Jason Tudisco
79e7e9536b
Crypto / protocol
- v4 envelope: X25519 + ML-KEM-768 hybrid (PQXDH-style HKDF over both
secrets). Heartbeats now carry an ML-KEM key; senders emit v4 whenever
the peer's heartbeat has one, v3 otherwise. Adds @noble/post-quantum.
- Heartbeats are signed by the KEZ identity and verified against the
recipient's primary before use. Previously a spoofed nostr pubkey
(from a re-wrapped replayed envelope) let an attacker substitute their
own heartbeat and read messages.
- Heartbeat retention counts from supersession, never deletes the
newest key, and GC runs after rotation — returning after a long
offline stretch no longer destroys the key the backlog needs.
- Verified-heartbeat cache per peer: 5-min TTL (one lookup per file
instead of per chunk) and anti-downgrade to identity ECDH.
- Always republish heartbeat on session start; rotate on the poll timer;
atomic IDB updates; wipe heartbeats on "Forget this account".
- Dedupe inbound envelopes by sender_sig (replays / re-broadcasts).
Server
- Proxy /v1/sigchains/* to the internal sig-server and hand out the
public https://<server>/v1/sigchains/... URL. Sigchain sync from the
app was failing ("Load failed") against http://sig-server:7878.
App
- Relay settings apply to profile / NIP-65 publishing (republished on
change); wss-only relays (ws:// for localhost); order-aware defaults.
- Clear chat also deletes attachments; retention changes apply
immediately with a warning when shortening.
- Photos: HEIC -> JPEG and downscale to 2048px (iOS canvas limit, strips
EXIF); snapshot the conversation at send time.
- Overlay a11y/Escape fixes, scroll-pin fix, svelte-check to 0 errors.
- Clear chat, image zoom, file-body fallback rendering, NIP-65 read
relays in publish set, relay settings UI, forward-secrecy settings.
Docs
- README rewritten to explain the whole app; SECURITY.md updated for v4;
heartbeat self-check (src/lib/heartbeat.selfcheck.ts).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.1 KiB
JSON
42 lines
1.1 KiB
JSON
{
|
|
"name": "kez-chat-web",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build",
|
|
"preview": "vite preview",
|
|
"check": "svelte-check --tsconfig ./tsconfig.json"
|
|
},
|
|
"dependencies": {
|
|
"@bokuweb/zstd-wasm": "^0.0.22",
|
|
"@noble/curves": "^1.6.0",
|
|
"@noble/hashes": "^1.5.0",
|
|
"@noble/post-quantum": "^0.7.1",
|
|
"@scure/base": "^1.1.9",
|
|
"@scure/bip39": "^2.2.0",
|
|
"canonicalize": "^2.0.0",
|
|
"emoji-picker-element": "^1.29.1",
|
|
"idb-keyval": "^6.2.1",
|
|
"nostr-tools": "^2.23.5",
|
|
"svelte-spa-router": "^4.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@sveltejs/vite-plugin-svelte": "^4.0.0",
|
|
"@tailwindcss/vite": "^4.0.0",
|
|
"@tsconfig/svelte": "^5.0.0",
|
|
"@types/node": "^22.0.0",
|
|
"@vite-pwa/assets-generator": "^1.0.2",
|
|
"svelte": "^5.0.0",
|
|
"svelte-check": "^4.0.0",
|
|
"tailwindcss": "^4.0.0",
|
|
"typescript": "^5.6.0",
|
|
"vite": "^5.4.0",
|
|
"vite-plugin-pwa": "^1.3.0",
|
|
"workbox-precaching": "^7.4.1",
|
|
"workbox-routing": "^7.4.1",
|
|
"workbox-strategies": "^7.4.1"
|
|
}
|
|
}
|