End-to-End Encryption: E2EE foundation with crypto core, message cache, and session management

[G-ELM]

Summary

Implement the foundational E2EE infrastructure for the web client, including device keypair management, local encrypted message caching, prekey generation and management, and session establishment. These changes enable offline message history, secure local storage, and encrypted communication channels.

Changes

• Task 2: Web Crypto Core - Device keypair generation and IndexedDB key store

  • Generate device identity keypair via Web Crypto (P-256 ECDH)
  • Store private key as non-exportable CryptoKey in IndexedDB
  • Generate and persist stable deviceId locally
  • Export public key JWK for registration
  • Clear keys on logout/revocation

• Task 1: Local Encrypted Message Cache - Offline read with encrypted storage

  • Cache decrypted messages in IndexedDB
  • Encrypt at rest using device-local key (derived from identity key via PBKDF2)
  • Support per-conversation message retrieval
  • Clear cache on logout
  • Messages indexed by conversationId and timestamp for efficient queries

• Task 3: Prekey Generation and Replenishment - Key management for session establishment

  • Generate signed prekey (ECDH P-256) signed by identity key
  • Generate and store batch of one-time prekeys (X25519)
  • Persist private prekeys in IndexedDB keyed by keyId
  • Upload prekeys via /crypto/prekeys endpoint after registration
  • Implement prekeys_low handler to trigger replenishment
  • Auto-generate new keys when count drops below threshold
  • Delete one-time prekeys after consumption

• Task 4: Session Establishment - First-contact key exchange and session caching

  • Fetch recipient device bundle from /crypto/bundles endpoint
  • Verify signed prekey signature using identity key (ECDSA P-256)
  • Derive shared secret via X25519 ECDH
  • Cache sessions per recipient device in IndexedDB
  • Abstract SessionProtocol interface for protocol swapping
  • Implement SealedBoxProtocol (AES-GCM) as default transport
  • Support message encryption/decryption per session
  • Auto-consume one-time prekeys after session establishment

Technical Details

• Crypto: Web Crypto API for all cryptographic operations
• Storage: IndexedDB for non-exportable keys and session data
• Encryption: AES-GCM for message cache and sessions; PBKDF2 for key derivation
• Signatures: ECDSA for prekey verification; private keys never leave the browser
• Protocol: Sealed-box style (ECDH + AES-GCM); interface ready for Signal migration

Acceptance Criteria Met

✅ Private key non-exportable, never leaves the browser
✅ Public key + deviceId available for registration
✅ Key store survives reloads; cleared on logout
✅ History available offline after first sync
✅ Local cache encrypted at rest
✅ Cache cleared on logout/revocation
✅ Signed + one-time prekeys uploaded after registration
✅ prekeys_low triggers replenishment
✅ Private prekeys stored locally, consumed once
✅ Signed prekey signature verified before use
✅ Session cached per recipient device
✅ Interface abstracts underlying protocol (sealed-box now, Signal later)

Closes #292
Closes #293
Closes #294
Closes #299

[drips-wave]

@G-ELM Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits