mnemo-engine 0.5.1__tar.gz → 0.5.2__tar.gz

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mnemo-engine
-Version: 0.5.1
+Version: 0.5.2
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: 3
 Classifier: License :: OSI Approved :: Apache Software License

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo/Cargo.lock

@@ -610,7 +610,7 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "mnemo-engine"
-version = "0.5.1"
+version = "0.5.2"
 dependencies = [
  "aes-gcm",
  "argon2",
@@ -634,7 +634,7 @@ dependencies = [
 
 [[package]]
 name = "mnemo-node"
-version = "0.5.1"
+version = "0.5.2"
 dependencies = [
  "mnemo-engine",
  "napi",

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo/Cargo.toml

@@ -6,7 +6,7 @@
 # below stay `mnemo`, so consumers still write `use mnemo::...` and invoke
 # `mnemo` on the command line after `cargo add mnemo-engine`.
 name = "mnemo-engine"
-version = "0.5.1"
+version = "0.5.2"
 edition = "2021"
 rust-version = "1.75"
 # `benches/corpus.rs` is a shared helper module pulled into real benches

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo/README.md

@@ -530,6 +530,26 @@ The v0.2.0 format (v7) closes every "silent stale-data load" path
 flagged in the security review; rollback-replay and availability are
 acknowledged limitations.
 
+**v0.5.2 (SEC-1): AES-GCM nonces are now per-session random.** Up to
+v0.5.1, each page's encryption nonce was `(page_no, write_counter)` —
+unique within a single file, but **shared across copies of a file**
+under the same DEK (the data key never changes after `create`). If you
+had two copies of the same `.mnemo` file and both received writes
+(two laptops syncing through Dropbox and the file "conflict-copies"
+diverge; a restored older backup resuming alongside the current file;
+anything that leads to `cp agent.mnemo backup.mnemo` + writes to both),
+the two copies' writers would produce pages with the same encryption
+nonce under the same key but different plaintexts — breaking AES-GCM
+confidentiality and tamper-evidence. v0.5.2 moves to a random 64-bit
+per-session prefix + 32-bit per-session counter (NIST SP 800-38D
+§8.2.1), drawn fresh on every writable open. Cross-copy collisions
+now require two sessions to independently draw the same 64-bit value
+— astronomically unlikely. **If you ran a pre-v0.5.2 build on diverged
+copies, rotate your DEK by running `compact_file`** — it rewrites the
+file through a fresh `random_dek`, so the prior nonce reuse under the
+old key stops mattering for the rewritten pages. No format change;
+existing files open on v0.5.2 unchanged.
+
 ## Quick start (library)
 
 ```rust

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo/src/crypto.rs

@@ -166,13 +166,61 @@ pub fn random_nonce() -> [u8; NONCE_LEN] {
     n
 }
 
-/// Build a deterministic, unique page nonce from a page number and the
-/// monotonic write counter. `(page, counter)` never repeats, so neither does
-/// the nonce — the central safety property of the encryption scheme.
-pub fn page_nonce(page_no: u64, write_counter: u64) -> [u8; NONCE_LEN] {
+/// Generate a random `u64`, used by the pager to pick a per-session
+/// nonce prefix. See [`session_page_nonce`] for the full construction.
+pub fn random_u64() -> u64 {
+    use rand::RngCore;
+    rand::thread_rng().next_u64()
+}
+
+/// Build a per-session page nonce (PR SEC-1, v0.5.2).
+///
+/// Structure, following NIST SP 800-38D §8.2.1 (fixed field + invocation
+/// field) for AES-GCM:
+///
+/// - **Bytes 0..8** — `session_random`: a 64-bit random value drawn
+///   fresh on every writable [`crate::Mnemo::open`] / [`crate::Mnemo::create`]
+///   (and regenerated on counter wrap). This is the "fixed field".
+/// - **Bytes 8..12** — `session_counter`: a 32-bit per-session monotonic
+///   counter that advances once per encrypted page write. This is the
+///   "invocation field".
+///
+/// `page_no` is **not** encoded in the nonce. Pages were bound to their
+/// home slot through AAD since v6 (`page_no.to_le_bytes()`), so an
+/// attacker who swapped a valid page to a different slot already failed
+/// authentication — the AAD binding stays in place and does the job the
+/// `page_no` component of the pre-SEC-1 nonce was helping with.
+///
+/// # Why not deterministic any more
+///
+/// Before v0.5.2 the nonce was `page_no as u32 || write_counter as u64`,
+/// which was unique **within a file** but not **across copies of a file**.
+/// If you copied a `.mnemo` file to another host and both the original and
+/// the copy got written to (two laptops syncing a Dropbox file; a
+/// restored older backup resuming operation), each copy's writer produced
+/// pages whose nonces collided with the other's at the same `(page_no,
+/// write_counter)` coordinates, under the same DEK (`random_dek()` only
+/// at create; `rekey` keeps it). That breaks AES-GCM's confidentiality
+/// and tamper-evidence guarantee: whoever holds both ciphertexts can
+/// recover the XOR of the plaintexts and forge pages with a valid tag.
+///
+/// A fresh random 64-bit `session_random` per writable open closes that:
+/// cross-copy collision now requires two sessions to independently draw
+/// the same 64-bit value (birthday bound ~2^32 sessions, i.e.
+/// astronomically unlikely for a human-scale user). The 32-bit
+/// `session_counter` guarantees uniqueness *within* a session; the pager
+/// regenerates `session_random` and resets the counter if it would wrap.
+///
+/// # Decrypt is unaffected
+///
+/// Each page already stores its own nonce in bytes `[0..12]` of the
+/// on-disk image (see `mnemo/src/pager.rs::read_page`). Decrypt reads the
+/// stored nonce; it never recomputes one. **No format bump — a v0.5.1
+/// file opens fine on v0.5.2 and vice versa.**
+pub fn session_page_nonce(session_random: u64, session_counter: u32) -> [u8; NONCE_LEN] {
     let mut n = [0u8; NONCE_LEN];
-    n[0..4].copy_from_slice(&(page_no as u32).to_le_bytes());
-    n[4..12].copy_from_slice(&write_counter.to_le_bytes());
+    n[0..8].copy_from_slice(&session_random.to_le_bytes());
+    n[8..12].copy_from_slice(&session_counter.to_le_bytes());
     n
 }
 

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo/src/pager.rs

@@ -93,8 +93,26 @@ pub const DEFAULT_CACHE_PAGES: usize = 8192;
 pub struct Pager {
     file: File,
     dek: Zeroizing<[u8; KEY_LEN]>,
-    /// Monotonic nonce counter. Incremented for every encrypted page write.
+    /// Monotonic write counter persisted in the header (lease / replay
+    /// machinery; see `Mnemo::prepare_for_flush`). **No longer used in
+    /// the page nonce** — SEC-1 (v0.5.2) moved page nonces to a
+    /// per-session random prefix + per-session counter so copies of a
+    /// file can't collide on `(page_no, write_counter)` under the same
+    /// DEK. Still bumped per write for the existing lease machinery.
     pub write_counter: u64,
+    /// Random 64-bit "fixed field" (NIST SP 800-38D §8.2.1) stamped
+    /// into bytes 0..8 of every page nonce this pager produces. Drawn
+    /// fresh on every writable open and regenerated on counter wrap —
+    /// so cross-session nonce collisions require two independent
+    /// sessions to draw the same 64-bit random value (birthday bound
+    /// ~2^32). Unused on read-only handles.
+    session_random: u64,
+    /// Per-session monotonic counter stamped into bytes 8..12 of every
+    /// page nonce. Starts at 0, increments once per encrypted page
+    /// write via [`Pager::next_nonce`]. If about to overflow `u32::MAX`,
+    /// [`Pager::next_nonce`] regenerates `session_random` and resets to 0
+    /// so the (random, counter) pair stays unique within the session.
+    session_counter: u32,
     /// Format version this pager is currently encrypting *for*. `Pager` is
     /// version-aware because the format-bump in v6 changed page encryption
     /// to bind each page's home `page_no` as AAD on AES-GCM, making
@@ -119,11 +137,34 @@ impl Pager {
             file,
             dek,
             write_counter,
+            // Fresh 64-bit random per Pager construction = per writable
+            // open. See SEC-1 doc on `crypto::session_page_nonce`.
+            session_random: crypto::random_u64(),
+            session_counter: 0,
             version,
             cache: PageCache::new(DEFAULT_CACHE_PAGES),
         }
     }
 
+    /// Mint the next page nonce for this session.
+    ///
+    /// Increments `session_counter` and returns
+    /// `session_random || session_counter`. If the counter would overflow
+    /// `u32::MAX`, regenerates `session_random` and resets the counter
+    /// before incrementing — so no `(session_random, session_counter)`
+    /// pair ever repeats within this session.
+    fn next_nonce(&mut self) -> [u8; NONCE_LEN] {
+        if self.session_counter == u32::MAX {
+            // Wrap guard: pick a new 64-bit prefix and reset the counter
+            // so the next write uses `(fresh_random, 1)` instead of
+            // reusing `(old_random, 0)`.
+            self.session_random = crypto::random_u64();
+            self.session_counter = 0;
+        }
+        self.session_counter += 1;
+        crypto::session_page_nonce(self.session_random, self.session_counter)
+    }
+
     /// Switch the pager to a new format version. Used by [`crate::Mnemo::open`]
     /// during a migration that needs to read with the old version's AAD
     /// scheme and write with the new one.
@@ -204,8 +245,11 @@ impl Pager {
         let mut padded = vec![0u8; PAYLOAD];
         padded[..payload.len()].copy_from_slice(payload);
 
+        // Bump the header's lease counter (unchanged — still consumed by
+        // `prepare_for_flush`); mint the actual nonce from the per-session
+        // random + counter pair (SEC-1).
         self.write_counter += 1;
-        let nonce = crypto::page_nonce(page_no, self.write_counter);
+        let nonce = self.next_nonce();
         let aad = self.page_aad(page_no);
         let ciphertext = crypto::aead_encrypt(&self.dek, &nonce, &padded, &aad)?;
 
@@ -288,9 +332,13 @@ impl Pager {
 
     /// Encrypt and write every dirty page, then fsync.
     ///
-    /// Each page gets a fresh nonce from `(page_no, write_counter)`; the
-    /// counter advances per write so a nonce is never reused. Once written,
-    /// pages become clean and the cache is trimmed back to its cap.
+    /// Each page gets a fresh nonce from the per-session random prefix +
+    /// per-session counter (`Pager::next_nonce` → `crypto::session_page_nonce`
+    /// since v0.5.2 / SEC-1). The counter advances per write; the random
+    /// prefix is drawn once per writable open and regenerated on counter
+    /// wrap, so no nonce ever repeats across writes in this session or
+    /// across copies of the file. Once written, pages become clean and
+    /// the cache is trimmed back to its cap.
     pub fn flush(&mut self) -> Result<()> {
         let pages = self.cache.dirty_pages();
         if pages.is_empty() {
@@ -303,7 +351,7 @@ impl Pager {
                 .expect("dirty page must be cached")
                 .to_vec();
             self.write_counter += 1;
-            let nonce = crypto::page_nonce(page_no, self.write_counter);
+            let nonce = self.next_nonce();
             let aad = self.page_aad(page_no);
             let ciphertext = crypto::aead_encrypt(&self.dek, &nonce, &payload, &aad)?;
 

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo/tests/proptest_store.rs

@@ -524,3 +524,122 @@ proptest! {
         );
     }
 }
+
+// --- PR SEC-1: no page-nonce ever repeats within a file ---
+//
+// Fifth property, added for the v0.5.2 security hotfix. Random
+// Remember/Flush/Reopen sequences on one `.mnemo` file; after the run,
+// scan every encrypted page's 12-byte nonce and assert they're all
+// distinct. Together with the targeted "no cross-copy nonce" and "fresh
+// prefix per reopen" integration tests in sec1_nonce_uniqueness.rs,
+// this covers the AES-GCM uniqueness invariant across the engine's
+// actual write surface (not just a hand-rolled sequence).
+
+use std::fs::File;
+use std::io::{Read, Seek, SeekFrom};
+
+const SEC1_PAGE_SIZE: usize = 8192;
+const SEC1_NONCE_LEN: usize = 12;
+
+fn sec1_collect_nonces(path: &Path) -> BTreeSet<[u8; SEC1_NONCE_LEN]> {
+    let mut f = File::open(path).expect("open");
+    let len = f.metadata().expect("stat").len();
+    let page_count = (len / SEC1_PAGE_SIZE as u64) as usize;
+    let mut out = BTreeSet::new();
+    // Skip page 0 (plaintext header).
+    for page_no in 1..page_count {
+        f.seek(SeekFrom::Start((page_no as u64) * SEC1_PAGE_SIZE as u64))
+            .expect("seek");
+        let mut page = [0u8; SEC1_PAGE_SIZE];
+        if f.read_exact(&mut page).is_err() {
+            break;
+        }
+        let mut nonce = [0u8; SEC1_NONCE_LEN];
+        nonce.copy_from_slice(&page[..SEC1_NONCE_LEN]);
+        if nonce != [0u8; SEC1_NONCE_LEN] {
+            out.insert(nonce);
+        }
+    }
+    out
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig {
+        cases: 64,
+        max_shrink_iters: 1024,
+        ..Default::default()
+    })]
+
+    #[test]
+    fn prop_no_page_nonce_repeats_within_file(
+        ops in prop::collection::vec(
+            (
+                prop::collection::vec(any::<u8>(), 1..32), // content bytes
+                any::<bool>(),                              // flush after?
+                any::<bool>(),                              // reopen after?
+            ),
+            1..12,
+        ),
+    ) {
+        let td = TempDir::new().unwrap();
+        let path = td.path().join("prop-sec1.mnemo");
+        let dims = 4;
+        let mut db = Mnemo::create(&path, "pw", MnemoConfig {
+            dimensions: dims,
+            kdf: KdfParams::fast(),
+            ..Default::default()
+        }).unwrap();
+
+        for (i, (content, should_flush, should_reopen)) in ops.iter().enumerate() {
+            // Distinct per-op vector so the engine actually writes a page.
+            let v: Vec<f32> = (0..dims)
+                .map(|k| (i as f32 + k as f32 + 1.0) * 0.17)
+                .collect();
+            db.remember(Memory::new(
+                format!("op-{i}:{}", content.iter().map(|b| *b as u32).sum::<u32>()),
+                MemoryType::Semantic,
+                v,
+            ))
+            .unwrap();
+            if *should_flush || *should_reopen {
+                db.flush().unwrap();
+            }
+            if *should_reopen {
+                db.close().unwrap();
+                drop(db);
+                db = Mnemo::open(&path, "pw").unwrap();
+            }
+        }
+        db.flush().unwrap();
+        db.close().unwrap();
+        drop(db);
+
+        // Count stored (nonce) entries vs scanned pages. BTreeSet
+        // deduplicates — a repeat would make the set shorter than the
+        // page count. We can't know the exact page count up front
+        // (compaction, WAL frames reused for later txns, etc.), so
+        // compare set.len() to the count of non-empty page slots we
+        // actually read.
+        let mut f = File::open(&path).unwrap();
+        let total_pages = (f.metadata().unwrap().len() / SEC1_PAGE_SIZE as u64) as usize;
+        let mut non_empty = 0usize;
+        for page_no in 1..total_pages {
+            f.seek(SeekFrom::Start((page_no as u64) * SEC1_PAGE_SIZE as u64)).unwrap();
+            let mut page = [0u8; SEC1_PAGE_SIZE];
+            if f.read_exact(&mut page).is_err() {
+                break;
+            }
+            let mut nonce = [0u8; SEC1_NONCE_LEN];
+            nonce.copy_from_slice(&page[..SEC1_NONCE_LEN]);
+            if nonce != [0u8; SEC1_NONCE_LEN] {
+                non_empty += 1;
+            }
+        }
+        let unique = sec1_collect_nonces(&path).len();
+        prop_assert_eq!(
+            unique, non_empty,
+            "page-nonce repeat detected: {} unique nonces across {} non-empty pages",
+            unique, non_empty,
+        );
+    }
+}

mnemo_engine-0.5.2/mnemo/tests/sec1_nonce_uniqueness.rs

@@ -0,0 +1,261 @@
+//! PR SEC-1 (v0.5.2): page-nonce uniqueness invariants.
+//!
+//! Before SEC-1, page nonces were `page_no || write_counter` — unique
+//! within a file but **reused across copies of a file**. If you copied
+//! a `.mnemo` file to another host and both the original and the copy
+//! got written to (two laptops syncing a file; a restored older backup
+//! resuming operation), each copy's writer produced pages whose nonces
+//! collided with the other's at the same `(page_no, write_counter)`
+//! coordinates, under the same DEK (`random_dek()` is only called at
+//! create). That breaks AES-GCM confidentiality (XOR of plaintexts
+//! recoverable) and tamper-evidence (GHASH key recoverable → page
+//! forgery possible).
+//!
+//! The fix is a per-session random prefix: every writable open draws
+//! a fresh 64-bit `session_random`, and the nonce becomes
+//! `session_random || session_counter`. Cross-session collisions now
+//! require two sessions to independently draw the same 64-bit random
+//! value (negligible). This file pins the three invariants the planner
+//! asked for:
+//!
+//! 1. **No nonce in both copies.** Fork a file, write to both forks,
+//!    scan every page in both — the raw-nonce sets must be disjoint.
+//! 2. **Nonces differ across reopen sessions.** Open, write, close,
+//!    reopen, write — the two sessions' nonces must not overlap.
+//! 3. **v0.5.1 fixtures still open.** A file produced by the old
+//!    deterministic-nonce code must still decrypt, since decrypt reads
+//!    the stored nonce rather than recomputing one. (Simulated here by
+//!    using the current code to produce a file and reopening it — the
+//!    on-disk schema didn't change in SEC-1, so the equivalence is
+//!    structural, not just empirical.)
+
+use std::collections::HashSet;
+use std::fs;
+use std::io::{Read, Seek, SeekFrom};
+
+use mnemo::{Memory, MemoryType, Mnemo, MnemoConfig};
+use tempfile::TempDir;
+
+const PAGE_SIZE: usize = 8192;
+const NONCE_LEN: usize = 12;
+
+fn fast_cfg(dims: usize) -> MnemoConfig {
+    MnemoConfig {
+        dimensions: dims,
+        kdf: mnemo::KdfParams::fast(),
+        ..Default::default()
+    }
+}
+
+/// WAL frame magic. A page starting with these four bytes is a WAL
+/// frame, not an encrypted data page — its first 12 bytes are
+/// `MAGIC(4) || kind(1) || txn_id(8)...`, not an AES-GCM nonce.
+/// Skipped by [`collect_nonces`] so the test doesn't compare frame
+/// headers across copies (two files recovered from the same state
+/// will naturally share identical frame headers at the same offsets).
+const WAL_FRAME_MAGIC: &[u8; 4] = b"MWAL";
+
+/// Collect every encrypted page's 12-byte nonce from a `.mnemo` file.
+///
+/// Skip:
+/// - Page 0 (plaintext header, not AES-GCM).
+/// - WAL frame slots whose first 4 bytes are `MWAL` — these are
+///   log-frame headers, not nonces. Two files that share WAL frames
+///   (e.g. one is a `cp` of the other) will have identical frame
+///   headers at the same positions; that's structural, not a nonce
+///   reuse.
+/// - All-zero page slots (unwritten space in the WAL region or at
+///   the file tail).
+///
+/// Everything else is a nonce from an AES-GCM encrypted page.
+fn collect_nonces(path: &std::path::Path) -> HashSet<[u8; NONCE_LEN]> {
+    let mut file = fs::File::open(path).expect("open for nonce scan");
+    let len = file.metadata().expect("stat").len();
+    assert!(len >= PAGE_SIZE as u64, "file must have at least one page");
+    let page_count = (len / PAGE_SIZE as u64) as usize;
+
+    let mut out = HashSet::new();
+    for page_no in 1..page_count {
+        file.seek(SeekFrom::Start((page_no as u64) * PAGE_SIZE as u64))
+            .expect("seek");
+        let mut page = [0u8; PAGE_SIZE];
+        if file.read_exact(&mut page).is_err() {
+            break;
+        }
+        if &page[..4] == WAL_FRAME_MAGIC {
+            continue;
+        }
+        let mut nonce = [0u8; NONCE_LEN];
+        nonce.copy_from_slice(&page[..NONCE_LEN]);
+        if nonce != [0u8; NONCE_LEN] {
+            out.insert(nonce);
+        }
+    }
+    out
+}
+
+/// Insert N distinct memories + flush. Caller owns the handle; this
+/// just populates it with pages worth encrypting.
+fn seed(db: &mut Mnemo, start: usize, count: usize) {
+    for i in start..start + count {
+        let v = (0..4).map(|k| (i as f32 + k as f32) * 0.123).collect();
+        db.remember(Memory::new(format!("mem-{i}"), MemoryType::Semantic, v))
+            .expect("remember");
+    }
+    db.flush().expect("flush");
+}
+
+#[test]
+fn sec1_no_nonce_appears_in_both_copies() {
+    // Property: new pages written to two diverged copies of the same
+    // file carry disjoint nonces. This is the exact failure mode SEC-1
+    // fixes — before it, pages at the same (page_no, write_counter)
+    // coordinates would carry byte-identical nonces in both copies
+    // under the same DEK with different plaintexts.
+    //
+    // Nonces present *before* the fork are shared by construction
+    // (byte-for-byte copy of A to B), so the test snapshots those and
+    // only compares nonces introduced *after* the fork — those are the
+    // ones that would collide under the pre-SEC-1 scheme.
+    let td = TempDir::new().unwrap();
+    let a = td.path().join("a.mnemo");
+    let b = td.path().join("b.mnemo");
+
+    // Create A with some initial content, flush, close.
+    {
+        let mut db = Mnemo::create(&a, "pw", fast_cfg(4)).unwrap();
+        seed(&mut db, 0, 10);
+        db.close().unwrap();
+    }
+
+    // Snapshot nonces present in A before the fork; these will be
+    // duplicated in B by construction (same byte content, same stored
+    // nonce). Any nonce in this set is already-shared history, not a
+    // reuse violation.
+    let pre_fork = collect_nonces(&a);
+
+    // Fork: byte-for-byte copy A -> B. Represents a user running `cp`
+    // for backup, a Dropbox sync propagating the file, or a restored
+    // snapshot.
+    fs::copy(&a, &b).expect("fork copy");
+
+    // Writer A: open the original and append new content.
+    {
+        let mut db = Mnemo::open(&a, "pw").unwrap();
+        seed(&mut db, 100, 10);
+        db.close().unwrap();
+    }
+
+    // Writer B: open the copy and append its own, different content.
+    // Pre-SEC-1, A and B would use the same `(page_no, write_counter)`
+    // sequence for their new pages → identical nonces → nonce reuse.
+    {
+        let mut db = Mnemo::open(&b, "pw").unwrap();
+        seed(&mut db, 200, 10);
+        db.close().unwrap();
+    }
+
+    let na_after = collect_nonces(&a);
+    let nb_after = collect_nonces(&b);
+
+    // New nonces introduced in each copy = everything that wasn't in
+    // the pre-fork snapshot. These are the writes we care about.
+    let a_new: HashSet<_> = na_after.difference(&pre_fork).copied().collect();
+    let b_new: HashSet<_> = nb_after.difference(&pre_fork).copied().collect();
+    assert!(!a_new.is_empty(), "A must have written new encrypted pages");
+    assert!(!b_new.is_empty(), "B must have written new encrypted pages");
+
+    let overlap: Vec<_> = a_new.intersection(&b_new).collect();
+    assert!(
+        overlap.is_empty(),
+        "SEC-1 violation: {} nonce(s) reused across post-fork writes to \
+         copies A and B. Overlapping bytes: {:x?}",
+        overlap.len(),
+        overlap,
+    );
+}
+
+#[test]
+fn sec1_nonces_differ_across_reopen_sessions() {
+    // Property: each writable open gets a fresh `session_random`, so
+    // the second session's nonces are disjoint from the first's.
+    // Pre-SEC-1 this held *per file* via the monotonic `write_counter`;
+    // post-SEC-1 the per-session random prefix makes it robust against
+    // cross-copy and cross-restore scenarios too.
+    let td = TempDir::new().unwrap();
+    let path = td.path().join("sessions.mnemo");
+
+    // Session 1.
+    {
+        let mut db = Mnemo::create(&path, "pw", fast_cfg(4)).unwrap();
+        seed(&mut db, 0, 10);
+        db.close().unwrap();
+    }
+    let after_s1 = collect_nonces(&path);
+
+    // Session 2 — fresh open on the same file.
+    {
+        let mut db = Mnemo::open(&path, "pw").unwrap();
+        seed(&mut db, 100, 10);
+        db.close().unwrap();
+    }
+    let after_s2 = collect_nonces(&path);
+
+    // The second session wrote additional pages, so after_s2 should be
+    // a superset of after_s1 (same pages present with same nonces,
+    // plus new ones). What we're asserting here is a specific property
+    // of the new scheme: the pages written in session 2 use nonces
+    // that start with a fresh random prefix — so **no new nonce in
+    // session 2 has the same 8-byte prefix as a nonce from session 1**
+    // (except by the astronomical ~2^-64 birthday chance).
+    let new_in_s2: HashSet<[u8; NONCE_LEN]> = after_s2.difference(&after_s1).copied().collect();
+    assert!(
+        !new_in_s2.is_empty(),
+        "session 2 should have written at least one new page"
+    );
+    let s1_prefixes: HashSet<[u8; 8]> = after_s1
+        .iter()
+        .map(|n| {
+            let mut p = [0u8; 8];
+            p.copy_from_slice(&n[..8]);
+            p
+        })
+        .collect();
+    let s2_prefixes: HashSet<[u8; 8]> = new_in_s2
+        .iter()
+        .map(|n| {
+            let mut p = [0u8; 8];
+            p.copy_from_slice(&n[..8]);
+            p
+        })
+        .collect();
+    let shared: Vec<_> = s1_prefixes.intersection(&s2_prefixes).collect();
+    assert!(
+        shared.is_empty(),
+        "SEC-1 violation: {} session-random prefix(es) shared across \
+         two writable opens of the same file; the second session should \
+         have minted a fresh 64-bit prefix. Shared: {:x?}",
+        shared.len(),
+        shared,
+    );
+}
+
+#[test]
+fn sec1_decrypt_reads_stored_nonce_unchanged_format() {
+    // Property: the on-disk schema is unchanged — each page still
+    // stores its own 12-byte nonce in bytes [0..12] and decrypt reads
+    // it from there. A file produced by the current build must open
+    // and read every memory back correctly after reopen, since that's
+    // the same code path a v0.5.1 file would exercise.
+    let td = TempDir::new().unwrap();
+    let path = td.path().join("roundtrip.mnemo");
+    let want = 20usize;
+
+    {
+        let mut db = Mnemo::create(&path, "pw", fast_cfg(4)).unwrap();
+        seed(&mut db, 0, want);
+        db.close().unwrap();
+    }
+    let mut db = Mnemo::open(&path, "pw").unwrap();
+    assert_eq!(db.memories().unwrap().len(), want);
+}

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo-python/Cargo.lock

@@ -409,7 +409,7 @@ dependencies = [
 
 [[package]]
 name = "mnemo-engine"
-version = "0.5.1"
+version = "0.5.2"
 dependencies = [
  "aes-gcm",
  "argon2",
@@ -430,7 +430,7 @@ dependencies = [
 
 [[package]]
 name = "mnemo-python"
-version = "0.5.1"
+version = "0.5.2"
 dependencies = [
  "mnemo-engine",
  "pyo3",

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/mnemo-python/Cargo.toml

@@ -4,7 +4,7 @@
 # fields below are still useful for `cargo publish --dry-run` to lint
 # cleanly and for `cargo doc` to render coherently.
 name = "mnemo-python"
-version = "0.5.1"
+version = "0.5.2"
 edition = "2021"
 rust-version = "1.75"
 description = "Python (PyO3) bindings for the Mnemo encrypted agent-memory engine; built by maturin into the mnemo-engine wheel on PyPI"

{mnemo_engine-0.5.1 → mnemo_engine-0.5.2}/pyproject.toml

@@ -11,7 +11,7 @@ build-backend = "maturin"
 # Cargo.toml), so user code keeps writing `import mnemo` after
 # `pip install mnemo-engine`.
 name = "mnemo-engine"
-version = "0.5.1"
+version = "0.5.2"
 description = "Encrypted, portable agent-memory engine — Python bindings"
 readme = "README.md"
 requires-python = ">=3.8"