libves 1.0.4 → 1.9.9

package/libVES.node.js

@@ -1,13 +1,39 @@
-/**
+/***************************************************************************
+ *          ___       ___
+ *         /   \     /   \    VESvault
+ *         \__ /     \ __/    Encrypt Everything without fear of losing the Key
+ *            \\     //                   https://vesvault.com https://ves.host
+ *             \\   //
+ *     ___      \\_//
+ *    /   \     /   \         libVES:                      VESvault API library
+ *    \__ /     \ __/
+ *       \\     //
+ *        \\   //
+ *         \\_//              - Key Management and Exchange
+ *         /   \              - Item Encryption and Sharing
+ *         \___/              - VESrecovery (TM)
+ *
+ *
+ * (c) 2017 - 2020 VESvault Corp
+ * Jim Zubov <jz@vesvault.com>
+ *
+ * GNU General Public License v3
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
  * @title libVES
  * @dev A JavaScript end-to-end encryption interface to VESvault REST API
- * @version 1.01b
+ * @version 1.99
  *
  * @dev Official source code: https://github.com/vesvault/libVES
  *
- * @author Jim Zubov <jz@vesvault.com> (VESvault)
- * GPL license, http://www.gnu.org/licenses/
- */
+ * @author Jim Zubov <jz@vesvault.com> (VESvault Corp)
+ *
+ ***************************************************************************/
 
 if (!window.libVES) window.libVES = function(optns) {
     try {
@@ -26,8 +52,8 @@ if (!window.libVES) window.libVES = function(optns) {
 libVES.prototype = {
     apiUrl: 'https://api.ves.host/v1/',
     wwwUrl: 'https://www.vesvault.com/',
-    keyAlgo: 'RSA',
-    textCipher: 'AES256CBC',
+    keyAlgo: 'ECDH',
+    textCipher: 'AES256GCMp',
     defaultHash: 'SHA256',
     
     request: function(method,uri,body,optns) {
@@ -62,7 +88,7 @@ libVES.prototype = {
 	    if (body != null) xhr.setRequestHeader('Content-Type','application/json');
 	    xhr.setRequestHeader('Accept','application/json');
 	    if (this.user && optns.password) xhr.setRequestHeader('Authorization','Basic ' + btoa(this.user + ':' + optns.password));
-	    else if (this.token) xhr.setRequestHeader('Authorization','Bearer ' + this.token);
+	    else if (optns.token || this.token) xhr.setRequestHeader('Authorization','Bearer ' + (optns.token ? optns.token : this.token));
 	    xhr.responseType = 'json';
 	    xhr.send(body);
 	}.bind(this));
@@ -87,6 +113,18 @@ libVES.prototype = {
 	}
 	return '';
     },
+    elevateAuth: function(optns) {
+	var self = this;
+	if (optns && (optns.password || optns.token)) return Promise.resolve(optns);
+	return (optns && optns.authVaultKey ? Promise.resolve(optns.authVaultKey) : self.getVaultKey()).then(function(vkey) {
+	    return vkey.getSessionToken().then(function(tkn) {
+		if (!tkn) return optns;
+		var o = {token: tkn};
+		if (optns) for (var k in optns) o[k] = optns[k];
+		return o;
+	    });
+	});
+    },
     login: function(passwd) {
 	if (this.token) return this.me();
 	var self = this;
@@ -102,11 +140,82 @@ libVES.prototype = {
 	this.token = undefined;
 	return this.lock();
     },
-    delegate: function() {
+    delegate: function(optns) {
 	var self = this;
 	return libVES.getModule(libVES,'Delegate').then(function(dlg) {
-	    return dlg.login(self);
+	    return dlg.login(self,null,optns).then(function() {
+		return self;
+	    });
+	});
+    },
+    getVESflow: function() {
+	var self = this;
+	if (!this.VESflow) this.VESflow = libVES.getModule(libVES, 'Flow').then(function(fw) {
+	    var flow = new fw('VES');
+	    var authf = self.authorize.bind(self);
+	    self.authorize = function(msg) {
+		flow.setValue(msg);
+		return authf(msg);
+	    };
+	    var outf = self.logout.bind(self);
+	    self.logout = function() {
+		flow.logout();
+		return outf();
+	    };
+	    return flow;
 	});
+	return this.VESflow;
+    },
+    flow: function(start, optns) {
+	var self = this;
+	return self.getVESflow().then(function(flow) {
+	    return flow.get().then(function(auth) {
+		return self.authorize(auth);
+	    }).catch(function(e) {
+		if (!start || (e && e.code == 'Reload')) throw e;
+		var url = self.wwwUrl + 'vv/unlock?url=' + encodeURIComponent(document.location.href) + '&domain=' + encodeURIComponent(self.domain);
+		if (optns) for (var k in optns) if (optns[k] != null) url += '&' + encodeURIComponent(k) + '=' + encodeURIComponent(optns[k]);
+		flow.url = undefined;
+		return flow.setValue(undefined).then(function() {
+		    return flow.addToken(url).then(function(url) {
+			document.location.replace(url);
+			throw {code: 'Redirect', message: 'Starting VES Authorization...'};
+		    });
+		});
+	    });
+	});
+    },
+    authorize: function(msg) {
+	var self = this;
+	if (msg.token) this.token = msg.token;
+	if (msg.domain) this.domain = msg.domain;
+	if (msg.externalId) this.externalId = msg.externalId;
+	return (msg.VESkey ? this.unlock(msg.VESkey) : this.me()).then(function() {
+	    return self;
+	});
+    },
+    carry: function(optns) {
+	var cr = {};
+	if (this.externalId) cr.externalId = this.externalId;
+	if (this.domain) cr.domain = this.domain;
+	if (this.token) cr.token = this.token;
+	if (this.VESkey) cr.VESkey = this.VESkey;
+	try {
+	    sessionStorage['libVES_carry'] = JSON.stringify(cr);
+	} catch (e) {
+	    return Promise.reject(e);
+	}
+	return Promise.resolve(true);
+    },
+    pick: function(optns) {
+	try {
+	    if (!sessionStorage['libVES_carry']) throw new libVES.Error('NotFound','No libVES_carry in sessionStorage');
+	    var cr = JSON.parse(sessionStorage['libVES_carry']);
+	    delete(sessionStorage['libVES_carry']);
+	    return this.authorize(cr);
+	} catch (e) {
+	    return Promise.reject(e);
+	}
     },
     me: function() {
 	var self = this;
@@ -119,16 +228,17 @@ libVES.prototype = {
 	var self = this;
 	return this.getVaultKey().then(function(vkey) {
 	    return vkey.unlock(Promise.resolve(veskey)).then(function(cryptoKey) {
+		if (self.VESkey === null) self.VESkey = veskey;
 		if (!self.token && self.type == 'secondary') return vkey.getSessionToken().then(function(tkn) {
 		    self.token = tkn;
-		    return Promise.resolve(veskey).then(function(veskey) {
-			if (veskey) return vkey.reshareVESkey(veskey).catch(function(){});
-		    }).then(function() {
-			return cryptoKey;
-		    });
+		    return cryptoKey;
 		});
 		return cryptoKey;
 	    });
+	}).then(function(ck) {
+	    return self.handleAttn().catch(function() {}).then(function() {
+		return ck;
+	    });
 	});
     },
     lock: function() {
@@ -162,7 +272,7 @@ libVES.prototype = {
 	});
     },
     getVaultKeysById: function() {
-	if (!this.vaultKeysById) this.vaultKeysById = this.me().then(function(me) {
+	return this.me().then(function(me) {
 	    return me.getVaultKeys().then(function(vaultKeys) {
 		return Promise.all(vaultKeys.map(function(e,i) {
 		    return e.getId();
@@ -173,7 +283,6 @@ libVES.prototype = {
 		});
 	    });
 	});
-	return this.vaultKeysById;
     },
     getItems: function() {
 	var self = this;
@@ -211,7 +320,7 @@ libVES.prototype = {
 		if (u instanceof libVES.VaultKey) return [u];
 		else if (u instanceof libVES.External) return [new libVES.VaultKey({externals:[u]},self)];
 		else if (u instanceof libVES.User) return self.getUserKeys(u);
-		else if (u instanceof Array || u.domain != null || u.externalId != null) return self._matchSecondaryKey(u,u.user).then(function(vkey) {
+		else if (u instanceof Array || u.domain != null || u.externalId != null) return self._matchSecondaryKey(u, u.user, u.appUrl).then(function(vkey) {
 		    return [vkey];
 		});
 	    }
@@ -229,10 +338,21 @@ libVES.prototype = {
 	} else if (typeof(u) == 'string' && u.match(/^\S+\@\S+$/)) return new libVES.User({email: u},this);
 	throw new libVES.Error('BadUser',"Cannot match user: " + u,{value: u});
     },
-    _matchSecondaryKey: function(ext,user) {
+    _matchSecondaryKey: function(ext, user, appUrl) {
 	var self = this;
 	var m = function() {
-	    return libVES.getModule(libVES.Domain,ext.domain);
+	    return libVES.getModule(libVES.Domain,ext.domain).catch(function(e) {
+		return {
+		    userToVaultRef: function(u) {
+			return u.getEmail().then(function(email) {
+			    return email.toLowerCase();
+			});
+		    },
+		    vaultRefToUser: function(ext) {
+			return new libVES.User({email: ext.externalId}, self);
+		    }
+		};
+	    });
 	};
 	return (ext.externalId ? self.prepareExternals(ext) : m().then(function(dom) {
 	    return Promise.resolve(user || self.me()).then(function(u) {
@@ -257,10 +377,11 @@ libVES.prototype = {
 			return Promise.all([me.getId(),u.getId()]).then(function(ids) {
 			    if (ids[0] == ids[1]) return self.getSecondaryKey(exts,true);
 			}).catch(function(e) {
-			    if (e != 'NotFound') throw e;
+			    if (e.code != 'NotFound') throw e;
 			}).then(function(rs) {
 			    return rs || self.createTempKey(self._matchUser(u)).then(function(vkey) {
 				return vkey.setField('externals',exts).then(function() {
+				    if (appUrl) vkey.setField('appUrl', appUrl);
 				    return vkey;
 				});
 			    });
@@ -292,21 +413,21 @@ libVES.prototype = {
 	    return keys;
 	});
     },
-    createTempKey: function(usr,optns) {
+    createTempKey: function(usr, optns) {
 	var self = this;
-	var key = new libVES.VaultKey({type: 'temp', algo: this.keyAlgo, user: usr},self);
+	var key = new libVES.VaultKey({type: 'temp', algo: this.keyAlgo, user: usr}, self);
 	var veskey = this.generateVESkey(usr);
-	return key.generate(veskey,optns).then(function(k) {
-	    if (self.e2e && self.e2e.length) usr.e2e = self.getVESkeyE2E(veskey,usr);
-	    key.setField('vaultItems',veskey.then(function(v) {
-		var vi = new libVES.VaultItem({type: 'password'},self);
-		return self.me().then(function(me) {
-		    return vi.shareWith([me],v,false).then(function() {
+	return key.generate(veskey, optns).then(function(k) {
+	    if (self.e2e && self.e2e.length) usr.e2e = self.getVESkeyE2E(veskey, usr);
+	    key.setField('vaultItems', veskey.then(function(v) {
+		var vi = new libVES.VaultItem({type: 'password'}, self);
+		return Promise.all(self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()]).then(function(sh) {
+		    return vi.shareWith(sh, v, false).then(function() {
 			return [vi];
 		    });
 		});
 	    }));
-	    key.setField('creator',self.me());
+	    key.setField('creator', self.me());
 	    return key;
 	});
     },
@@ -331,22 +452,31 @@ libVES.prototype = {
 	var self = this;
 	return this.me().then(function(me) {
 	    return (new libVES.VaultKey({type: 'current', algo: self.keyAlgo, user: me},self)).generate(Promise.resolve(veskey),options).then(function(k) {
-		return self.getVaultKey().then(function(cur) {
-		    var r;
-		    if (cur) {
-			if (lost) r = cur.setField('type','lost').then(function() {
+		return me.getCurrentVaultKey().then(function(cur) {
+		    return (cur ? cur.unlock().then(function() {
+			return k.rekeyFrom(cur);
+		    }).catch(function(e) {
+			if (!lost) throw e;
+		    }) : Promise.resolve(null)).then(function() {
+			var r;
+			if (cur && lost) r = cur.setField('type','lost').then(function() {
 			    k.user = undefined;
 			    return me.setField('vaultKeys',[cur,k]).then(function() {
 				return me;
 			    });
 			});
-			else r = k.rekeyFrom(cur);
-		    } else r = k;
-		    me.currentVaultKey = me.activeVaultKeys = undefined;
-		    if (!cur || !lost) me.vaultKeys = undefined;
-		    return r;
+			else r = k;
+			me.currentVaultKey = me.activeVaultKeys = me.shadowVaultKey = undefined;
+			if (!cur || !lost) me.vaultKeys = undefined;
+			return r;
+		    });
 		}).then(function(r) {
-		    return r.post(undefined,undefined,options);
+		    return self.elevateAuth(options).then(function(optns) {
+			return r.post(undefined, undefined, optns);
+		    });
+		}).catch(function(e) {
+		    self.reset();
+		    throw e;
 		}).then(function(post) {
 		    return self.reset(post);
 		}).then(function() {
@@ -370,21 +500,21 @@ libVES.prototype = {
 	    return rs;
 	});
     },
-    getSecondaryKey: function(ext,force) {
+    getSecondaryKey: function(ext, force) {
 	var self = this;
 	return this.prepareExternals(Promise.resolve(ext).then(function(e) {
-	    if (e.domain && !e.externalId) return libVES.getModule(libVES.Domain,e.domain).then(function(mod) {
+	    if (e.domain && !e.externalId) return libVES.getModule(libVES.Domain, e.domain).then(function(mod) {
 		return self.me().then(function(me) {
-		    return mod.userToVaultRef(me,self);
+		    return mod.userToVaultRef(me, self);
 		});
 	    });
 	    return e;
 	})).then(function(ext) {
-	    var vkey = new libVES.VaultKey({externals: ext},self);
+	    var vkey = new libVES.VaultKey({externals: ext}, self);
 	    return vkey.getId().then(function(id) {
 		return vkey;
 	    }).catch(function(e) {
-		if (!force) throw e;
+		if (!force || e.code != 'NotFound') throw e;
 		return self.setSecondaryKey(ext);
 	    });
 	});
@@ -395,14 +525,25 @@ libVES.prototype = {
 	    if (!veskey) veskey = self.generateVESkey();
 	    return self.me().then(function(me) {
 		return (new libVES.VaultKey({type: 'secondary', algo: self.keyAlgo, user: me, externals: ext},self)).generate(veskey,optns).then(function(k) {
+		    return self.getSecondaryKey(ext).then(function(k2) {
+			return k.rekeyFrom(k2);
+		    }).catch(function(e) {
+			delete(k.vaultEntries);
+			return k;
+		    });
+		}).then(function(k) {
 		    var vi = new libVES.VaultItem({type: "password"},self);
 		    k.setField('vaultItems',[vi]);
 		    return Promise.resolve(veskey).then(function(v) {
 			if (!v) throw new libVES.Error('InvalidValue','VESkey cannot be empty');
 			return vi.shareWith([me],v,false).then(function() {
-			    return k.post().then(function(post) {
-				self.reset(post);
-				return k;
+			    return self.elevateAuth(optns);
+			}).then(function(optns) {
+			    return k.post(undefined, undefined, optns).then(function(post) {
+				return k.setField('id', post.id, false).then(function() {
+				    k.fieldUpdate = {id: true};
+				    return k;
+				});
 			    });
 			});
 		    });
@@ -411,14 +552,26 @@ libVES.prototype = {
 	});
     },
     setShadow: function(usrs,optns) {
-	if (!optns || !optns.n) return Promise.reject(new libVES.Error('InvalidValue','optns.n must be an integer'));
 	var self = this;
+	if (!(usrs instanceof Array)) return Promise.reject(new libVES.Error('InvalidValue', 'usrs must be an array'));
+	if (!usrs.length) {
+	    return self.getShadowKey().then(function(sh) {
+		return (sh ? sh.getId().then(function(id) {
+		    return self.elevateAuth(optns).then(function(optns) {
+			return self.post('vaultKeys/' + id, {'$op': 'delete'}, undefined, optns). then(function() {
+			    return null;
+			});
+		    });
+		}) : null);
+	    });
+	}
+	if (!optns || !optns.n) return Promise.reject(new libVES.Error('InvalidValue','optns.n must be an integer'));
 	var rkey = new Uint8Array(32);
 	window.crypto.getRandomValues(rkey);
 	var algo = optns.v ? libVES.Scramble.algo[optns.v] : libVES.Scramble.RDX;
 	if (!algo) return Promise.reject(new libVES.Error('InvalidValue','Unknown scramble algorithm: ' + optns.v));
 	var s = new algo(optns.n);
-	return s.explode(rkey,usrs.length).then(function(tkns) {
+	return s.explode(rkey,usrs.length,optns).then(function(tkns) {
 	    return self.me().then(function(me) {
 		me.activeVaultKeys = undefined;
 		return me.setField('shadowVaultKey',new libVES.VaultKey({type: 'shadow', user: me, algo: self.keyAlgo},self).generate(rkey,optns),false).then(function(k) {
@@ -434,14 +587,16 @@ libVES.prototype = {
 				delete(libVES.Object._refs);
 				return vis;
 			    }));
-			    return k.post();
+			    return self.elevateAuth(optns).then(function(optns) {
+				return k.post(undefined, undefined, optns);
+			    });
 			});
 		    });
 		}).catch(function(e) {
 		    me.shadowVaultKey = undefined;
 		    throw e;
 		}).then(function() {
-		    me.currentVaultKey = me.activeVaultKeys = undefined;
+		    me.currentVaultKey = me.shadowVaultKey = me.activeVaultKeys = undefined;
 		    return me.getShadowVaultKey();
 		});
 	    });
@@ -467,30 +622,11 @@ libVES.prototype = {
     putValue: function(fileRef,value,shareWith) {
 	var self = this;
 	return this.getFileItem(fileRef).then(function(vaultItem) {
-	    return vaultItem.setField('type',libVES.VaultItem.Type._detect(value)).then(function(type) {
-		return vaultItem.getFile().then(function(file) {
-		    return file.getExternals().then(function(exts) {
-			return exts[0].getDomain().then(function(domain) {
-			    var m = libVES.getModule(libVES.Domain,domain);
-			    file.setField('path',m.then(function(mod) {
-				return mod.defaultFilePath(file,exts[0]);
-			    }).catch(function() {
-				return '';
-			    }));
-			    file.setField('name',m.then(function(mod) {
-				return mod.defaultFileName(file,exts[0]);
-			    }).catch(function() {
-				return null;
-			    }));
-			    return type;
-			});
-		    });
-		});
-	    }).then(function() {
+	    return vaultItem.setField('type',libVES.VaultItem.Type._detect(value)).then(function() {
 	        return Promise.resolve(shareWith || self.getFileItem(fileRef).then(function(vi) {
-	    	    return vi.getShareList();
-	    	}).catch(function(e) {
-		    return self.usersToKeys([{domain: fileRef.domain}]);
+		    return vi.getShareList();
+		}).catch(function(e) {
+		    return self.usersToKeys([{domain: (fileRef.domain || VES.domain)}]);
 		})).then(function(shareWith) {
 		    return vaultItem.shareWith(shareWith,value);
 		});
@@ -502,6 +638,16 @@ libVES.prototype = {
 	    return vaultItem.shareWith(shareWith);
 	});
     },
+    fileExists: function(fileRef) {
+	return this.getFileItem(fileRef).then(function(vaultItem) {
+	    return vaultItem.getId().then(function(id) {
+		return true;
+	    }).catch(function(e) {
+		if (e.code == 'NotFound') return false;
+		throw e;
+	    });
+	});
+    },
     deleteFile: function(fileRef) {
 	return this.getFile(fileRef).then(function(file) {
 	    return file.delete();
@@ -539,8 +685,8 @@ libVES.prototype = {
     hashText: function(text,cls) {
 	if (cls) cls = cls.split('.')[0];
 	else cls = this.defaultHash;
-	return libVES.getModule(libVES.Util,['Hash',cls]).then(function(fn) {
-	    return fn(libVES.Util.StringToByteArray(text)).then(function(buf) {
+	return libVES.getModule(libVES.Util,['Hash',cls]).then(function(mod) {
+	    return mod.hash(libVES.Util.StringToByteArray(text)).then(function(buf) {
 		return cls + '.' + libVES.Util.ByteArrayToB64W(buf);
 	    });
 	});
@@ -579,8 +725,6 @@ libVES.prototype = {
 		    }).then(function() {
 			chain = chain.then(function(ct) {
 			    return vaultKey.rekey().then(function() {
-				if (self.onRekey) return self.onRekey(vaultKey);
-			    }).then(function() {
 				return ct + 1;
 			    });
 			}).catch(function(e) {console.log(e);});;
@@ -597,35 +741,104 @@ libVES.prototype = {
 	var self = this;
 	return self.me().then(function(me) {
 	    return me.getVaultKeys().then(function(vaultKeys) {
-			return Promise.all(vaultKeys.map(function(e,i) {
-				return e.getType();
-			})).then(function(types) {
-				var rs = [];
-				for (var i = 0; i < types.length; i++) switch (types[i]) {
-					case 'recovery': case 'shadow':
-					rs.push(vaultKeys[i].getRecovery());
-				}
-				return Promise.all(rs);
-			});
+		return Promise.all(vaultKeys.map(function(e,i) {
+		    return e.getType();
+		})).then(function(types) {
+		    var rs = [];
+		    for (var i = 0; i < types.length; i++) switch (types[i]) {
+			case 'recovery': case 'shadow':
+			    rs.push(vaultKeys[i].getRecovery());
+		    }
+		    return Promise.all(rs);
 		});
+	    });
 	});
     },
     getFriendsRecoveries: function() {
 	var self = this;
 	return self.me().then(function(me) {
-	    return me.getFriendsVaultKeys().then(function(vaultKeys) {
-		return Promise.all(vaultKeys.map(function(e,i) {
-		    return e.getType();
+	    return me.getFriendsKeyItems().then(function(vaultItems) {
+		var vaultKeys = [];
+		return Promise.all(vaultItems.map(function(e,i) {
+		    return e.getVaultKey().then(function(vk) {
+			vaultKeys[i] = vk;
+			if (vk) return vk.getType();
+		    });
 		})).then(function(types) {
 		    var rs = [];
 		    for (var i = 0; i < types.length; i++) switch (types[i]) {
 			case 'recovery': case 'shadow':
-			    rs.push(vaultKeys[i].getRecovery());
+			    rs.push(vaultKeys[i].getRecovery([vaultItems[i]]));
 		    }
 		    return Promise.all(rs);
 		});
 	    });
 	});
+    },
+    getUnlockableKeys: function() {
+	var self = this;
+	return self.getVaultKey().then(function(vk) {
+	    return vk.getField('unlockableVaultKeys').then(function(vks) {
+		var rs = {};
+		return Promise.all(vks.map(function(e, i) {
+		    return e.getId().then(function(id) {
+			rs[id] = e;
+		    });
+		})).then(function() {
+		    return rs;
+		});
+	    });
+	});
+    },
+    getAttn: function() {
+	var self = this;
+	var rs = {};
+	return self.get('attn').then(function(attn) {
+	    return attn ? Promise.all([(attn.vaultKeys ? Promise.all(attn.vaultKeys.map(function(vk, i) {
+		return new libVES.VaultKey(vk, self);
+	    })).then(function(vks) {
+		rs.vaultKeys = vks;
+	    }) : null)]) : null;
+	}).then(function() {
+	    return rs;
+	});
+    },
+    handleAttn: function(attn) {
+	var self = this;
+	return (attn ? Promise.resolve(attn) : self.getAttn()).then(function(attn) {
+	    if (attn) return Promise.all([(attn.vaultKeys ? self.attnVaultKeys(attn.vaultKeys) : null)]);
+	});
+    },
+    attnVaultKeys: function(vkeys) {
+	var self = this;
+	return Promise.all(vkeys.map(function(vkey, i) {
+	    console.log('attnVaultKeys:', vkey);
+	    return vkey.getType().then(function(type) {
+		switch (type) {
+		    case 'temp':
+		    case 'lost':
+			return vkey.getUser().then(function(user) {
+			    return self.me().then(function(me) {
+				return Promise.all([user.getId(), me.getId()]).then(function(ids) {
+				    if (ids[0] == ids[1]) return type == 'temp' ? vkey.rekey()
+				    : self.elevateAuth({authVaultKey: vkey}).then(function(optns) {
+					return vkey.rekey(optns);
+				    });
+				    else return vkey.getVaultItems().then(function(vis) {
+					return Promise.all(vis.map(function(vi, i) {
+					    return vi.reshareWith([user]);
+					}));
+				    });
+				});
+			    });
+			});
+		    case 'recovery':
+			return vkey.getRecovery().then(function(rcv) {
+			    return rcv.recover();
+			});
+		}
+	    });
+	}));
     }
 };
 
@@ -756,7 +969,7 @@ libVES.Util = {
 	}
     },
     ASN1: {
-	decode: function(der) {
+	decode: function(der,fStruct) {
 	    var p = 0;
 	    var data = function() {
 		var l = der[p++];
@@ -771,10 +984,14 @@ libVES.Util = {
 	    };
 	    var rs = [];
 	    for (; p < der.length;) {
+		if (!fStruct && p) {
+		    rs.push(der.slice(p));
+		    break;
+		}
 		var tag = der[p++];
 		switch (tag) {
 		    case 48:
-			rs.push(libVES.Util.ASN1.decode(data()));
+			rs.push(libVES.Util.ASN1.decode(data(),true));
 			break;
 		    case 6:
 			rs.push(new libVES.Util.OID(data()));
@@ -796,7 +1013,7 @@ libVES.Util = {
 	    }
 	    return rs;
 	},
-	encode: function(data) {
+	encode: function(data,fStruct) {
 	    var i2a = function(v) {
 		if (v < 0) throw new libVES.Error('Internal',"Negative value for ASN.1 integer!");
 		var rs = [];
@@ -827,10 +1044,10 @@ libVES.Util = {
 		return rs;
 	    };
 	    var d;
-	    for (var i = 0; i < data.length; i++) switch (typeof(d = data[i])) {
+	    for (var i = 0; i < data.length; i++) if (fStruct || !i) switch (typeof(d = data[i])) {
 		case 'object':
 		    if (d == null) buf(5,new Uint8Array(0));
-		    else if (d instanceof Array) buf(48,libVES.Util.ASN1.encode(d));
+		    else if (d instanceof Array) buf(48,libVES.Util.ASN1.encode(d,true));
 		    else if (d instanceof libVES.Util.OID) buf(6,d.getBuffer());
 		    else if (d instanceof Uint8Array || d instanceof ArrayBuffer) buf((d.ASN1type || 4),d);
 		    else throw new libVES.Error('Internal',"ASN.1 encode - Unknown type");
@@ -839,7 +1056,7 @@ libVES.Util = {
 		    buf(2,i2a(d));
 		    break;
 		default: throw new libVES.Error('Internal',"ASN.1 encode - Unknown type");
-	    }
+	    } else bufs.push(d);
 	    var l = 0;
 	    for (var i = 0; i < bufs.length; i++) l += bufs[i].length;
 	    var der = new Uint8Array(l);
@@ -848,7 +1065,7 @@ libVES.Util = {
 	    return der;
 	},
 	import: function(der,optns) {
-	    var k = libVES.Util.ASN1.decode(der)[0];
+	    var k = optns && optns.decoded || libVES.Util.ASN1.decode(der)[0];
 	    if (!k) throw new libVES.Error('Internal','Empty ASN.1 package?');
 	    var i = 0;
 	    if (typeof(k[i]) == 'number') (optns || (optns = {})).version = k[i++];
@@ -894,6 +1111,11 @@ libVES.Util = {
 		    return crypto.subtle.importKey('pkcs8',der,{name:'RSA-OAEP', hash:'SHA-1'},true,['decrypt']);
 		});
 	    });
+	},
+	encode: function(key,optns) {
+	    return crypto.subtle.exportKey('spki',key).then(function(der) {
+		return libVES.Util.PEM.encode(der,'PUBLIC KEY');
+	    });
 	}
     },
     PKCS5: {
@@ -908,7 +1130,7 @@ libVES.Util = {
 		else return fp;
 	    })(args[i],f);
 	    return f('import',optns).then(function(der) {
-		return crypto.subtle.importKey('pkcs8',der,{name:'RSA-OAEP', hash:'SHA-1'},true,['decrypt']);
+		return libVES.Util.ASN1.import(new Uint8Array(der));
 	    }).catch(function(e) {
 		throw new libVES.Error('InvalidKey',"Cannot import the private key (Invalid VESkey?)");
 	    });
@@ -930,10 +1152,108 @@ libVES.Util = {
 	    });
 	}
     },
+    PKCS8: {
+	encode: function(key,optns) {
+	    var ops = {};
+	    for (var k in optns) ops[k] = optns[k];
+	    if (!ops.members) ops.members = [
+		libVES.getModule(libVES.Util,'PBKDF2'),
+		libVES.getModule(libVES.Cipher,'AES256CBC')
+	    ];
+	    return Promise.all(ops.members).then(function(ms) {
+		ops.members = ms;
+		return crypto.subtle.exportKey('pkcs8',key).catch(function(e) {
+		    console.log('PKCS8 failed, trying JWK...');
+		    return crypto.subtle.exportKey('jwk', key).then(function(jwk) {
+			return libVES.Util.PKCS8.fromJWK(jwk);
+		    });
+		}).then(function(der) {
+		    ops.content = der;
+		    var rec = [];
+		    if (ops.password) return libVES.Util.PKCS5.export(function(call,optns) {
+			rec[1] = optns.content;
+			return Promise.resolve();
+		    },ops).then(function(data) {
+			rec[0] = data;
+			return libVES.Util.PEM.encode(libVES.Util.ASN1.encode([rec]),'ENCRYPTED PRIVATE KEY');
+		    });
+		    else if (ops.opentext) return libVES.Util.PEM.encode(der,'PRIVATE KEY');
+		    else throw new libVES.Error('Internal','No password for key export (opentext=true to export without password?)');
+		});
+	    });
+	},
+	fromJWK: function(jwk) {
+	    if (jwk.kty != 'EC') throw new libVES.Error('Internal', 'kty=="EC" expected (workaround for Firefox)');
+	    var pubx = libVES.Util.B64ToByteArray(jwk.x);
+	    var puby = libVES.Util.B64ToByteArray(jwk.y);
+	    var pub = new Uint8Array(pubx.byteLength + puby.byteLength + 2);
+	    pub[0] = 0;
+	    pub[1] = 4;
+	    pub.set(new Uint8Array(pubx), 2);
+	    pub.set(new Uint8Array(puby), pubx.byteLength + 2);
+	    pub.ASN1type = 3;
+	    pub = libVES.Util.ASN1.encode([pub]);
+	    pub.ASN1type = 0xa1;
+	    return libVES.Util.ASN1.encode([[
+		0,
+		[
+		    new libVES.Util.OID('1.2.840.10045.2.1'),
+		    new libVES.Util.OID((function(crvs) {
+			for (var k in crvs) if (crvs[k] == jwk.crv) return k;
+			throw new libVES.Error('Internal', 'Unknown named curve: ' + jwk.crv);
+		    })(libVES.Util.EC.namedCurves))
+		],
+		libVES.Util.ASN1.encode([[
+		    1,
+		    libVES.Util.B64ToByteArray(jwk.d),
+		    pub
+		]])
+	    ]]).buffer;
+	},
+	toJWK: function(key) {
+	    var der = libVES.Util.ASN1.decode(key)[0];
+	    var idx = 0;
+	    if (!(der[0] instanceof Array)) idx++;
+	    switch (String(der[idx][0])) {
+		case '1.2.840.10045.2.1':
+		case '1.3.132.1.12':
+		case '1.3.132.112': // Firefox on Mac - apparently a misspelling of the former
+		    break;
+		default:
+		    console.log(der);
+		    throw new libVES.Error('Internal', 'EC PKCS8 expected');
+	    }
+	    var der2 = idx ? libVES.Util.ASN1.decode(der[idx + 1])[0] : null;
+	    var pub = idx ? (der2[2] ? libVES.Util.ASN1.decode(der2[2])[0] : null) : der[1];
+	    var publ = 0;
+	    if (pub && pub.byteLength > 2 && pub[1] == 4) publ = pub.byteLength / 2 - 1;
+	    return {
+		crv: libVES.Util.EC.namedCurves[der[idx][1]],
+		d: (idx ? libVES.Util.ByteArrayToB64W(der2[1]) : undefined),
+		ext: true,
+		key_ops: (idx ? ['deriveKey', 'deriveBits'] : []),
+		kty: 'EC',
+		x: (publ ? libVES.Util.ByteArrayToB64W(pub.slice(2, publ + 2)) : ''),
+		y: (publ ? libVES.Util.ByteArrayToB64W(pub.slice(publ + 2, 2 * publ + 2)) : '')
+	    };
+	}
+    },
     PBKDF2: {
-	deriveKey: function(args,pwd,algo) {
-	    return crypto.subtle.importKey('raw',libVES.Util.StringToByteArray(pwd),'PBKDF2',false,['deriveKey']).then(function(k) {
-		return crypto.subtle.deriveKey({name:'PBKDF2', salt:args[0], iterations:args[1], hash: 'SHA-1'},k,algo,true,['encrypt','decrypt']);
+	deriveKey: function(args, pwd, algo) {
+	    return crypto.subtle.importKey('raw', libVES.Util.StringToByteArray(pwd), 'PBKDF2', false, ['deriveKey']).then(function(k) {
+		var keyargs = {name:'PBKDF2', salt:args[0], iterations:args[1]};
+		var ka;
+		if (args[2] && (args[2][0] instanceof libVES.Util.OID)) ka = args[2][0].object().then(function(obj) {
+		    obj.setArgs(keyargs, args[2][1]);
+		    return keyargs;
+		});
+		else {
+		    keyargs.hash = 'SHA-1';
+		    ka = Promise.resolve(keyargs);
+		}
+		return ka.then(function(keyargs) {
+		    return crypto.subtle.deriveKey(keyargs, k, algo, true, ['encrypt', 'decrypt']);
+		});
 	    });
 	},
 	import: function(args,chain,optns) {
@@ -960,9 +1280,61 @@ libVES.Util = {
 	    });
 	}
     },
+    EC: {
+	import: function(args,chain,optns) {
+	    return chain('container',optns).then(function(der) {
+		var a = {name:'ECDH',namedCurve:libVES.Util.EC.namedCurves[String(args)]};
+		return crypto.subtle.importKey('spki',der,a,true,[]).catch(function() {;
+		    return crypto.subtle.importKey('pkcs8',der,a,true,['deriveKey','deriveBits']).catch(function(e) {
+		        console.log('PKCS8 failed, trying JWK...');
+			var jwk = libVES.Util.PKCS8.toJWK(der);
+			return crypto.subtle.importKey('jwk', jwk, a, true, jwk.key_ops);
+		    });
+		});
+	    });
+	},
+	namedCurves: {
+	    "1.3.132.0.10": "P-256",
+	    "1.3.132.0.34": "P-384",
+	    "1.3.132.0.35": "P-521"
+	}
+    },
     Hash: {
-	SHA256: function(buf) {
-	    return crypto.subtle.digest('SHA-256',buf);
+	SHA1: {
+	    setArgs: function(args, optns) {
+		args.hash = 'SHA-1';
+		return args;
+	    },
+	    hash: function(buf) {
+		return crypto.subtle.digest('SHA-1',buf);
+	    }
+	},
+	SHA256: {
+	    setArgs: function(args, optns) {
+		args.hash = 'SHA-256';
+		return args;
+	    },
+	    hash: function(buf) {
+		return crypto.subtle.digest('SHA-256',buf);
+	    }
+	},
+	SHA384: {
+	    setArgs: function(args, optns) {
+		args.hash = 'SHA-384';
+		return args;
+	    },
+	    hash: function(buf) {
+		return crypto.subtle.digest('SHA-384',buf);
+	    }
+	},
+	SHA512: {
+	    setArgs: function(args, optns) {
+		args.hash = 'SHA-512';
+		return args;
+	    },
+	    hash: function(buf) {
+		return crypto.subtle.digest('SHA-512',buf);
+	    }
 	}
     }
 };
@@ -993,10 +1365,15 @@ libVES.Util.OID.prototype = {
     }
 }
 
-libVES.Util.OID['1.2.840.113549.1.5.13'] = libVES.getModuleFunc(libVES,['Util','PKCS5']);
-libVES.Util.OID['1.2.840.113549.1.5.12'] = libVES.getModuleFunc(libVES,['Util','PBKDF2']);
-libVES.Util.OID['2.16.840.1.101.3.4.1.42'] = libVES.getModuleFunc(libVES,['Cipher','AES256CBC']);
-libVES.Util.OID['1.2.840.113549.1.1.1'] = libVES.getModuleFunc(libVES,['Util','PKCS1']);
+libVES.Util.OID['1.2.840.113549.1.5.13'] = libVES.getModuleFunc(libVES, ['Util', 'PKCS5']);
+libVES.Util.OID['1.2.840.113549.1.5.12'] = libVES.getModuleFunc(libVES, ['Util', 'PBKDF2']);
+libVES.Util.OID['2.16.840.1.101.3.4.1.42'] = libVES.getModuleFunc(libVES, ['Cipher', 'AES256CBC']);
+libVES.Util.OID['1.2.840.113549.1.1.1'] = libVES.getModuleFunc(libVES, ['Util', 'PKCS1']);
+libVES.Util.OID['1.2.840.10045.2.1'] = libVES.Util.OID['1.3.132.1.12'] = libVES.Util.OID['1.3.132.112'] = libVES.getModuleFunc(libVES, ['Util', 'EC']);
+libVES.Util.OID['1.2.840.113549.2.7'] = libVES.getModuleFunc(libVES, ['Util', 'Hash', 'SHA1']);
+libVES.Util.OID['1.2.840.113549.2.9'] = libVES.getModuleFunc(libVES, ['Util', 'Hash', 'SHA256']);
+libVES.Util.OID['1.2.840.113549.2.10'] = libVES.getModuleFunc(libVES, ['Util', 'Hash', 'SHA384']);
+libVES.Util.OID['1.2.840.113549.2.11'] = libVES.getModuleFunc(libVES, ['Util', 'Hash', 'SHA512']);
 
 libVES.Math = {
     pad: function(a,n) {
@@ -1374,10 +1751,6 @@ libVES.External = function(data,VES,refs) {
     this.init(data,VES,refs);
 };
 
-libVES.Lockbox = function(data,VES,refs) {
-    this.init(data,VES,refs);
-};
-
 libVES.File = function(data,VES,refs) {
     this.init(data,VES,refs);
 };
@@ -1386,7 +1759,7 @@ libVES.User.prototype = new libVES.Object({
     apiUri: 'users',
     fieldList: {id: true, email: true, type: true, firstName: true, lastName: true},
     fieldExtra: {vaultKeys: true, activeVaultKeys: true, currentVaultKey: true},
-    fieldClass: {vaultKeys: libVES.VaultKey, activeVaultKeys: libVES.VaultKey, currentVaultKey: libVES.VaultKey, shadowVaultKey: libVES.VaultKey, friendsVaultKeys: libVES.VaultKey},
+    fieldClass: {vaultKeys: libVES.VaultKey, activeVaultKeys: libVES.VaultKey, currentVaultKey: libVES.VaultKey, shadowVaultKey: libVES.VaultKey, friendsKeyItems: libVES.VaultItem},
     getEmail: function() {
 	return this.getField('email');
     },
@@ -1416,11 +1789,10 @@ libVES.User.prototype = new libVES.Object({
 	});
 	return this.getField('activeVaultKeys');
     },
-    getFriendsVaultKeys: function() {
-	return this.getField('friendsVaultKeys');
+    getFriendsKeyItems: function() {
+	return this.getField('friendsKeyItems');
     },
     getCurrentVaultKey: function() {
-
 	return this.getField('currentVaultKey');
     },
     getShadowVaultKey: function() {
@@ -1452,9 +1824,9 @@ libVES.User.prototype = new libVES.Object({
 libVES.VaultKey.prototype = new libVES.Object({
     apiUri: 'vaultKeys',
     fieldList: {id: true, algo: true, type: true, publicKey: true, privateKey: true},
-    fieldClass: {user: libVES.User, vaultItems: libVES.VaultItem, externals: libVES.External, sharedKeys: libVES.VaultKey},
+    fieldClass: {user: libVES.User, vaultItems: libVES.VaultItem, externals: libVES.External, unlockableVaultKeys: libVES.VaultKey, creator: libVES.User},
     fieldExtra: {user: true, vaultItems: true},
-    fieldSets: [{vaultEntries: {id: true, encData: true, vaultItem: {id: true}}},{type: true, algo: true, publicKey: true}],
+    fieldSets: [{vaultEntries: {id: true, encData: true, vaultItem: {id: true}}},{type: true, algo: true, publicKey: true}, {unlockableVaultKeys: {id: true, type: true}}],
     getAlgo: function() {
 	return this.getField('algo');
     },
@@ -1478,18 +1850,12 @@ libVES.VaultKey.prototype = new libVES.Object({
     getVaultItems: function() {
 	return this.getField('vaultItems');
     },
-    getSharedKeys: function() {
-	return this.getField('sharedKeys');
-    },
     getExternals: function() {
 	return this.getField('externals');
     },
     getUser: function() {
 	return this.getField('user');
     },
-    getVaultItems: function() {
-	return this.getField('vaultItems');
-    },
     resolveVESkey: function(veskey) {
 	if (veskey) return Promise.resolve(veskey);
 	var self = this;
@@ -1497,6 +1863,7 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    switch (t) {
 	    case 'secondary':
 	    case 'temp':
+	    case 'lost':
 		return self.getVaultItems().then(function(vis) {
 		    var f = function(vis) {
 			if (!vis.length) throw new libVES.Error('InvalidKey','Cannot unlock the secondary key');
@@ -1564,10 +1931,12 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    self.setField('algo',wc.engine.tag);
 	    if (!wc.privateKey) throw new libVES.Error('InvalidValue','Private key expected');
 	    return wc;
-	}) : this.engine().then(function(e) {
-	    return e.generate(optns).then(function(ks) {
-		ks.engine = e;
-		return ks;
+	}) : (optns && optns.algo ? self.setField('algo',optns.algo) : Promise.resolve()).then(function() {
+	    return self.engine().then(function(e) {
+		return e.generate(optns).then(function(ks) {
+		    ks.engine = e;
+		    return ks;
+		});
 	    });
 	});
 	return Promise.resolve(veskey).then(function(v) {
@@ -1611,16 +1980,14 @@ libVES.VaultKey.prototype = new libVES.Object({
 	var self = this;
 	var old_vis = {};
 	return (self.vaultEntries ? self.vaultEntries.then(function(old_ves) {
-	    return old_ves.map(function(ve,i) {
+	    if (old_ves) return old_ves.map(function(ve,i) {
 		old_vis[ve.vaultItem.id] = true;
 	    });
 	}) : Promise.resolve(null)).then(function() {
 	    return self.setField('vaultEntries',key.unlock(veskey).then(function() {
 		return key.getVaultEntries().then(function(ves) {
 		    return Promise.all(ves.map(function(ve) {
-			return old_vis[ve.vaultItem.id] ? Promise.resolve({
-			    vaultItem: {id: ve.vaultItem.id}
-			}) : key.decrypt(ve.encData).then(function(ptxt) {
+			return old_vis[ve.vaultItem.id] ? null : key.decrypt(ve.encData).then(function(ptxt) {
 			    return self.encrypt(ptxt).then(function(ctxt) {
 				return {
 				    vaultItem: {id: ve.vaultItem.id},
@@ -1633,6 +2000,8 @@ libVES.VaultKey.prototype = new libVES.Object({
 				"$op": "ignore"
 			    };
 			});
+		    }).filter(function(e, i) {
+			return !!e;
 		    }));
 		});
 	    }));
@@ -1640,7 +2009,7 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    return self;
 	});
     },
-    rekey: function() {
+    rekey: function(optns) {
 	var self = this;
 	return self.getUser().then(function(user) {
 	    return self.getExternals().then(function(exts) {
@@ -1661,20 +2030,24 @@ libVES.VaultKey.prototype = new libVES.Object({
 		}));
 	    }).then(function(keys) {
 		return user.setField('vaultKeys',keys).then(function() {
-		    return user.post(null,{vaultEntries: true},{refs: {'#/': user}}).then(function(data) {
+		    if (!optns) optns = {};
+		    optns.refs = {'#/': user};
+		    return user.post(null,{vaultEntries: true}, optns).then(function(data) {
 			self.setFields(data,false);
-			return self;
+			return self.VES.onRekey ? self.VES.onRekey(self).catch(function() {}).then(function() {
+			    return self;
+			}) : self;
 		    });
 		});
 	    });
 	});
     },
-    getRecovery: function() {
+    getRecovery: function(myItems) {
 	var self = this;
 	return self.getType().then(function(t) {
 	    switch (t) {
 		case 'shadow': case 'recovery':
-		    return new libVES.Recovery(self);
+		    return new libVES.Recovery(self, myItems);
 		default: throw new libVES.Error('InvalidValue','Recovery is not applicable for VaultKey type ' + t);
 	    }
 	});
@@ -1682,18 +2055,21 @@ libVES.VaultKey.prototype = new libVES.Object({
     getSessionToken: function() {
 	var self = this;
 	return this.getField('encSessionToken').then(function(tk) {
+	    if (!tk) return null;
 	    return self.decrypt(tk).then(function(b) {
 		return libVES.Util.ByteArrayToString(b);
 	    });
 	});
     },
-    reshareVESkey: function(veskey) {
+    reshareVESkey: function(veskey, optns) {
 	var self = this;
 	return self.getVaultItems().then(function(vaultItems) {
 	    return self.getUser().then(function(user) {
 		return Promise.all(vaultItems.map(function(vaultItem,i) {
 		    return vaultItem.getType().then(function(t) {
-			if (t == 'password') return vaultItem.reshareWith([user],veskey);
+			if (t == 'password') return vaultItem.reshareWith([user], veskey, false).then(function(vi) {
+			    return vi.post(undefined, undefined, optns);
+			});
 		    });
 		}));
 	    });
@@ -1708,29 +2084,33 @@ libVES.VaultItem.prototype = new libVES.Object({
     apiUri: 'vaultItems',
     fieldList: {id: true},
     fieldClass: {vaultKey: libVES.VaultKey, file: libVES.File},
-    fieldSets: [{type: true, meta: true},{vaultEntries: {id: true, encData: true, vaultKey: {id: true}}},{vaultKey: true, file: true, lockbox: true}],
-    defaultCipher: 'AES256',
+    fieldSets: [{type: true, meta: true},{vaultEntries: {id: true, encData: true, vaultKey: {id: true, type: true, user: {id: true}, algo: true}}},{vaultKey: true, file: true}],
+    defaultCipher: 'AES256GCM',
     getRaw: function() {
 	var self = this;
-	return self.VES.getVaultKeysById().then(function(vaultKeys) {
-	    var f = function(vaultEntries) {
-	        var i = 0;
-		var fn = function() {
-		    for (; i < vaultEntries.length; i++) {
-			var k,d;
-			if ((d = vaultEntries[i].encData) != null && (k = vaultKeys[vaultEntries[i].vaultKey.id])) {
-			    i++;
-			    return k.decrypt(d).catch(fn);
-			}
+	var f = function(vaultEntries, vaultKeys) {
+	    var i = 0;
+	    var fn = function() {
+		if (vaultEntries) for (; i < vaultEntries.length; i++) {
+		    var k, d;
+		    if ((d = vaultEntries[i].encData) != null && vaultKeys[(k = vaultEntries[i].vaultKey).id]) {
+			i++;
+			return new libVES.VaultKey(k, self.VES).decrypt(d).catch(fn);
 		    }
-		    return Promise.reject(new libVES.Error('Invalid Key',"No unlocked key to decrypt the item",{vaultItem: self}));
-		};
-		return fn();
+		}
+		return Promise.reject(new libVES.Error('InvalidKey',"No unlocked key to decrypt the item",{vaultItem: self}));
 	    };
-	    var vaultEntries = [];
-	    if (self.vaultEntryByKey) for (var k in self.vaultEntryByKey) vaultEntries.push(self.vaultEntryByKey[k]);
-	    return f(vaultEntries).catch(function() {
-		return self.getVaultEntries().then(f);
+	    return fn();
+	};
+	var vaultEntries = [];
+	if (self.vaultEntryByKey) for (var k in self.vaultEntryByKey) vaultEntries.push(self.vaultEntryByKey[k]);
+	return f(vaultEntries, self.VES.unlockedKeys).catch(function() {
+	    return self.getVaultEntries().then(function(vaultEntries) {
+		return f(vaultEntries, self.VES.unlockedKeys).catch(function() {
+		    return self.VES.getUnlockableKeys().then(function(vks) {
+			return f(vaultEntries, vks);
+		    });
+		});
 	    });
 	});
     },
@@ -1749,7 +2129,7 @@ libVES.VaultItem.prototype = new libVES.Object({
     getVaultEntries: function() {
 	var self = this;
 	return this.getField('vaultEntries').then(function(ves) {
-	    for (var i = 0; i < ves.length; i++) self.vaultEntryByKey[ves[i].vaultKey.id] = ves[i];
+	    if (ves) for (var i = 0; i < ves.length; i++) self.vaultEntryByKey[ves[i].vaultKey.id] = ves[i];
 	    return ves;
 	});
     },
@@ -1759,9 +2139,6 @@ libVES.VaultItem.prototype = new libVES.Object({
     getFile: function() {
 	return this.getField('file');
     },
-    getLockbox: function() {
-	return this.getField('lockbox');
-    },
     parse: function(buf) {
 	var self = this;
 	return this.getType().then(function(type) {
@@ -1780,42 +2157,49 @@ libVES.VaultItem.prototype = new libVES.Object({
 	    });
 	});
     },
+    resolveRaw: function(val) {
+	return (val == null ? this.getRaw() : this.build(val));
+    },
     shareWith: function(usrs,val,save) {
 	var self = this;
-	return (val == null ? self.getRaw() : self.build(val)).then(function(v) {
-	    return self.VES.usersToKeys(usrs).then(function(ks) {
-		return (val == null ? self.getVaultEntries().then(function(ves) {
-		    var k_ves = {};
-		    var k_used = {};
-		    for (var j = 0; j < ves.length; j++) k_ves[ves[j].vaultKey.id] = ves[j];
-		    return Promise.all(ks.map(function(k,j) {
-			return k.getId().then(function(k_id) {
-			    k_used[k_id] = true;
-			    return k_ves[k_id];
-			}).catch(function(){});
-		    })).then(function(old_ves) {
-			for (var k_id in k_ves) if (!k_used[k_id]) old_ves.push(k_ves[k_id]);
-			return old_ves;
-		    });
-		}) : Promise.resolve([])).then(function(old_ves) {
-		    var new_ves = [];
-		    var set_ves = [];
-		    return Promise.all(ks.map(function(k,j) {
-			return new_ves[j] = (old_ves[j] || k.encrypt(v).then(function(ctext) {
-			    return k.postData(null,libVES.Object._refs).then(function(pd) {
+	return self.VES.usersToKeys(usrs).then(function(ks) {
+	    return (val == null || self.id ? self.getVaultEntries().then(function(ves) {
+		var k_ves = {};
+		var k_used = {};
+		for (var j = 0; j < ves.length; j++) k_ves[ves[j].vaultKey.id] = ves[j];
+		return Promise.all(ks.map(function(k,j) {
+		    return k.getId().then(function(k_id) {
+			k_used[k_id] = true;
+			return k_ves[k_id];
+		    }).catch(function(){});
+		})).then(function(old_ves) {
+		    for (var k_id in k_ves) if (!k_used[k_id]) old_ves.push(k_ves[k_id]);
+		    return old_ves;
+		});
+	    }) : Promise.resolve([])).then(function(old_ves) {
+		var new_ves = [];
+		var set_ves = [];
+		var valr = null;
+		return Promise.all(ks.map(function(k,j) {
+		    return new_ves[j] = (old_ves[j] || (valr != null ? valr : valr = self.resolveRaw(val)).then(function(v) {
+			return k.encrypt(v).then(function(ctext) {
+			    return (function(refs) {
+				if (refs) for (var i in refs) if (refs[i] === k) return Promise.resolve({'$ref':i});
+				return k.postData(null,refs);
+			    })(libVES.Object._refs).then(function(pd) {
 				return set_ves.push({vaultKey: pd, encData: ctext});
 			    });
-			}));
-		    })).then(function() {
-			return Promise.all(old_ves.slice(ks.length).map(function(ve,j) {
-			    return (new libVES.VaultKey(ve.vaultKey,self.VES)).matchVaults(ks).then(function(f) {
-				if (f === false) set_ves.push({vaultKey: ve.vaultKey, '$op': 'delete'});
-			    });
-			}));
-		    }).then(function() {
-			if (!set_ves.length) return save = false;
-			return self.setField('vaultEntries',set_ves);
-		    });
+			});
+		    }));
+		})).then(function() {
+		    return Promise.all(old_ves.slice(ks.length).map(function(ve,j) {
+			return (new libVES.VaultKey(ve.vaultKey,self.VES)).matchVaults(ks).then(function(f) {
+			    if (f === false) set_ves.push({vaultKey: {id: ve.vaultKey.id}, '$op': 'delete'});
+			});
+		    }));
+		}).then(function() {
+		    if (!set_ves.length) return save = false;
+		    return self.setField('vaultEntries',set_ves);
 		});
 	    });
 	}).then(function() {
@@ -1835,7 +2219,9 @@ libVES.VaultItem.prototype = new libVES.Object({
 		    var m_curr_ks = {};
 		    for (var i = 0; i < curr_ks.length; i++) m_curr_ks[curr_ids[i]] = curr_ks[i];
 		    return Promise.all(new_ks.map(function(k,i) {
-			return k.getId();
+			return k.getId().catch(function(e) {
+			    if (e.code != 'NotFound') throw e;
+			});
 		    })).then(function(new_ids) {
 			for (var i = 0; i < new_ks.length; i++) if (!m_curr_ks[new_ids[i]]) curr_ks.push(m_curr_ks[new_ids[i]] = new_ks[i]);
 			return self.shareWith(curr_ks,val,save);
@@ -1898,8 +2284,9 @@ libVES.VaultItem.Type = {
 		return new ci(new Uint8Array(buf));
 	    });
 	},
-	build: function(data) {
+ 	build: function(data) {
 	    if (!(data instanceof libVES.Cipher)) throw new libVES.Error('InvalidData',"Content of a VaultItem type 'file' must be libVES.Cipher");
+	    this.setField('meta', data.getMeta());
 	    return data.getSecret();
 	}
     },
@@ -1921,10 +2308,13 @@ libVES.VaultItem.Type.password = libVES.VaultItem.Type.string;
 libVES.File.prototype = new libVES.Object({
     apiUri: 'files',
     fieldList: {id: true},
-    fieldClass: {externals: libVES.External},
+    fieldClass: {externals: libVES.External, creator: libVES.User},
     getExternals: function() {
 	return this.getField('externals');
-    }
+    },
+    getCreator: function() {
+	return this.getField('creator');
+    },
 });
 
 libVES.External.prototype = new libVES.Object({
@@ -1944,49 +2334,171 @@ libVES.External.prototype = new libVES.Object({
 });
 
 libVES.Algo = {
-    RSA: {
-	tag: 'RSA',
+    ECDH: {
+	tag: 'ECDH',
 	decrypt: function(k,buf) {
-	    return crypto.subtle.decrypt('RSA-OAEP',k,buf);
+	    var b = new Uint8Array(buf);
+	    var data = libVES.Util.ASN1.decode(b);
+	    if (!data || data.length < 2) throw new libVES.Error('InvalidValue','Error parsing ECIES: Invalid ciphertext?');
+	    return libVES.Util.ASN1.import(b.slice(0,b.byteLength - data[1].byteLength),{decoded:data[0]}).then(function(eKey) {
+		return libVES.Algo.ECDH.cipher(k,eKey).then(function(ci) {
+		    return ci.decrypt(data[1],true).catch(function(e) {
+			if (e instanceof libVES.Error) throw e;
+			throw new libVES.Error('InvalidValue','Error decrypting ECIES payload: Invalid ciphertext?',{error:e});
+		    });
+		}).catch(function(e) {
+		    if (e instanceof libVES.Error) throw e;
+		    throw new libVES.Error('InvalidValue','Error negotiating DH cipher key: Invalid ciphertext?',{error:e});
+		});
+	    }).catch(function(e) {
+		if (e instanceof libVES.Error) throw e;
+		throw new libVES.Error('InvalidValue','Error loading EC ephemeral: Invalid ciphertext?',{error:e});
+	    });
 	},
 	encrypt: function(k,buf) {
-	    return crypto.subtle.encrypt('RSA-OAEP',k,buf);
+	    return libVES.Algo.ECDH.eKey(k).then(function(eKey) {
+		return libVES.Algo.ECDH.cipher(eKey.privateKey,k).then(function(ci) {
+		    return Promise.all([
+			crypto.subtle.exportKey('spki',eKey.publicKey),
+			ci.encrypt(buf,true)
+		    ]).then(function(bufs) {
+			var buf = new Uint8Array(bufs[0].byteLength + bufs[1].byteLength);
+			buf.set(new Uint8Array(bufs[0]),0);
+			buf.set(new Uint8Array(bufs[1]),bufs[0].byteLength);
+			return buf;
+		    });
+		}).catch(function(e) {
+		    if (e instanceof libVES.Error) throw e;
+		    throw new libVES.Error('InvalidValue','Error generating ECIES DH cipher',{error:e});
+		});
+	    });
+	},
+	eKey: function(pub) {
+	    return crypto.subtle.exportKey('jwk',pub).then(function(kdata) {
+		return crypto.subtle.generateKey({name:'ECDH',namedCurve: kdata.crv},true,['deriveKey','deriveBits']).catch(function(e) {
+		    throw new libVES.Error('InvalidValue','Error generating ECIES ephemeral',{error: e});
+		});
+	    });
+	},
+	cipher: function(priv,pub) {
+	    return libVES.getModule(libVES.Cipher,'AES256GCMp').then(function(m) {
+		return Promise.resolve(libVES.Algo.ECDH.curveBytes[pub.algorithm.namedCurve] || crypto.subtle.exportKey('jwk',pub).then(function(jwk) {
+		    return jwk.x.length * 3 / 4;
+		})).then(function(len) {
+		    return crypto.subtle.deriveBits({name:'ECDH',public:pub},priv,8 * len).then(function(raw) {
+			return crypto.subtle.digest({name:'SHA-384'},raw).then(function(buf) {
+			    return new m(new Uint8Array(buf).slice(0,m.prototype.keySize + m.prototype.ivSize));
+			});
+		    });
+		});
+	    });
+	},
+	curveBytes: {
+	    'P-256': 32,
+	    'P-384': 48,
+	    'P-521': 66
 	},
 	import: function(data,optns) {
 	    return libVES.Util.PEM.import(data,optns);
 	},
 	export: function(data,optns) {
 	    if (data instanceof CryptoKey) switch (data.type) {
-		case 'private':
-		    var ops = {};
-		    for (var k in optns) ops[k] = optns[k];
-		    if (!ops.members) ops.members = [
-			libVES.getModule(libVES.Util,'PBKDF2'),
-			libVES.getModule(libVES.Cipher,'AES256CBC')
-		    ];
-		    return Promise.all(ops.members).then(function(ms) {
-			ops.members = ms;
-			return crypto.subtle.exportKey('pkcs8',data).then(function(der) {
-			    ops.content = der;
-			    var rec = [];
-			    if (ops.password) return libVES.Util.PKCS5.export(function(call,optns) {
-				rec[1] = optns.content;
-				return Promise.resolve();
-			    },ops).then(function(data) {
-				rec[0] = data;
-				return libVES.Util.PEM.encode(libVES.Util.ASN1.encode([rec]),'ENCRYPTED PRIVATE KEY');
-			    });
-			    else if (ops.opentext) return crypto.subtle.exportKey('pkcs8',data).then(function(der) {
-				return libVES.Util.PEM.encode(der,'PRIVATE KEY');
-			    });
-			    else throw libVES.Error('Internal','No password for key export (opentext=true to export without password?)');
-			});
-		    });
+		case 'private': return libVES.Util.PKCS8.encode(data, optns);
 		case 'public':
-		    return crypto.subtle.exportKey('spki',data).then(function(der) {
-			return libVES.Util.PEM.encode(der,'PUBLIC KEY');
+		    return crypto.subtle.exportKey('spki', data).then(function(der) {
+			var asn = libVES.Util.ASN1.decode(new Uint8Array(der))[0];
+			console.log(asn);
+			switch (String(asn[0][0])) {
+			    case '1.2.840.10045.2.1':
+				return der;
+			    case '1.3.132.1.12':
+			    case '1.3.132.112': // Firefox on Mac - apparently a misspelling of the former
+				asn[0][0] = new libVES.Util.OID('1.2.840.10045.2.1');
+				asn[1].ASN1type = 3;
+				return libVES.Util.ASN1.encode([asn]);
+			    default:
+				console.log(asn);
+				throw new libVES.Error('Internal', 'Unexpected EC pubkey format');
+			}
+			return der;
+		    }).then(function(der) {
+			return libVES.Util.PEM.encode(der, 'PUBLIC KEY');
 		    });
 	    }
+	    throw new libVES.Error('Internal', "Unknown type of key object");
+	},
+	generate: function(optns) {
+	    var op = {name:'ECDH', namedCurve:'P-384'};
+	    if (optns) for (var k in optns) op[k] = optns[k];
+	    return crypto.subtle.generateKey(op,true,['deriveKey','deriveBits']);
+	},
+	getPublic: function(priv) {
+	    return crypto.subtle.exportKey('jwk',priv).then(function(k) {
+		return crypto.subtle.importKey('jwk',{
+		    crv: k.crv,
+		    ext: true,
+		    key_ops: [],
+		    kty: 'EC',
+		    x: k.x,
+		    y: k.y
+		},{name:'ECDH'},true,[]);
+	    });
+	}
+    },
+    RSA: {
+	tag: 'RSA',
+	decrypt: function(k,buf) {
+	    var self = libVES.Algo.RSA;
+	    var maxl = (k.algorithm.modulusLength + 7) >> 3;
+	    if (buf.byteLength <= maxl) return self.decryptRSA(k,buf);
+	    var b = new Uint8Array(buf);
+	    return self.decryptRSA(k,b.slice(0,maxl)).then(function(ck) {
+		return self.cipher(ck).then(function(ci) {
+		    return ci.decrypt(b.slice(maxl),true);
+		});
+	    });
+	},
+	decryptRSA: function(k,buf) {
+	    return crypto.subtle.decrypt('RSA-OAEP',k,buf).catch(function(e) {
+		throw new libVES.Error('InvalidValue','Error decrypting RSA OAEP: Invalid ciphertext?',{error:e});
+	    });
+	},
+	encrypt: function(k,buf) {
+	    var self = libVES.Algo.RSA;
+	    var maxl = ((k.algorithm.modulusLength + 7) >> 3) - 48;
+	    if (buf.byteLength <= maxl) return self.encryptRSA(k,buf);
+	    return self.cipher().then(function(ci) {
+		return Promise.all([
+		    ci.getSecret().then(function(sk) {
+			return self.encryptRSA(k,sk);
+		    }),
+		    ci.encrypt(buf,true)
+		]).then(function(bufs) {
+		    var rs = new Uint8Array(bufs[0].byteLength + bufs[1].byteLength);
+		    rs.set(new Uint8Array(bufs[0]),0);
+		    rs.set(new Uint8Array(bufs[1]),bufs[0].byteLength);
+		    return rs;
+		});
+	    });
+	},
+	encryptRSA: function(k,buf) {
+	    return crypto.subtle.encrypt('RSA-OAEP',k,buf).catch(function(e) {
+		throw new libVES.Error('InvalidValue','Error encrypting RSA OAEP: Buffer is too long?',{error:e});
+	    });;
+	},
+	cipher: function(secret) {
+	    return libVES.getModule(libVES.Cipher,'AES256GCMp').then(function(cls) {
+		return new cls(secret);
+	    });
+	},
+	import: function(data,optns) {
+	    return libVES.Util.PEM.import(data,optns);
+	},
+	export: function(data,optns) {
+	    if (data instanceof CryptoKey) switch (data.type) {
+		case 'private': return libVES.Util.PKCS8.encode(data,optns);
+		case 'public': return libVES.Util.PKCS1.encode(data,optns);
+	    }
 	    throw new libVES.Error('Internal',"Unknown type of key object");
 	},
 	generate: function(optns) {
@@ -2006,7 +2518,6 @@ libVES.Algo = {
 		},{name:'RSA-OAEP',hash:'SHA-1'},true,['encrypt']);
 	    });
 	}
-	
     },
     RSA_PKCS1_15: {
 	tag: 'RSA_PKCS1_15',
@@ -2066,26 +2577,31 @@ libVES.Cipher.prototype = {
 	}
     },
     getSecret: function() {
+	var self = this;
 	var meta = null;
 	if (this.meta) for (var k in this.meta) {
 	    meta = libVES.Util.StringToByteArray(JSON.stringify(this.meta));
 	    break;
 	}
 	var buf = new Uint8Array(this.keySize + this.ivSize + (meta ? meta.byteLength : 0));
-	return Promise.all([this.key,this.IV]).then(function(data) {
-	    return crypto.subtle.exportKey("raw",data[0]).then(function(key) {
-		buf.set(new Uint8Array(key),0);
-		buf.set(new Uint8Array(data[1]),key.byteLength);
-		if (meta) buf.set(meta,key.byteLength + data[1].byteLength);
-		return buf;
-	    });
+	return Promise.all([(this.algo ? this.key.then(function(key) {
+	    return crypto.subtle.exportKey("raw", key);
+	}) : this.key), this.IV]).then(function(data) {
+	    buf.set(new Uint8Array(data[0]), 0);
+	    buf.set(new Uint8Array(data[1]), data[0].byteLength);
+	    if (meta) buf.set(new Uint8Array(meta), data[0].byteLength + data[1].byteLength);
+	    return buf;
 	});
     },
+    getMeta: function() {
+	return {a: this.a};
+    },
     buildKey: function(key) {
 	if (!this.algo) return Promise.resolve(key);
 	return crypto.subtle.importKey('raw',key,this.algo,true,['encrypt','decrypt']);
     },
-    process: function(buf,final,callbk,chunkSize) {
+    process: function(buf,final,callbk,sizefn) {
+	var self = this;
 	buf = new Uint8Array(buf);
 	if (this.processBuf) {
 	    var b = new Uint8Array(buf.byteLength + this.processBuf.byteLength);
@@ -2093,9 +2609,24 @@ libVES.Cipher.prototype = {
 	    b.set(buf,this.processBuf.byteLength);
 	    buf = b;
 	}
-	var p = final ? buf.byteLength : (chunkSize ? Math.floor(buf.byteLength / chunkSize) * chunkSize : 0);
-	this.processBuf = p < buf.byteLength ? buf.slice(p) : null;
-	return p > 0 ? callbk(buf.slice(0,p)) : Promise.resolve(new Uint8Array(0));
+	var over = !final;
+	var fn = function(cprev) {
+	    var chunkSize = sizefn();
+	    if ((!buf.byteLength && over) || (!final && (!chunkSize || buf.byteLength < chunkSize))) {
+		self.processBuf = buf.byteLength ? buf : null;
+		return Promise.resolve(cprev);
+	    }
+	    var cl = (chunkSize && chunkSize < buf.byteLength) ? chunkSize : buf.byteLength;
+	    if (!chunkSize || cl < chunkSize) over = true;
+	    return callbk(buf.slice(0, cl)).then(function(ctext) {
+		buf = buf.slice(cl);
+		var r = new Uint8Array(cprev.byteLength + ctext.byteLength);
+		r.set(cprev, 0);
+		r.set(new Uint8Array(ctext), cprev.byteLength);
+		return r;
+	    }).then(fn);
+	};
+	return fn(new Uint8Array(0));
     },
     encryptChunk: function(buf) {
 	return Promise.all([this.key,this.algoInfo()]).then(function(info) {
@@ -2111,37 +2642,60 @@ libVES.Cipher.prototype = {
 	return Promise.resolve(this.algo);
     },
     encrypt: function(buf,final) {
-	return this.process(buf,final,this.encryptChunk.bind(this),this.chunkSizeP);
+	return this.process(buf,final,this.encryptChunk.bind(this),(function() { return this.chunkSizeP; }).bind(this));
     },
     decrypt: function(buf,final) {
-	return this.process(buf,final,this.decryptChunk.bind(this),this.chunkSizeC);
+	return this.process(buf,final,this.decryptChunk.bind(this),(function() { return this.chunkSizeC; }).bind(this));
     }
 };
 
-libVES.Cipher.AES256 = function(rec) {
+libVES.Cipher.NULL = function(rec) {
     this.init(rec);
+}
+
+libVES.Cipher.AES = function(data) {
+    for (var k in data) this[k] = data[k];
 };
 
 libVES.Cipher.AES256CBC = function(rec) {
     this.init(rec);
 };
 
-libVES.Cipher.AES256.prototype = new libVES.Cipher({
-    keySize: 32,
-    ivSize: 32
+libVES.Cipher.AES256GCM = function(rec) {
+    this.init(rec);
+};
+
+libVES.Cipher.AES256GCMp = function(rec) {
+    this.init(rec);
+};
+
+libVES.Cipher.AES256GCM1K = function(rec) {
+    this.init(rec);
+};
+
+libVES.Cipher.NULL.prototype = new libVES.Cipher({
+    a: 'NULL',
+    keySize: 0,
+    ivSize: 0
 });
 
-libVES.Cipher.AES256CBC.prototype = new libVES.Cipher({
-    algo: 'AES-CBC',
+libVES.Cipher.AES.prototype = new libVES.Cipher({
     keySize: 32,
-    ivSize: 16,
+    ivSize: 32,
     algoInfo: function() {
+	var self = this;
 	return this.IV.then(function(iv) {
-	    return {name: 'AES-CBC', iv: iv};
+	    return {name: self.algo, iv: iv};
 	});
     }
 });
 
+libVES.Cipher.AES256CBC.prototype = new libVES.Cipher.AES({
+    algo: 'AES-CBC',
+    keySize: 32,
+    ivSize: 16
+});
+
 libVES.Cipher.AES256CBC.import = function(args,chain,optns) {
     return chain('import').then(function(buf) {
 	return crypto.subtle.decrypt({name: 'AES-CBC', iv: args},optns.key,buf);
@@ -2160,6 +2714,88 @@ libVES.Cipher.AES256CBC.info = function(chain,optns) {
     return Promise.resolve({algorithm: {name: 'AES-CBC', length: 256}});
 };
 
+libVES.Cipher.AES256GCM.prototype = new libVES.Cipher.AES({
+    algo: 'AES-GCM',
+    keySize: 32,
+    ivSize: 12
+});
+
+libVES.Cipher.AES256GCMp.prototype = new libVES.Cipher.AES({
+    algo: 'AES-GCM',
+    keySize: 32,
+    ivSize: 12,
+    padSize: 32,
+    encryptChunk: function(buf0) {
+	var buf = new Uint8Array(buf0);
+	var pad = this.padSize - (buf.byteLength % this.padSize) - 1;
+	var bufp = new Uint8Array(buf.byteLength + pad + 1);
+	bufp[0] = pad;
+	bufp.set(buf,1);
+	return libVES.Cipher.prototype.encryptChunk.call(this,bufp);
+    },
+    decryptChunk: function(buf) {
+	return libVES.Cipher.prototype.decryptChunk.call(this,buf).then(function(bufp0) {
+	    var bufp = new Uint8Array(bufp0);
+	    return bufp.slice(1,bufp.byteLength - bufp[0]);
+	});
+    }
+});
+
+libVES.Cipher.AES256GCM1K.prototype = new libVES.Cipher.AES({
+    algo: 'AES-GCM',
+    keySize: 32,
+    ivSize: 12,
+    chunkSizeP: 1024,
+    chunkSizeC: 16,
+    algoInfo: function() {
+	var self = this;
+	if (!this.lastGCM) throw new libVES.Error('Internal', 'GCM HMAC is not buffered');
+	return this.IV.then(function(iv) {
+	    var buf = new Uint8Array(iv.byteLength + self.lastGCM.byteLength);
+	    buf.set(new Uint8Array(iv), 0);
+	    buf.set(new Uint8Array(self.lastGCM), iv.byteLength);
+	    return libVES.Util.Hash.SHA256.hash(buf).then(function(sha) {
+		return { name: self.algo, iv: sha.slice(0, self.ivSize) };
+	    });
+	});
+    },
+    encryptChunk: function(buf) {
+	var self = this;
+	var seed = null;
+	if (!this.lastGCM) {
+	    seed = new Uint8Array(16);
+	    crypto.getRandomValues(seed);
+	    this.lastGCM = seed;
+	}
+	return Promise.all([this.key, this.algoInfo()]).then(function(info) {
+	    return crypto.subtle.encrypt(info[1], info[0], buf).then(function(ctext) {
+		self.lastGCM = new Uint8Array(ctext.slice(-16));
+		if (!seed) return ctext;
+		var rs = new Uint8Array(seed.byteLength + ctext.byteLength);
+		rs.set(seed, 0);
+		rs.set(new Uint8Array(ctext), seed.byteLength);
+		return rs;
+	    });
+	});
+    },
+    decryptChunk: function(buf) {
+	var self = this;
+	if (buf.byteLength < 16) throw new libVES.Error('Crypto', 'Invalid ciphertext block size');
+	var rs;
+	if (this.lastGCM) {
+	    rs = Promise.all([this.key, this.algoInfo()]).then(function(info) {
+		self.lastGCM = buf.slice(-16);
+		return crypto.subtle.decrypt(info[1], info[0], buf);
+	    });
+	} else {
+	    rs = Promise.resolve(new Uint8Array(0));
+	    this.chunkSizeC = 1040;
+	    this.lastGCM = buf;
+	}
+	return rs;
+    }
+});
+
 libVES.Scramble = {
     RDX: function(x) {
 	this.size = x;
@@ -2230,17 +2866,23 @@ libVES.Scramble.RDX.prototype = {
     scramble: function(vec,b) {
 	return libVES.Math.mulv(vec,this.getCv(b));
     },
-    explode: function(sc,ct) {
+    explode: function(sc,ct,optns) {
 	var self = this;
 	return this.toVector(sc).then(function(v) {
 	    var bs = self.getBases(ct);
 	    var rs = [];
 	    for (i = 0; i < bs.length; i++) rs[i] = {
-		meta: {
+		meta: (function(m) {
+		    if (optns) {
+			if (optns.t != null) m.t = optns.t;
+			if (optns.shadow) for (var k in optns.shadow) m[k] = optns.shadow[k];
+		    }
+		    return m;
+		})({
 		    v: self.tag,
 		    n: self.size,
 		    b: bs[i]
-		},
+		}),
 		value: self.scramble(v,bs[i])
 	    }
 	    return rs;
@@ -2305,8 +2947,9 @@ libVES.Scramble.algo = {
     'RDX1.2': libVES.Scramble.RDX
 };
 
-libVES.Recovery = function(vaultKey) {
+libVES.Recovery = function(vaultKey, myItems) {
     this.vaultKey = vaultKey;
+    if (myItems) this.myItems = Promise.resolve(myItems);
 };
 
 libVES.Recovery.prototype = {
@@ -2315,7 +2958,7 @@ libVES.Recovery.prototype = {
 	var self = this;
 	return this.tokens = self.vaultKey.getType().then(function(t) {
 	    switch (t) {
-		case 'shadow': case 'recovery': return self.vaultKey.getField('vaultItems',{
+		case 'shadow': case 'recovery': return (self.myItems ? self.myItems : self.vaultKey.getField('vaultItems',{
 		    id: true,
 		    meta: true,
 		    type: true,
@@ -2326,7 +2969,7 @@ libVES.Recovery.prototype = {
 			    type: true
 			}
 		    }
-		},true).then(function(vis) {
+		},true)).then(function(vis) {
 		    var frnds = {};
 		    var fn = function() {
 			return self.vaultKey.getUser().then(function(my_u) {
@@ -2336,10 +2979,15 @@ libVES.Recovery.prototype = {
 				    return Promise.all([
 					vi.getVaultEntries().then(function(ves) {
 					    return Promise.all(ves.map(function(ve) {
-						return new libVES.VaultKey(ve.vaultKey,self.vaultKey.VES).getUser().then(function(u) {
+						var vk = new libVES.VaultKey(ve.vaultKey,self.vaultKey.VES);
+						return vk.getUser().then(function(u) {
 						    return u.getId().then(function(uid) {
-							if (uid == my_uid) frnd.assisted = true;
-							else {
+							if (uid == my_uid) {
+							    frnd.assisted = true;
+							    return vk.getType().then(function(type) {
+								if (type == 'current') frnd.current = true;
+							    });
+							} else {
 							    frnd.user = u;
 							    frnds[uid] = frnd;
 							}
@@ -2398,10 +3046,10 @@ libVES.Recovery.prototype = {
 	    return Promise.all(tkns.map(function(v,i) {
 		return v.user.getId();
 	    })).then(function(uids) {
-			return user.getId().then(function(uid) {
-				for (var i = 0; i < uids.length; i++) if (uids[i] == uid) return tkns[i];
-				throw new libVES.Error('InvalidValue','Not a friend: ' + uid);
-			});
+		return user.getId().then(function(uid) {
+		    for (var i = 0; i < uids.length; i++) if (uids[i] == uid) return tkns[i];
+		    throw new libVES.Error('InvalidValue','Not a friend: ' + uid);
+		});
 	    });
 	});
     },
@@ -2424,22 +3072,11 @@ libVES.Recovery.prototype = {
     getFriendsAssisted: function() {
 	var self = this;
 	return this.getTokens().then(function(tkns) {
-	    return Promise.all(tkns.map(function(v,i) {
-		return v.vaultItem.getVaultEntries().then(function() {
-		    return v.vaultEntryByKey;
-		});
-	    })).then(function(ves) {
-		return self.vaultKey.getUser().then(function(user) {
-		    return user.getCurrentVaultKey().then(function(vk) {
-			return vk.getId().then(function(vkid) {
-			    var rs = 0;
-			    for (var i = 0; i < ves.length; i++) if (ves[i]) if(ves[i][vkid]) rs++;
-			    return rs;
-			});
-		    });
-		});
+	    var a = 0;
+	    tkns.map(function(t, i) {
+		if (t.assisted) a++;
 	    });
-	    return tkns[0].meta.n;
+	    return a;
 	});
     },
     getFriendsToGo: function() {
@@ -2464,7 +3101,10 @@ libVES.Recovery.prototype = {
 	});
     },
     assist: function() {
-	return this._assist(true);
+	var self = this;
+	return self.vaultKey.getType().then(function(t) {
+	    return t == 'recovery' ? self._assist(true) : null;
+	});
     },
     revoke: function() {
 	return this._assist(false);
@@ -2484,7 +3124,9 @@ libVES.Recovery.prototype = {
     _recover: function() {
 	var self = this;
 	return self.unlock().then(function() {
-	    return self.vaultKey.rekey();
+	    return self.vaultKey.VES.elevateAuth({authVaultKey: self.vaultKey}).then(function(optns) {
+		return self.vaultKey.rekey(optns);
+	    });
 	});
     },
     recover: function() {
@@ -2500,11 +3142,14 @@ libVES.Delegate = {
     html: '<div style="position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,0.5);display:table;z-index:200000;">'
 	+ '<div style="display:table-row;"><div style="display:table-cell;vertical-align:middle;text-align:center;">'
 	+ '<div style="min-width:320px;max-width:640px;;background-color:white;margin: auto;padding: 30px;">'
-	+ '<p>Use the VESvault popup window to grant access to the App Vault</p>'
-	+ '<p class="VESvaultDelegateBlockerMsg" style="color: #bf7f00; font-style:italic;">&nbsp;</p>'
-	+ '<p><a class="VESvaultDelegateRetryLnk" href="{$url}" target="VESvaultDelegate" onclick="return !libVES.Delegate.retryPopup(this.href,this)">Click here</a> if you can\'t see VESvault popup window</p>'
-	+ '<p><a class="VESvaultDelegateCancelLnk" href="#" onclick="libVES.Delegate.cancel(); return false;">Cancel</a></p>'
+	+ '{$content}'
 	+ '</div></div></div></div>',
+    htmlDlg: '<p>Use the VESvault popup window to grant access to the App Vault</p>'
+	   + '<p class="VESvaultDelegateBlockerMsg" style="color: #bf7f00; font-style:italic;">&nbsp;</p>'
+	   + '<p><a class="VESvaultDelegateRetryLnk" href="{$url}" target="VESvaultDelegate" onclick="return !libVES.Delegate.retryPopup(this.href,this)">Click here</a> if you can\'t see VESvault popup window</p>'
+	   + '<p><a class="VESvaultDelegateCancelLnk" href="#" onclick="libVES.Delegate.cancel(); return false;">Cancel</a></p>',
+    htmlFlw: '<p>Authorizing VES Access</p>'
+	   + '<iframe style="width: 100%; height: 48px; border: none;" src="{$url}"></iframe>',
     htmlBlockerMsg: 'Looks like your browser is using a popup blocker...',
     name: 'VESvaultDelegate',
     login: function(VES,challenge,optns) {
@@ -2518,11 +3163,10 @@ libVES.Delegate = {
 	return this.response = new Promise(function(resolve,reject) {
 	    self.reject = reject;
 	    self.resolve = resolve;
-	    var url = VES.wwwUrl + 'session/delegate/' + escape(VES.app) + '/' + escape(VES.domain);
-	    self.matchOrigin = (function(m) { return m ? m[0] : document.location.protocol + '//' + document.location.host; })(url.match(/^(https\:\/\/[^\/\?\#]+)/));
-	    self.popup = document.createElement('DIV');
-	    self.popup.innerHTML = self.html.replace('{$url}',url);
-	    document.getElementsByTagName('BODY')[0].appendChild(self.popup);
+	    var url = VES.wwwUrl + 'vv/unlock?via=delegate&url=' + encodeURIComponent(document.location.href) + '&domain=' + encodeURIComponent(VES.domain);
+	    if (optns) for (var k in optns) if (optns[k] != null) url += '&' + encodeURIComponent(k) + '=' + encodeURIComponent(optns[k]);
+	    self.setOrigin(url);
+	    self.showOverlay(self.htmlDlg.replace('{$url}',url));
 	    self.retryPopupCalled = 0;
 	    try {
 		document.getElementsByClassName('VESvaultDelegateRetryLnk')[0].onclick = function() {
@@ -2545,6 +3189,35 @@ libVES.Delegate = {
 	    self.popupInterval = window.setInterval(self.chkCancel.bind(self),1000);
 	});
     },
+    flow: function(VES, start, optns) {
+	if (this.response) return this.response;
+	this.VES = VES;
+	var self = this;
+	var unlk = VES.wwwUrl + 'vv/unlock';
+	if (start || (!sessionStorage['libVES.flowStarted'] && document.referrer.substr(0, unlk.length).toLowerCase() == unlk.toLowerCase())) {
+	    return self.response = new Promise(function(resolve, reject) {
+		self.reject = reject;
+		self.resolve = resolve;
+		var ifrm = VES.wwwUrl + 'vv/flowin?url=' + encodeURIComponent(document.location.href) + '&domain=' + encodeURIComponent(VES.domain);
+		if (optns) for (var k in optns) if (optns[k] != null) ifrm += '&' + encodeURIComponent(k) + '=' + encodeURIComponent(optns[k]);
+		self.setOrigin(ifrm);
+		window.addEventListener('message',self.listener.bind(self));
+		self.showOverlay(self.htmlFlw.replace('{$url}', ifrm));
+		if (start) delete(sessionStorage['libVES.flowStarted'])
+		else sessionStorage['libVES.flowStarted'] = true;
+	    });
+	} else {
+	    return new Promise(function(){});
+	}
+    },
+    showOverlay: function(cont) {
+	this.popup = document.createElement('DIV');
+	this.popup.innerHTML = this.html.replace('{$content}', cont);
+	document.getElementsByTagName('BODY')[0].appendChild(this.popup);
+    },
+    setOrigin: function(url) {
+	this.matchOrigin = (function(m) { return m ? m[0] : document.location.protocol + '//' + document.location.host; })(url.match(/^(https\:\/\/[^\/\?\#]+)/));
+    },
     openPopup: function(url) {
 	return this.popupWindow = window.open(url,this.name,"width=600,height=600,top=100,left=100");
     },
@@ -2558,30 +3231,13 @@ libVES.Delegate = {
 	return !f && this.openPopup(url);
     },
     listener: function(evnt) {
-	if (this.popupWindow && evnt.origin == this.matchOrigin) try {
+	if (this.popup && evnt.origin == this.matchOrigin) try {
 	    var msg = JSON.parse(evnt.data);
-	    var VES = this.VES;
-	    if (msg.externalId) {
-		VES.externalId = msg.externalId;
-		this.resolve(VES.unlock(msg.VESkey).then(function() {
-		    return VES;
-		}));
-	    } else if (msg.token) {
-		VES.token = msg.token;
-		this.resolve(VES.getSecondaryKey({domain:VES.domain},true).then(function(vaultKey) {
-		    return vaultKey.getExternals().then(function(externals) {
-			return Promise.all(externals.map(function(ext,i) {
-			    return ext.getDomain();
-			})).then(function(domains) {
-			    for (var i = 0; i < domains.length; i++) if (domains[i] == VES.domain) return externals[i].getExternalId();
-			    throw new libVES.Error('Internal','No external id found for newly created secondary key');
-			}).then(function(extId) {
-			    VES.externalId = extId;
-			    return VES;
-			});
-		    });
-		}));
-	    } else return;
+	    if (msg.redirect) {
+		document.location.replace(msg.redirect);
+	    } else {
+		this.resolve(this.VES.authorize(msg));
+	    }
 	    this.close();
 	    if (!evnt.source.closed) evnt.source.close();
 	} catch(e) {}
@@ -2598,7 +3254,7 @@ libVES.Delegate = {
 	    this.popupInterval = null;
 	    this.popup.parentNode.removeChild(this.popup);
 	    this.popup = null;
-	    return self.response;
+	    return this.response;
 	}
     },
     cancel: function() {
@@ -2611,4 +3267,255 @@ libVES.Delegate = {
     }
 };
 
+
+libVES.Flow = function(name, optns) {
+    this.name = name;
+    this.origin = document.location.origin;
+    this.url = this.origin + '/VESflow';
+    if (optns) for (var k in optns) this[k] = optns[k];
+    return this;
+};
+
+libVES.Flow.algo = {name: 'ECDH', namedCurve: 'P-256'};
+
+libVES.Flow.keyAlgo = function(jwk) {
+    if (jwk && jwk.kty == 'EC') return {name: 'ECDH', namedCurve: jwk.crv};
+    return null;
+};
+
+libVES.Flow.toOrigin = function(url) {
+    var a = document.createElement('a');
+    a.href = url;
+    return a.origin;
+};
+
+libVES.Flow.jwkPub = function(jwk) {
+    delete(jwk.d);
+    delete(jwk.key_ops);
+    delete(jwk.ext);
+    return jwk;
+};
+
+libVES.Flow.parseToken = function(src, callbk) {
+    src = src.replace(/\#VESflow\.(\w+)=([^\#\&\=]+)/g, function(s, k, v) {
+	var tk;
+	try {
+	    tk = JSON.parse(decodeURIComponent(v));
+	    if (callbk(decodeURIComponent(k), tk)) return '';
+	} catch(e) {
+	    console.log(e);
+	}
+	return s;
+    });
+    return src;
+};
+
+libVES.Flow.logout = function() {
+    for (var k in sessionStorage) if (k.match(/^VESflow\b/)) delete(sessionStorage[k]);
+};
+
+libVES.Flow.prototype.source = function(src) {
+    if (src != null) history.replaceState(null, '', src);
+    return document.location.href;
+};
+
+libVES.Flow.prototype.privKey = function(algo) {
+    if (!algo) algo = libVES.Flow.algo;
+    var a = JSON.stringify(algo);
+    return Promise.resolve(sessionStorage['VESflow' + a]).then(function(k) {
+	if (!k) throw null;
+	return crypto.subtle.importKey('jwk', JSON.parse(k), algo, true, ['deriveBits', 'deriveKey']);
+    }).catch(function(e) {
+	return crypto.subtle.generateKey(algo, true, ['deriveBits', 'deriveKey']).then(function(pair) {
+	    return crypto.subtle.exportKey('jwk', pair.privateKey).then(function(jwk) {
+		sessionStorage['VESflow' + a] = JSON.stringify(jwk);
+		return pair.privateKey;
+	    });
+	});
+    });
+};
+
+libVES.Flow.prototype.pubJWK = function(org) {
+    return ((!org || org == this.origin) ? this.privKey().then(function(priv) {
+	return crypto.subtle.exportKey('jwk', priv).then(function(jwk) {
+	    return libVES.Flow.jwkPub(jwk);
+	});
+    }) : Promise.resolve(sessionStorage['VESflow|' + org]).then(function(k) {
+	if (!k) throw {code: 'NotFound', message: 'No public key stored for ' + org};
+	return JSON.parse(k);
+    }));
+};
+
+libVES.Flow.prototype.pubKey = function(org) {
+    return this.pubJWK(org).then(function(jwk) {
+	return crypto.subtle.importKey('jwk', jwk, libVES.Flow.keyAlgo(jwk), true, []);
+    });
+};
+
+libVES.Flow.prototype.cipher = function(url) {
+    var self = this;
+    return self.pubKey(libVES.Flow.toOrigin(url)).then(function(pub) {
+	return self.privKey(pub.algorithm).then(function(priv) {
+	    return crypto.subtle.deriveBits({name: 'ECDH', public: pub}, priv, 8 * libVES.Algo.ECDH.curveBytes[pub.algorithm.namedCurve]);
+	});
+    }).then(function(raw) {
+	return crypto.subtle.digest({name: 'SHA-256'}, raw).then(function(buf) {
+	    return crypto.subtle.importKey('raw', buf, 'AES-GCM', false, ['encrypt', 'decrypt']);
+	});
+    });
+};
+
+libVES.Flow.prototype.encrypt = function(url, val) {
+    var self = this;
+    return Promise.resolve(val || this.value()).then(function(val) {
+	if (val == null) throw {code: 'NoData', message: 'Empty value'};
+	return self.cipher(url).then(function(ci) {
+	    var iv = new Uint8Array(12);
+	    crypto.getRandomValues(iv);
+	    return crypto.subtle.encrypt({name: 'AES-GCM', iv: iv.buffer}, ci, libVES.Util.StringToByteArray(JSON.stringify(val))).then(function(ctext) {
+		return libVES.Util.ByteArrayToB64W(iv) + '.' + libVES.Util.ByteArrayToB64W(ctext);
+	    });
+	});
+    });
+};
+
+libVES.Flow.prototype.token = function(url) {
+    var self = this;
+    return this.pubJWK().then(function(jwk) {
+	return {url: self.url, key: jwk};
+    }).then(function(tk) {
+	return self.encrypt(url).then(function(ctext) {
+	    tk.enc = ctext;
+	    self.erase(url);
+	    self.sent = true;
+	    return tk;
+	}).catch(function(e) {
+	    self.store(url).catch(function(e) {});
+	    return tk;
+	});
+    });
+};
+
+libVES.Flow.prototype.addToken = function(url) {
+    var self = this;
+    return self.token(url).then(function(tk) {
+	return url + '#VESflow.' + self.name + '=' + encodeURIComponent(JSON.stringify(tk));
+    });
+};
+
+libVES.Flow.prototype.decrypt = function(ctext, url) {
+    var self = this;
+    var c = ctext.split('.');
+    return self.cipher(url).then(function(ci) {
+	return crypto.subtle.decrypt({name: 'AES-GCM', iv: libVES.Util.B64ToByteArray(c[0])}, ci, libVES.Util.B64ToByteArray(c[1])).then(function(ptext) {
+	    return JSON.parse(libVES.Util.ByteArrayToString(ptext));
+	});
+    });
+};
+
+libVES.Flow.prototype.value = function() {
+    var self = this;
+    return Promise.resolve(history.state && history.state['VESflow.' + self.name]).then(function(ctext) {
+	return self.decrypt(ctext);
+    });
+};
+
+libVES.Flow.prototype.setValue = function(val) {
+    var self = this;
+    return Promise.resolve(val? self.encrypt(null, val) : null).then(function(ctext) {
+	var s = {};
+	if (history.state) for (var k in history.state) s[k] = history.state[k];
+	if (ctext) s['VESflow.' + self.name] = ctext;
+	else delete(s['VESflow.' + self.name]);
+	history.replaceState(s, '');
+	return val;
+    });
+};
+
+libVES.Flow.prototype.click = function(a) {
+    var self = this;
+    (a.origin == this.origin ? self.store() : self.addToken(a.href).then(function(url) {
+	a.href = url;
+    })).then(function() {
+	document.location.href = a.href;
+    });
+    return false;
+};
+
+libVES.Flow.prototype.reload = function(e) {
+    if (!this.sent) this.store().catch(function(e) {});
+};
+
+libVES.Flow.prototype.recv = function(dval) {
+    var self = this;
+    return Promise.resolve(self.source()).then(function(src) {
+	var tk = null;
+	src = libVES.Flow.parseToken(src, function(k, t) {
+	    if (k != self.name) return false;
+	    tk = t;
+	    return true;
+	});
+	if (tk == null) throw {code: 'NotFound', message: 'No valid token in the source url'};
+	return Promise.resolve(self.source(src)).then(function() {
+	    if (dval) for (var k in dval) if (tk[k] === undefined) tk[k] = dval[k];
+	    return self.recvToken(tk);
+	});
+    });
+};
+
+libVES.Flow.prototype.recvToken = function(tk) {
+    var org = libVES.Flow.toOrigin(tk.url);
+    if (org != this.origin && tk.key) sessionStorage['VESflow|' + org] = JSON.stringify(tk.key);
+    if (!tk.enc) return Promise.reject({url: tk.url, code: 'Incomplete', message: 'Missing encrypted data'});
+    return this.decrypt(tk.enc, org);
+};
+
+libVES.Flow.prototype.get = function() {
+    var self = this;
+    return self.fetch().catch(function(e) {
+	if (!e || e.code != 'NotFound') console.log(e);
+	return null;
+    }).then(function(data) {
+	return self.recv().catch(function(e) {
+	    if (e && e.code == 'Incomplete') {
+		self.url = document.location.href;
+		return self.addToken(e.url).then(function(url) {
+		    document.location.replace(url);
+		    throw {code: 'Reload', message: 'Completing the key exchange'};
+		});
+	    }
+	    if (!data) throw e;
+	    return data;
+	});
+    });
+};
+
+libVES.Flow.prototype.store = function(url) {
+    if (history.state && history.state['VESflow.' + this.name]) {
+	this.sent = 1;
+	return Promise.resolve(sessionStorage['VESflow.' + this.name + '>' + libVES.Flow.toOrigin(url)] = history.state['VESflow.' + this.name]);
+    }
+    return Promise.reject({code: 'NotFound', message: 'Value is not set'});
+};
+
+libVES.Flow.prototype.fetch = function(url) {
+    var self = this;
+    return Promise.resolve(sessionStorage['VESflow.' + self.name + '>' + libVES.Flow.toOrigin(url)]).then(function(ctext) {
+	if (!ctext) throw {code: 'NotFound', message: 'Not in the session storage'};
+	return self.decrypt(ctext).then(function(data) {
+	    self.erase(url);
+	    return data;
+	});
+    });
+};
+
+libVES.Flow.prototype.erase = function(url) {
+    delete(sessionStorage['VESflow.' + this.name + '>' + libVES.Flow.toOrigin(url)]);
+};
+
+libVES.Flow.prototype.logout = function() {
+    this.setValue(undefined);
+    return libVES.Flow.logout();
+};
+
 module.exports = libVES;