voidlogue-crypto 2.0.2 → 2.0.3

package/README.md

@@ -66,6 +66,8 @@ const codename = generateCodename(4); // e.g. "correct-horse-battery-staple"
 | Method | Description |
 |---|---|
 | `hex(input)` | SHA-256 of input string → 64-char hex |
+| `relationshipHash(emailA, emailB)` | Pure relationship identifier. Commutative. |
+| `isInitiator(myEmail, theirEmail)` | Deterministic tie-breaker for UI deadlocks |
 | `roomId(emailA, emailB, codename)` | Derives opaque room hash. Commutative. |
 | `validateCodename(codename)` | Returns `{ valid, reason? }` |
 | `deriveKey(codename, roomHash)` | PBKDF2 → AES-256-GCM key (non-extractable) |
@@ -138,7 +140,8 @@ console.log(EFF_WORDLIST.length); // 7776
 ```
 Room hash:
   hA, hB   = SHA-256(email.toLowerCase().trim())
-  roomHash = SHA-256(sort([hA,hB]).join(":") + ":" + codename + ":" + APP_SALT)
+  relHash  = SHA-256(sort([hA,hB]).join(":") + ":" + APP_SALT + ":relationship")
+  roomHash = SHA-256(relHash + ":" + codename + ":" + APP_SALT)
 
 Conversation key:
   key = PBKDF2(codename, salt=roomHash, iters=600_000, hash=SHA-256) → AES-256-GCM

package/SECURITY.md

@@ -10,7 +10,7 @@ against the actual code running in the browser.
 
 ### Claim 1: "We cannot read your Conversation messages"
 
-**Code that proves it:** `src/voidshield.ts` — `roomId()`, `deriveKey()`, `encrypt()`
+**Code that proves it:** `src/voidshield.ts` — `relationshipHash()`, `roomId()`, `deriveKey()`, `encrypt()`
 
 Room hashes are derived entirely client-side from the pair of email addresses
 and the shared codename. The algorithm:
@@ -18,7 +18,8 @@ and the shared codename. The algorithm:
 ```
 hA       = SHA-256(emailA.toLowerCase().trim())
 hB       = SHA-256(emailB.toLowerCase().trim())
-roomHash = SHA-256(sort([hA, hB]).join(":") + ":" + codename + ":" + APP_SALT)
+relHash  = SHA-256(sort([hA, hB]).join(":") + ":" + APP_SALT + ":relationship")
+roomHash = SHA-256(relHash + ":" + codename + ":" + APP_SALT)
 ```
 
 The server receives only `roomHash` — an opaque 64-character hex string. It

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "voidlogue-crypto",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Open-source client-side cryptographic primitives for Voidlogue — published for independent audit and verification of privacy claims.",
   "main": "index.js",
   "type": "module",
@@ -45,14 +45,14 @@
     "node": ">=18.0.0"
   },
   "devDependencies": {
-    "@eslint/js": "^8.0.0",
-    "@types/node": "^20.0.0",
-    "eslint": "^8.0.0",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.5.2",
+    "eslint": "^10.2.0",
     "expect": "^30.3.0",
-    "fast-check": "^3.23.2",
+    "fast-check": "^4.6.0",
     "prettier": "^3.0.0",
     "tsx": "^4.21.0",
-    "typescript": "^5.0.0",
+    "typescript": "^6.0.2",
     "typescript-eslint": "^8.58.0"
   },
   "scripts": {

package/src/voidshield.ts

@@ -65,6 +65,8 @@ export interface KyberKeyPair {
 
 export interface VoidShieldAPI {
   hex(input: string): Promise<string>;
+  relationshipHash(emailA: string, emailB: string): Promise<string>;
+  isInitiator(myEmail: string, theirEmail: string): Promise<boolean>;
   roomId(emailA: string, emailB: string, codename: string): Promise<string>;
   validateCodename(codename: string): CodenameValidation;
   deriveKey(codename: string, roomHash: string): Promise<CryptoKey>;
@@ -210,16 +212,27 @@ export const VoidShield: VoidShieldAPI = {
 
   // ── Conversation ─────────────────────────────────────────────────────────
 
+  async relationshipHash(emailA: string, emailB: string): Promise<string> {
+    const [hA, hB] = await Promise.all([
+      this.hex(emailA.toLowerCase().trim()),
+      this.hex(emailB.toLowerCase().trim()),
+    ]);
+    return this.hex(`${[hA, hB].sort().join(':')}:${APP_SALT}:relationship`);
+  },
+
+  async isInitiator(myEmail: string, theirEmail: string): Promise<boolean> {
+    const hashMe = await this.hex(myEmail.toLowerCase().trim());
+    const hashThem = await this.hex(theirEmail.toLowerCase().trim());
+    return hashMe < hashThem;
+  },
+
   async roomId(
     emailA: string,
     emailB: string,
     codename: string
   ): Promise<string> {
-    const [hA, hB] = await Promise.all([
-      this.hex(emailA.toLowerCase().trim()),
-      this.hex(emailB.toLowerCase().trim()),
-    ]);
-    return this.hex(`${[hA, hB].sort().join(':')}:${codename}:${APP_SALT}`);
+    const relHash = await this.relationshipHash(emailA, emailB);
+    return this.hex(`${relHash}:${codename}:${APP_SALT}`);
   },
 
   validateCodename(codename: string): CodenameValidation {