be a key
+    // nothing vouches for — every peer would see an unproven device under a
+    // known name, which is the alarm this whole arc exists to stop firing
+    // wrongly. Rotating a secondary needs the primary to re-sign for it, and
+    // there is no channel for that yet.
+    if (!this.#identity) {
+      return;
+    }
+
     // Clear any existing grace timer
     if (this.#graceTimer) {
       clearTimeout(this.#graceTimer);
@@ -84,6 +212,10 @@ export class KeyManager {
     sodium.crypto_box_keypair(this.#publicKey, this.#secretKey);
 
     this.#fingerprint = KeyManager.computeFingerprint(this.#publicKey);
+    // The descriptor just changed, so any list already out there describes a
+    // key this device no longer uses. Without this the new list would carry the
+    // old counter and every peer would discard it as not newer.
+    this.#listCounter += 1;
 
     // Auto-destroy previous keys after grace period
     this.#graceTimer = setTimeout(() => {
@@ -94,7 +226,7 @@ export class KeyManager {
 
   destroyPrevious() {
     if (this.#previousSecretKey) {
-      sodium.sodium_memzero(this.#previousSecretKey);
+      sodium.sodium_free(this.#previousSecretKey);
     }
     this.#previousSecretKey = null;
     this.#previousPublicKey = null;
@@ -118,9 +250,11 @@ export class KeyManager {
     if (this.#graceTimer) {
       clearTimeout(this.#graceTimer);
     }
+    this.#identity?.destroy();
+    this.#identity = null;
     this.destroyPrevious();
     if (this.#secretKey) {
-      sodium.sodium_memzero(this.#secretKey);
+      sodium.sodium_free(this.#secretKey);
     }
     this.#secretKey = null;
     this.#publicKey = null;
@@ -133,12 +267,22 @@ export class KeyManager {
       secretKey: this.#secretKey.toString('base64'),
       pqPublicKey: this.#pqKeyPair.publicKey.toString('base64'),
       pqSecretKey: this.#pqKeyPair.secretKey.toString('base64'),
+      identity: this.#identity ? this.#identity.serialize() : null,
+      identityPk: this.#identityPk,
+      grantedList: this.#grantedList,
+      deviceId: this.#deviceId,
+      deviceCreatedAt: this.#deviceCreatedAt,
+      listCounter: this.#listCounter,
     };
   }
 
   static deserialize(data) {
     const km = new KeyManager(); // generates throwaway keys
-    sodium.sodium_memzero(km.#secretKey); // wipe throwaway
+    // sodium_free rather than memzero: the throwaway's pages are mlock'd, and
+    // zeroing leaves them locked until a finaliser happens to run. One page is
+    // harmless, but this is the pattern that aborted CI in 2.12.0 and it costs
+    // nothing to get right.
+    sodium.sodium_free(km.#secretKey);
 
     km.#publicKey = Buffer.from(data.publicKey, 'base64');
     const tempSec = Buffer.from(data.secretKey, 'base64');
@@ -156,6 +300,34 @@ export class KeyManager {
         secretKey: Buffer.from(data.pqSecretKey, 'base64'),
       };
     }
+    // Same shape for the identity: a session or a backup written before this
+    // existed simply keeps the fresh one generated above. Losing an identity
+    // that nothing reads yet costs nothing; refusing to restore the session
+    // would cost the user everything else in it.
+    const identity = DeviceIdentity.deserialize(data.identity);
+    if (identity) {
+      km.#identity.destroy();
+      km.#identity = identity;
+      km.#identityPk = identity.publicKeyB64;
+    } else if (typeof data.identityPk === 'string' && data.grantedList) {
+      // A secondary: an identity it does not hold the secret for, and the list
+      // it was granted. Restored together or not at all — one without the other
+      // is a device that claims an identity it cannot prove it belongs to.
+      km.#identity.destroy();
+      km.#identity = null;
+      km.#identityPk = data.identityPk;
+      km.#grantedList = data.grantedList;
+    }
+    if (typeof data.deviceId === 'string' && /^[0-9a-f]{32}$/.test(data.deviceId)) {
+      km.#deviceId = data.deviceId;
+      // Only meaningful alongside the id they belong to.
+      if (Number.isSafeInteger(data.deviceCreatedAt) && data.deviceCreatedAt >= 0) {
+        km.#deviceCreatedAt = data.deviceCreatedAt;
+      }
+      if (Number.isSafeInteger(data.listCounter) && data.listCounter >= 1) {
+        km.#listCounter = data.listCounter;
+      }
+    }
     return km;
   }
 }

package/src/crypto/SenderKey.js

@@ -16,6 +16,26 @@ const CHAIN_KEY_TAG = Buffer.from([0x02]);
 const DEFAULT_MAX_SKIP = 1000; // bound out-of-order / skipped message keys
 const KEY_ID_SIZE = 16;
 
+// Release a key allocated with sodium_malloc.
+//
+// `sodium_memzero` alone is not enough, and the difference is not academic.
+// sodium_malloc'd pages are **mlock'd**, and an operating system caps how much
+// a process may lock at once — RLIMIT_MEMLOCK, which on Linux is small and on
+// macOS is typically unlimited. Zeroing a key leaves its pages locked until the
+// garbage collector happens to run the buffer's finaliser, so a process that
+// derives keys faster than it collects them walks into an allocation failure it
+// never sees coming: sodium_malloc returns NULL, and the crash lands on whatever
+// unrelated call allocated next.
+//
+// sodium_free zeroes before releasing, so this is strictly stronger than the
+// memzero it replaces. Null-safe and idempotent by convention: every caller
+// drops its reference immediately after, so nothing can reach freed memory.
+function freeKey(buf) {
+  if (buf) {
+    sodium.sodium_free(buf);
+  }
+}
+
 // An opaque label for a sender chain, handed out with the distribution.
 //
 // On the relay path a group message arrives by fan-out with no sender on it —
@@ -97,8 +117,9 @@ export class SenderChain {
     sodium.crypto_generichash(messageKey, MSG_KEY_TAG, this.#chainKey);
     const nextChainKey = sodium.sodium_malloc(KEY_SIZE);
     sodium.crypto_generichash(nextChainKey, CHAIN_KEY_TAG, this.#chainKey);
-    sodium.sodium_memzero(this.#chainKey);
+    const spent = this.#chainKey;
     this.#chainKey = nextChainKey;
+    freeKey(spent); // released, not merely zeroed — the hot path, once per message
     return messageKey;
   }
 
@@ -112,7 +133,8 @@ export class SenderChain {
 
   // Receiving: the message key at `targetCounter`, caching skipped keys for
   // out-of-order delivery. Returns null on replay (already consumed) or if the
-  // gap exceeds maxSkip. The caller must sodium_memzero the returned key.
+  // gap exceeds maxSkip. The caller owns the returned key and must release it —
+  // groupDecrypt does, on every path including the failures.
   messageKeyFor(targetCounter) {
     if (this.#skipped.has(targetCounter)) {
       const key = this.#skipped.get(targetCounter);
@@ -145,9 +167,10 @@ export class SenderChain {
   }
 
   destroy() {
-    sodium.sodium_memzero(this.#chainKey);
+    freeKey(this.#chainKey);
+    this.#chainKey = null;
     for (const key of this.#skipped.values()) {
-      sodium.sodium_memzero(key);
+      freeKey(key);
     }
     this.#skipped.clear();
   }
@@ -162,18 +185,18 @@ export function groupEncrypt(messageKey, plaintext) {
   const ciphertext = Buffer.alloc(padded.length + sodium.crypto_secretbox_MACBYTES);
   sodium.crypto_secretbox_easy(ciphertext, padded, nonce, messageKey);
   sodium.sodium_memzero(padded);
-  sodium.sodium_memzero(messageKey);
+  freeKey(messageKey);
   return { ciphertext, nonce };
 }
 
 export function groupDecrypt(messageKey, ciphertext, nonce) {
   if (ciphertext.length < sodium.crypto_secretbox_MACBYTES) {
-    sodium.sodium_memzero(messageKey);
+    freeKey(messageKey);
     return null;
   }
   const padded = Buffer.alloc(ciphertext.length - sodium.crypto_secretbox_MACBYTES);
   const ok = sodium.crypto_secretbox_open_easy(padded, ciphertext, nonce, messageKey);
-  sodium.sodium_memzero(messageKey);
+  freeKey(messageKey);
   if (!ok) {
     sodium.sodium_memzero(padded);
     return null;
@@ -312,14 +335,21 @@ export class GroupSession {
     }
   }
 
+  // Returns whether this actually removed a member. Callers rotate on a real
+  // membership change and must not rotate on a departure they have already
+  // handled: every rotation costs a redistribution to everyone remaining, and a
+  // redistribution that crosses an incoming message is a message the recipient
+  // has to buffer.
   removeMember(memberId) {
     const chain = this.#members.get(memberId);
+    const had = this.#members.has(memberId) || this.#memberSignPk.has(memberId);
     if (chain) {
       chain.destroy();
       this.#members.delete(memberId);
     }
     this.#forgetKeyIdsOf(memberId);
     this.#memberSignPk.delete(memberId);
+    return had;
   }
 
   #forgetKeyIdsOf(memberId) {
@@ -343,13 +373,18 @@ export class GroupSession {
     // The signing key rotates with the chain it authenticates. Keeping it would
     // let anyone holding the old public key keep attributing new packets to a
     // chain that was rotated precisely because the room membership changed.
-    sodium.sodium_memzero(this.#signSk);
+    //
+    // Released rather than zeroed: rotation runs on every membership change, so
+    // a room with any churn would otherwise accumulate locked pages for the life
+    // of the session.
+    freeKey(this.#signSk);
     ({ publicKey: this.#signPk, secretKey: this.#signSk } = newSigningKeypair());
   }
 
   destroy() {
     this.#own.destroy();
-    sodium.sodium_memzero(this.#signSk);
+    freeKey(this.#signSk);
+    this.#signSk = null;
     for (const chain of this.#members.values()) {
       chain.destroy();
     }