v0.9.0: kotlin 2.2.21, kotlin.time fix for deprecated methods in kotlinx.datetime. Should work ok on mac/ios

added Container.decryptWithPassword
0.8.5: upgrade kotlin & dependencies
2025-12-16 19:13:27 +01:00 · 2025-12-04 12:14:07 +01:00 · 2025-10-24 18:05:25 +02:00 · 2025-03-27 00:17:59 +03:00 · 2025-03-27 00:14:32 +03:00 · 2025-03-26 23:45:31 +03:00
78 changed files with 1073 additions and 294 deletions
@@ -9,6 +9,7 @@ build/
 .idea/jarRepositories.xml
 .idea/compiler.xml
 .idea/libraries/
+.idea
 *.iws
 *.iml
 *.ipr
@@ -1,10 +1,3 @@
 # Default ignored files
 /shelf/
 /workspace.xml
-# Editor-based HTTP Client requests
-/httpRequests/
-# Datasource local storage ignored files
-/dataSources/
-/dataSources.local.xml
-/artifacts/crypto2_js_0_1_0_SNAPSHOT.xml
-/artifacts/crypto2_jvm_0_1_0_SNAPSHOT.xml
@@ -1,6 +0,0 @@
-<component name="ArtifactManager">
-  <artifact type="jar" name="crypto2-js-0.1.1-SNAPSHOT">
-    <output-path>$PROJECT_DIR$/build/libs</output-path>
-    <root id="archive" name="crypto2-js-0.1.1-SNAPSHOT.jar" />
-  </artifact>
-</component>
@@ -1,8 +0,0 @@
-<component name="ArtifactManager">
-  <artifact type="jar" name="crypto2-js-1.0-SNAPSHOT">
-    <output-path>$PROJECT_DIR$/build/libs</output-path>
-    <root id="archive" name="crypto2-js-1.0-SNAPSHOT.jar">
-      <element id="module-output" name="crypto2.jsMain" />
-    </root>
-  </artifact>
-</component>
@@ -1,6 +0,0 @@
-<component name="ArtifactManager">
-  <artifact type="jar" name="crypto2-jvm-0.1.1-SNAPSHOT">
-    <output-path>$PROJECT_DIR$/build/libs</output-path>
-    <root id="archive" name="crypto2-jvm-0.1.1-SNAPSHOT.jar" />
-  </artifact>
-</component>
@@ -1,8 +0,0 @@
-<component name="ArtifactManager">
-  <artifact type="jar" name="crypto2-jvm-1.0-SNAPSHOT">
-    <output-path>$PROJECT_DIR$/build/libs</output-path>
-    <root id="archive" name="crypto2-jvm-1.0-SNAPSHOT.jar">
-      <element id="module-output" name="crypto2.jvmMain" />
-    </root>
-  </artifact>
-</component>
@@ -1,8 +0,0 @@
-<component name="ArtifactManager">
-  <artifact type="jar" name="crypto2-wasm-js-0.1.1-SNAPSHOT">
-    <output-path>$PROJECT_DIR$/build/libs</output-path>
-    <root id="archive" name="crypto2-wasm-js-0.1.1-SNAPSHOT.jar">
-      <element id="module-output" name="crypto2.wasmJsMain" />
-    </root>
-  </artifact>
-</component>
@@ -1,5 +1,29 @@
 <component name="ProjectCodeStyleConfiguration">
  <code_scheme name="Project" version="173">
+    <DBN-PSQL>
+      <case-options enabled="true">
+        <option name="KEYWORD_CASE" value="lower" />
+        <option name="FUNCTION_CASE" value="lower" />
+        <option name="PARAMETER_CASE" value="lower" />
+        <option name="DATATYPE_CASE" value="lower" />
+        <option name="OBJECT_CASE" value="preserve" />
+      </case-options>
+      <formatting-settings enabled="false" />
+    </DBN-PSQL>
+    <DBN-SQL>
+      <case-options enabled="true">
+        <option name="KEYWORD_CASE" value="lower" />
+        <option name="FUNCTION_CASE" value="lower" />
+        <option name="PARAMETER_CASE" value="lower" />
+        <option name="DATATYPE_CASE" value="lower" />
+        <option name="OBJECT_CASE" value="preserve" />
+      </case-options>
+      <formatting-settings enabled="false">
+        <option name="STATEMENT_SPACING" value="one_line" />
+        <option name="CLAUSE_CHOP_DOWN" value="chop_down_if_statement_long" />
+        <option name="ITERATION_ELEMENTS_WRAPPING" value="chop_down_if_not_single" />
+      </formatting-settings>
+    </DBN-SQL>
    <ScalaCodeStyleSettings>
      <option name="MULTILINE_STRING_CLOSING_QUOTES_ON_NEW_LINE" value="true" />
    </ScalaCodeStyleSettings>
@@ -5,6 +5,7 @@
    <option name="linkedExternalProjectsSettings">
      <GradleProjectSettings>
        <option name="externalProjectPath" value="$PROJECT_DIR$" />
+        <option name="gradleHome" value="/usr/local/Cellar/gradle/7.6/libexec" />
        <option name="modules">
          <set>
            <option value="$PROJECT_DIR$" />
@@ -12,5 +13,6 @@
        </option>
      </GradleProjectSettings>
    </option>
+    <option name="parallelModelFetch" value="true" />
  </component>
 </project>
@@ -1,7 +0,0 @@
-<component name="InspectionProjectProfileManager">
-  <profile version="1.0">
-    <option name="myName" value="Project Default" />
-    <inspection_tool class="ReplaceUntilWithRangeUntil" enabled="true" level="WEAK WARNING" enabled_by_default="true" />
-    <inspection_tool class="StructuralWrap" enabled="false" level="TYPO" enabled_by_default="false" />
-  </profile>
-</component>
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="KotlinJpsPluginSettings">
-    <option name="version" value="1.9.20" />
-  </component>
-</project>
@@ -1,9 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
  <component name="ExternalStorageConfigurationManager" enabled="true" />
  <component name="FrameworkDetectionExcludesConfiguration">
    <file type="web" url="file://$PROJECT_DIR$" />
  </component>
-  <component name="ProjectRootManager" version="2" languageLevel="JDK_17" default="true" project-jdk-name="17 (5)" project-jdk-type="JavaSDK">
+  <component name="ProjectRootManager" version="2" languageLevel="JDK_21" project-jdk-name="corretto-17" project-jdk-type="JavaSDK">
    <output url="file://$PROJECT_DIR$/out" />
  </component>
 </project>
@@ -2,6 +2,16 @@

 Kotlin Multiplatform cryptographic primitives using modern strong cryptography.

+## v0.9.0 for kotlin 2.2.21, new kotlin time compatible
+
+The primary goal was to fix kotlin-caused incompatibilities with kotlinx.datetime.Instant and Clock; the upgrade shoud be in-place 
+replacement providing calling code ises `kotlin.time.Instant` and
+`kotlin.time.Clock` respectively. No other changes are needed.
+
+Also we start to add small syntax sugar methods.
+
+## v.0.8.4 is built for all platform, IOS and wasmJS included
+
 Cryptographic API works exactly the same and compiles to any platform supported listed below with no change in source code.

 All primitives meant to send over the network or store are `kotlinx.serialization` compatible, serializers included.
@@ -21,7 +31,7 @@ repositories {
  maven("https://gitea.sergeych.net/api/packages/SergeychWorks/maven")
 }
 dependencies {
-  import("net.sergeych:crypto2:0.7.1-SNAPSHOT")  
+  import("net.sergeych:crypto2:0.8.4")  
 }
 ```

@@ -36,6 +46,10 @@ Please see the current documentation [here](https://code.sergeych.net/docs/crypt
 - All moder browsers, including mobile
 - Node.js

+## WasmJs
+
+- All moder browsers, including mobile
+
 ## JVM

 - Android
@@ -110,4 +124,13 @@ Secret key encryption and signing/verifying uses Edwards curves 25519 algorithms
  - SHA3 256, 384, more are on the way.
 - CRC-protected binary ID with magic numbers to implement human-friendly IDS with type checks

+## Licensing

+# Licensing
+
+This is work in progress, not yet moved to public domain;
+you need to obtain a license from https://8-rays.dev or [Sergey Chernov]. For open source projects it will most be free on some special terms.
+
+It will be moved to open source; we also guarantee that it will be moved to open source immediately if the software export restrictions will be lifted. We do not support such practices here at 8-rays.dev and assume open source must be open.
+
+[Sergey Chernov]: https://t.me/real_sergeych
@@ -1,4 +1,14 @@
 #!/bin/bash
+#
+# Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+#
+#  You may use, distribute and modify this code under the
+# terms of the private license, which you must obtain from the author
+#
+# To obtain the license, contact the author: https://t.me/real_sergeych or email to
+# real dot sergeych at gmail.
+#
+
 set -e
 ./gradlew dokkaHtml
 rsync -avz ./build/dokka/* code.sergeych.net:/bigstore/sergeych_pub/code/docs/crypto2
@@ -1,30 +1,38 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import org.jetbrains.kotlin.gradle.ExperimentalKotlinGradlePluginApi
+import org.jetbrains.kotlin.gradle.ExperimentalWasmDsl
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget

 plugins {
-    kotlin("multiplatform") version "2.0.20"
-    id("org.jetbrains.kotlin.plugin.serialization") version "2.0.20"
+    kotlin("multiplatform") version "2.2.21"
+    id("org.jetbrains.kotlin.plugin.serialization") version "2.2.21"
    id("org.jetbrains.dokka") version "1.9.20"
    `maven-publish`
 }

 group = "net.sergeych"
-version = "0.7.1-SNAPSHOT"
+version = "0.9.0"

 repositories {
    mavenCentral()
    maven("https://maven.universablockchain.com/")
    maven("https://gitea.sergeych.net/api/packages/SergeychWorks/maven")
+    maven("https://gitea.sergeych.net/api/packages/YoungBlood/maven")
    mavenLocal()
 }

 kotlin {
-    jvm {
-        @OptIn(ExperimentalKotlinGradlePluginApi::class)
-        compilerOptions {
-            jvmTarget = JvmTarget.JVM_11
-        }
-    }
+    jvmToolchain(21)
+    jvm()
    js {
        browser()
        nodejs()
@@ -38,36 +46,37 @@ kotlin {
    iosArm64()
    iosSimulatorArm64()
    mingwX64()
-//    @OptIn(ExperimentalWasmDsl::class)
-//    wasmJs() //no libsodium bindings yet (strangely)
-//    val ktor_version = "2.3.6"
+    @OptIn(ExperimentalWasmDsl::class)
+    wasmJs {
+        browser()
+    }

    sourceSets {
        all {
            languageSettings.optIn("kotlinx.serialization.ExperimentalSerializationApi")
            languageSettings.optIn("kotlinx.coroutines.ExperimentalCoroutinesApi")
            languageSettings.optIn("kotlin.ExperimentalUnsignedTypes")
+            languageSettings.optIn("kotlin.time.ExperimentalTime")
        }

-
        val commonMain by getting {
            dependencies {
-                implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.1")
-                implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.0")
+                implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.10.2")
+                implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.9.0")

-                implementation("com.ionspin.kotlin:multiplatform-crypto-libsodium-bindings:0.9.2")
+                implementation("net.sergeych:multiplatform-crypto-libsodium-bindings:0.9.6")
                implementation(project.dependencies.platform("org.kotlincrypto.hash:bom:0.5.1"))
                implementation("org.kotlincrypto.hash:sha3")
-                api("com.ionspin.kotlin:bignum:0.3.9")
-                api("net.sergeych:mp_bintools:0.1.7")
-                api("net.sergeych:mp_stools:1.5.1")
+                api("com.ionspin.kotlin:bignum:0.3.10")
+                api("net.sergeych:mp_bintools:0.3.2")
+
            }
        }
        val commonTest by getting {
            dependencies {
                implementation(kotlin("test"))
                implementation("org.slf4j:slf4j-simple:2.0.9")
-                implementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.8.1")
+                implementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.10.1")
            }
        }
        val native by creating {
@@ -80,7 +89,7 @@ kotlin {
            }
        }
        val jvmTest by getting
-        for (platform in listOf(linuxMain, macosMain, iosMain, mingwMain))
+        for (platform in listOf(linuxX64Main, linuxArm64Main, macosX64Main, macosArm64Main, iosX64Main, iosArm64Main, iosSimulatorArm64Main, mingwX64Main))
            platform { dependsOn(native) }
    }
 }
@@ -103,6 +112,14 @@ publishing {
    }
 }

+tasks.named<Test>("jvmTest") {
+    // Ignore Kotlin synthetic classes generated from files that look like tests
+    exclude("**/*TestKt.class")
+    exclude("**/*TestsKt.class")
+    exclude("**/*AssertThrowsKt.class")
+    exclude("**/*Test_toolsKt.class")
+}
+
 tasks.dokkaHtml.configure {
    outputDirectory.set(buildDir.resolve("dokka"))
    dokkaSourceSets {
@@ -1 +1,15 @@
+#
+# Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+#
+#  You may use, distribute and modify this code under the
+# terms of the private license, which you must obtain from the author
+#
+# To obtain the license, contact the author: https://t.me/real_sergeych or email to
+# real dot sergeych at gmail.
+#
+
 kotlin.code.style=official
+org.gradle.parallel=true
+org.gradle.jvmargs=-Xmx4096M -Dfile.encoding=UTF-8
+org.gradle.configuration-cache=true
+org.gradle.caching=true
@@ -1,5 +1,15 @@
+#
+# Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+#
+#  You may use, distribute and modify this code under the
+# terms of the private license, which you must obtain from the author
+#
+# To obtain the license, contact the author: https://t.me/real_sergeych or email to
+# real dot sergeych at gmail.
+#
+
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
@@ -1,19 +1,13 @@
 #!/bin/sh

 #
-# Copyright © 2015-2021 the original authors.
+# Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
 #
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
+#  You may use, distribute and modify this code under the
+# terms of the private license, which you must obtain from the author
 #
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# To obtain the license, contact the author: https://t.me/real_sergeych or email to
+# real dot sergeych at gmail.
 #

 ##############################################################################
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 pluginManagement {
    repositories {
        mavenCentral()
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.box.Box
@@ -14,10 +24,10 @@ import net.sergeych.crypto2.Asymmetric.generateKeys
 *
 * ## How to
 *
- * - [SecretKey.new] to create a secret key that includes [SecretKey.publicKey].
+ * - [DecryptingSecretKey.new] to create a secret key that includes [DecryptingSecretKey.publicKey].
 *   [generateKeys] also makes the pair.
- * - [PublicKey] provides encryption, anonymous or authenticated.
- * - [SecretKey] provides authenticated decryption of what [PublicKey] was encrypted with.
+ * - [EncryptingPublicKey] provides encryption, anonymous or authenticated.
+ * - [DecryptingSecretKey] provides authenticated decryption of what [EncryptingPublicKey] was encrypted with.
 * - [Message] is a serializable container with all necessary data to decrypt public-key encrypted data it.
 *
 * __Algorithms:__
@@ -31,8 +41,8 @@ object Asymmetric {
    /**
     * Encrypted message holder.
     *
-     * Do not instantiate it directly, use [PublicKey.encryptMessage], [PublicKey.encryptAnonymousMessage], etc.
-     * instead. Also [SecretKey.decrypt] can be used to decrypt it same as [decrypt] or [decryptWithSenderKey].
+     * Do not instantiate it directly, use [EncryptingPublicKey.encryptMessage], [EncryptingPublicKey.encryptAnonymousMessage], etc.
+     * instead. Also [DecryptingSecretKey.decrypt] can be used to decrypt it same as [decrypt] or [decryptWithSenderKey].
     *
     * To successfully decrypt the message, it is necessary to know a sender public key, and non-secret nonce.
     * This class carries all this information; serialize and pass it to the recipient.
@@ -41,12 +51,12 @@ object Asymmetric {
    class Message(
        private val nonce: UByteArray,
        private val encryptedMessage: UByteArray,
-        val senderPublicKey: PublicKey,
+        val senderPublicKey: EncryptingPublicKey,
    ) {
        /**
-         * Decrypt the message, same as [SecretKey.decrypt]
+         * Decrypt the message, same as [DecryptingSecretKey.decrypt]
         */
-        fun decrypt(recipientKey: SecretKey): UByteArray {
+        fun decrypt(recipientKey: DecryptingSecretKey): UByteArray {
            return decryptWithSenderKey(senderPublicKey, recipientKey)
        }

@@ -54,7 +64,7 @@ object Asymmetric {
         * Decrypt a message which is not include sender's public key (which should somehow be
         * known to the recipient). Use it if [senderPublicKey] is null.
         */
-        fun decryptWithSenderKey(senderKey: PublicKey, recipientKey: SecretKey): UByteArray {
+        fun decryptWithSenderKey(senderKey: EncryptingPublicKey, recipientKey: DecryptingSecretKey): UByteArray {
            return try {
                WithFill.decode(
                    Box.openEasy(encryptedMessage, nonce, senderKey.keyBytes, recipientKey.keyBytes)
@@ -79,19 +89,19 @@ object Asymmetric {

    /**
     * Encrypt the [plainData] using [from] sender for [recipient] public key. Note that to decrypt it
-     * the [SecretKey] that corresponds to the [recipient] public key is needed, Sender can't decrypt the message!
+     * the [DecryptingSecretKey] that corresponds to the [recipient] public key is needed, Sender can't decrypt the message!
     *
     * The authenticated encryption is used, is the message _is successfully decrypted_, it also means that
     * it was signed by the sender, whose public key is known at the decryption time.
     *
-     * When it is important not to provide senders' key, use [PublicKey.encryptAnonymousMessage].
+     * When it is important not to provide senders' key, use [EncryptingPublicKey.encryptAnonymousMessage].
     *
     * @param from the senders' secret key.
     * @param recipient the recipients' public key.
     * @param plainData data to encrypt
     */
    internal fun createMessage(
-        from: SecretKey, recipient: PublicKey, plainData: UByteArray,
+        from: DecryptingSecretKey, recipient: EncryptingPublicKey, plainData: UByteArray,
        nonce: UByteArray = randomNonce(),
    ): Message {
        return Message(
@@ -104,8 +114,8 @@ object Asymmetric {

    private fun randomNonce(): UByteArray = randomUBytes(crypto_box_NONCEBYTES)

-    fun generateKeys() = SecretKey.generateKeys()
-    fun newSecretKey() = SecretKey.new()
+    fun generateKeys() = DecryptingSecretKey.generateKeys()
+    fun newSecretKey() = DecryptingSecretKey.new()

    val nonceBytesLength = crypto_box_NONCEBYTES

@@ -115,4 +125,4 @@ object Asymmetric {
 * Shortcut type: a pair of sender secret key and recipient private key could be used so
 * simplify such interfaces
 */
-typealias AsymmetricEncryptionPair = Pair<SecretKey?, PublicKey>
+typealias AsymmetricEncryptionPair = Pair<DecryptingSecretKey?, EncryptingPublicKey>
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.util.encodeToUByteArray
@@ -48,7 +58,7 @@ open class BinaryId(
    /**
     * Bad format (crc does not match)
     */
-    class InvalidException(text: String,reason: Throwable?=null) : IllegalArgumentException(text,reason)
+    class InvalidException(text: String, reason: Throwable? = null) : IllegalArgumentException(text, reason)

    /**
     * Attempt to compare binary ids with different magic. In this case only [equals]
@@ -70,32 +80,32 @@ open class BinaryId(
        rest.last().toInt()
    }

-    private val innerData: UByteArray by lazy { id.sliceArray( 1..< id.size-1 ) }
+    private val innerData: UByteArray by lazy { id.sliceArray(1..<id.size - 1) }

    /**
     * The ID body: all the bytes except check and magic. ID bytes could carry useful information.
     *
     * - `id.size` is [body] size + 2 (see [BinaryId] inner structure)
     */
-    val body: UByteArray by lazy { id.sliceArray( 0 until id.size-2 ) }
+    val body: UByteArray by lazy { id.sliceArray(0 until id.size - 2) }

    val asVerifyingKey: VerifyingKey by lazy {
-        if( magic != KeysmagicNumber.defaultVerifying.ordinal)
+        if (magic != KeysmagicNumber.defaultVerifying.ordinal)
            throw InvalidException("It is not a veryfing key: magic=$magic, required ${KeysmagicNumber.defaultVerifying.ordinal}")
        check(body.size == 32)
        VerifyingPublicKey(body)
    }

    /**
-     * Try to recnstruct a [PublicKey] from [id] bytes. For such keys, [PublicKey.id] and [SecretKey.id]
+     * Try to recnstruct a [EncryptingPublicKey] from [id] bytes. For such keys, [EncryptingPublicKey.id] and [DecryptingSecretKey.id]
     * are made from public key bytes so it could be restored from such an ID
     *
     */
-    val asPublicKey: PublicKey by lazy {
-        if( magic != KeysmagicNumber.defaultAssymmetric.ordinal)
+    val asPublicKey: EncryptingPublicKey by lazy {
+        if (magic != KeysmagicNumber.defaultAssymmetric.ordinal)
            throw InvalidException("It is not a veryfing key: magic=$magic, required ${KeysmagicNumber.defaultAssymmetric.ordinal}")
        check(body.size == 32)
-        PublicKey(body)
+        EncryptingPublicKey(body)
    }

    override fun toString(): String = id.encodeToBase64Url()
@@ -157,8 +167,8 @@ open class BinaryId(
        }

        @Suppress("unused")
-        fun createRandom(magicNumber: Int, size: Int=16) =
-            createFromBytes(magicNumber, Random.Default.nextBytes(size-2))
+        fun createRandom(magicNumber: Int, size: Int = 16) =
+            createFromBytes(magicNumber, Random.Default.nextBytes(size - 2))

        /**
         * Encode a string as UTF and create a binaryId from its bytes and provided magic.
@@ -1,90 +0,0 @@
-package net.sergeych.crypto2
-
-import kotlinx.serialization.Serializable
-import net.sergeych.bintools.decodeHex
-import net.sergeych.bintools.encodeToHex
-import kotlin.math.min
-
-/**
- * Bytes sequence with comparison, concatenation, and string representation,
- * could be used as hash keys for pure binary values, etc.
- */
-@Suppress("unused")
-@Serializable
-class ByteChunk(val data: UByteArray): Comparable<ByteChunk> {
-
-    val size: Int get() = data.size
-
-    /**
-     * Per-byte comparison also of different length. From two chunks
-     * of different size but equal beginning, the shorter is considered
-     * the smaller.
-     */
-    override fun compareTo(other: ByteChunk): Int {
-        val limit = min(size, other.size)
-        for( i in 0 ..< limit) {
-            val own = data[i]
-            val their = other.data[i]
-            if( own < their) return -1
-            else if( own > their) return 1
-        }
-        if( size < other.size ) return -1
-        if( size > other.size ) return 1
-        return 0
-    }
-
-    /**
-     * Equal chunks means content equality.
-     */
-    override fun equals(other: Any?): Boolean {
-        if (this === other) return true
-        if (other !is ByteChunk) return false
-
-        return data contentEquals other.data
-    }
-
-    /**
-     * Content-based hash code
-     */
-    override fun hashCode(): Int {
-        return data.contentHashCode()
-    }
-
-    /**
-     * hex representation of data
-     */
-    override fun toString(): String = base64Url
-
-    /**
-     * Hex encoded data
-     */
-    val hex by lazy { data.encodeToHex() }
-
-    val base64Url by lazy { data.encodeToBase64Url() }
-
-    /**
-     * human-readable dump
-     */
-    val dump by lazy { data.toDump() }
-
-    /**
-     * Concatenate two chunks and return new one
-     */
-    operator fun plus(other: ByteChunk): ByteChunk = ByteChunk(data + other.data)
-
-    fun toByteArray(): ByteArray = data.asByteArray()
-    fun toUByteArray(): UByteArray = data
-
-    companion object {
-        fun fromHex(hex: String): ByteChunk = ByteChunk(hex.decodeHex().asUByteArray())
-        fun random(sizeInBytes: Int=16) = randomUBytes(sizeInBytes).toChunk()
-    }
-}
-
-private fun UByteArray.toChunk(): ByteChunk = ByteChunk(this)
-@Suppress("unused")
-private fun ByteArray.toChunk(): ByteChunk = ByteChunk(this.asUByteArray())
-
-@Suppress("unused")
-fun ByteArray.asChunk() = ByteChunk(toUByteArray())
-fun UByteArray.asChunk(): ByteChunk = ByteChunk(this)
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.SerialName
@@ -24,8 +34,8 @@ import net.sergeych.crypto2.Container.Companion.createWith
 *
 * Some rules:
 *
- * When adding public key recipient, it is faster to use your known [SecretKey], but you
- * can stay anonymous by just adding [PublicKey] only.
+ * When adding public key recipient, it is faster to use your known [DecryptingSecretKey], but you
+ * can stay anonymous by just adding [EncryptingPublicKey] only.
 *
 * Put your data in [SealedBox] if you need to authenticate message origin and timestamp, then put
 * the sealed box in the [Container], this will conceal signers from attack. In the case you need to
@@ -107,7 +117,7 @@ sealed class Container {
     * Add e key to the __decrypted__ container. The new container is also decrypted so you can add
     * more keys, etc.
     */
-    operator fun plus(recipient: PublicKey) = addRecipients { key(recipient) }
+    operator fun plus(recipient: EncryptingPublicKey) = addRecipients { key(recipient) }

    /**
     * Add e key to the __decrypted__ container. The new container is also decrypted so you can add
@@ -119,7 +129,7 @@ sealed class Container {
     * Add e key to the __decrypted__ container. The new container is also decrypted so you can add
     * more keys, etc.
     */
-    operator fun plus(pair: Pair<SecretKey, PublicKey>) = addRecipients { key(pair) }
+    operator fun plus(pair: Pair<DecryptingSecretKey, EncryptingPublicKey>) = addRecipients { key(pair) }

    /**
     * Update the data in the decrypted container. It keeps the same set of keys and update
@@ -145,14 +155,14 @@ sealed class Container {
    abstract val decryptedWithKeyId: KeyId?

    /**
-     * If the container _is decrypted by the [PublicKey]_, e.g., using secret key encryption,
-     * contains the [PublicKey] that corresponds the [SecretKey] used while encrypting, this
+     * If the container _is decrypted by the [EncryptingPublicKey]_, e.g., using secret key encryption,
+     * contains the [EncryptingPublicKey] that corresponds the [DecryptingSecretKey] used while encrypting, this
     * authenticating the sender party cryptographically. This key could be used to encrypt
     * the response to be visible to the sender only; the sender, providing it kept his secret key,
     * could decrypt it.
     */
    @Transient
-    var authorisedByKey: PublicKey? = null
+    var authorisedByKey: EncryptingPublicKey? = null
        protected set

    /**
@@ -193,7 +203,7 @@ sealed class Container {
                    kotlin.runCatching { k.decrypt(encryptedMessage) }.getOrNull()?.let {
                        decryptedData = it
                        decryptedWithKey = k
-                        if( k is SecretKey) {
+                        if(k is DecryptingSecretKey) {
                            authorisedByKey = Asymmetric.Message.decode(encryptedMessage).senderPublicKey
                        }
                        return it
@@ -216,7 +226,7 @@ sealed class Container {
                    // otherwise, we don't know the encryption key and will try to derive it
                    // from the decryption key:
                    when (val k = decryptedWithKey!!) {
-                        is SecretKey -> {
+                        is DecryptingSecretKey -> {
                            key(k.publicKey)
                        }

@@ -259,12 +269,12 @@ sealed class Container {
            constructor(key: EncryptingKey, encodeMainKey: UByteArray) :
                    this(key.id, key.encrypt(encodeMainKey))

-            constructor(sender: SecretKey?, recipient: PublicKey, encodeMainKey: UByteArray) :
+            constructor(sender: DecryptingSecretKey?, recipient: EncryptingPublicKey, encodeMainKey: UByteArray) :
                    this(
                        recipient.id,
                        recipient.encryptMessage(
                            encodeMainKey,
-                            senderKey = sender ?: SecretKey.new(),
+                            senderKey = sender ?: DecryptingSecretKey.new(),
                        ).encoded
                    )
        }
@@ -294,7 +304,7 @@ sealed class Container {
                                throw InvalidContainerException()
                            decryptedWithKeyId = key.id
                            mainKey = k
-                            if( key is SecretKey) {
+                            if(key is DecryptingSecretKey) {
                                authorisedByKey = Asymmetric.Message.decode(encryptedKey.cipherData).senderPublicKey
                            }
                        }
@@ -311,6 +321,27 @@ sealed class Container {
            }.build()
    }

+    /**
+     * Decrypt the container with a password. It scans all key ids for
+     * these with `KDP` params, e.g., derived from password, and try to
+     * derive keys from the password and decrypt the container. If there are
+     * no derivable keys, or all of them failed to decrypt, returns null.
+     * It could be long operation if there are multiple derivable keys with heavy
+     * KDF. See [PBKD] and [KDF] for more.
+     *
+     * @return decrypted data or null
+     */
+    @Suppress("unused")
+    fun decryptWithPassword(password: String): UByteArray? {
+        for( id in this.keyIds ) {
+            id.kdp?.let { kdp ->
+                decryptWith(kdp.deriveKey(password))?.let { return it }
+            }
+        }
+        return null
+    }
+
+
    companion object {

        /**
@@ -358,8 +389,8 @@ sealed class Container {
            }

            /**
-             * Add one or more [SecretKey] as sender authority coupled with [PublicKey] as
-             * a recipient. This is faster than anonymous usage of [PublicKey] only
+             * Add one or more [DecryptingSecretKey] as sender authority coupled with [EncryptingPublicKey] as
+             * a recipient. This is faster than anonymous usage of [EncryptingPublicKey] only
             */
            fun key(vararg pairs: AsymmetricEncryptionPair) {
                keyPairs.addAll(pairs)
@@ -368,7 +399,7 @@ sealed class Container {
            /**
             * Add one or more public keys as recipients. This is slower than using pairs of sender -> recipient.
             */
-            fun key(vararg publicKeys: PublicKey) {
+            fun key(vararg publicKeys: EncryptingPublicKey) {
                keyPairs.addAll(publicKeys.map { null to it })
            }

@@ -429,7 +460,7 @@ sealed class Container {
                Single(
                    pk.id, pk.encryptMessage(
                        plainData,
-                        senderKey = sk ?: SecretKey.new(),
+                        senderKey = sk ?: DecryptingSecretKey.new(),
                        randomFill = fillRange
                    ).encoded,
                    plainData,
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import net.sergeych.bintools.CRC
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.util.decodeFromUByteArray
@@ -8,7 +18,7 @@ import net.sergeych.crypto2.SymmetricKey.WithNonce
 /**
 * Some key able to perform decrypting. It is not serializable by purpose, as not all such
 * keys are wise to transfer/save. Concrete implementations are, like [SymmetricKey] or
- * [SecretKey].
+ * [DecryptingSecretKey].
 */
 interface DecryptingKey : NonceBased, KeyInstance {
    /**
@@ -0,0 +1,105 @@
+package net.sergeych.crypto2
+
+import net.sergeych.bintools.KVStorage
+import net.sergeych.bintools.MemoryKVStorage
+import net.sergeych.bintools.optStored
+import net.sergeych.synctools.ProtectedOp
+import net.sergeych.synctools.invoke
+import kotlin.random.Random
+import kotlin.random.nextUBytes
+
+/**
+ * Encrypted variant of [KVStorage]; the storage is encrypted with the given key
+ * in a given [plainStore] [KVStorage]. It is threadsafe where
+ * applicable. Also, it supports in-place key change [reEncrypt].
+ *
+ * Keys are stored encrypted and used hashed so it is not possible to
+ * retrieve them without knowing the encryption key.
+ *
+ * @param plainStore where to store encrypted data
+ * @param encryptionKey key to decrypt existing/encrypt new data. Can cause [DecryptionFailedException]
+ *          if the key is wrong and the storage is already initialized with a new key and same [prefix]
+ * @param prefix prefix for keys to distinguish from other data in [plainStore]
+ * @param removeExisting if true, removes all existing data in [plainStore] if the [encryptionKey] can't
+ *          decrypt existing encrypted data
+ */
+class EncryptedKVStorage(
+    private val plainStore: KVStorage,
+    private var encryptionKey: SymmetricKey,
+    private val prefix: String = "EKVS_",
+    removeExisting: Boolean
+) : KVStorage {
+    private val op = ProtectedOp()
+
+    private val prefix2 = prefix + ":"
+
+    val seed: UByteArray
+
+    init {
+        var encryptedSeed by plainStore.optStored<UByteArray>("$prefix#seed")
+        seed = try {
+            encryptedSeed?.let { encryptionKey.decrypt(it) }
+                ?: Random.nextUBytes(32).also {
+                    encryptedSeed = encryptionKey.encrypt(it)
+                }
+        } catch (x: DecryptionFailedException) {
+            if (removeExisting) {
+                plainStore.keys.filter { it.startsWith(prefix) }.forEach {
+                    plainStore.delete(it)
+                }
+                Random.nextUBytes(32).also {
+                    encryptedSeed = encryptionKey.encrypt(it)
+                }
+            } else throw x
+        }
+    }
+
+    private fun mkkey(key: String): String =
+        blake2b(key.encodeToByteArray().asUByteArray() + seed).encodeToBase64Url()
+
+    override val keys: Set<String>
+        get() = op.invoke {
+            plainStore.keys.mapNotNull {
+                if (it.startsWith(prefix2))
+                    plainStore[it]?.let { encrypted ->
+                        encryptionKey.decrypt(encrypted.asUByteArray()).asByteArray().decodeToString()
+                    }
+                else null
+            }.toSet()
+        }
+
+    override fun get(key: String): ByteArray? = op {
+        val k0 = mkkey(key)
+        val k = prefix + k0
+        plainStore[k]?.let { encryptionKey.decrypt(it.asUByteArray()).asByteArray() }
+            ?.also {
+                val k2 = prefix2 + k0
+                if (k2 !in plainStore)
+                    plainStore[k2] = encryptionKey.encrypt(key).asByteArray()
+            }
+    }
+
+    override fun set(key: String, value: ByteArray?) {
+        op {
+            val k1 = mkkey(key)
+            plainStore[prefix + k1] = value?.let {
+                encryptionKey.encrypt(it.asUByteArray()).asByteArray()
+            }
+            plainStore[prefix2 + k1] = encryptionKey.encrypt(key).asByteArray()
+        }
+    }
+
+    /**
+     * Re-encrypts the entire storage in-place with the given key; it is threadsafe where
+     * applicable.
+     *
+     * This method re-encrypts every data item so it is cryptographically secure.
+     */
+    fun reEncrypt(newKey: SymmetricKey) {
+        op {
+            val copy = MemoryKVStorage().also { it.addAll(this) }
+            encryptionKey = newKey
+            addAll(copy)
+        }
+    }
+}
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.util.encodeToUByteArray
@@ -1,9 +1,21 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.generichash.GenericHash
 import com.ionspin.kotlin.crypto.util.encodeToUByteArray
 import kotlinx.coroutines.channels.ReceiveChannel
 import kotlinx.coroutines.flow.Flow
+import net.sergeych.bintools.ByteChunk
+import net.sergeych.bintools.asChunk
 import org.kotlincrypto.hash.sha3.SHA3_256
 import org.kotlincrypto.hash.sha3.SHA3_384

@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.LibsodiumInitializer
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.Serializable
@@ -10,7 +20,7 @@ import kotlinx.serialization.Serializable
 * Important. `KeyId` of matching keys are the same, so you can use it to identify
 * and find matching keys in the [UniversalRing], etc. For example:
 *
- * - [SecretKey] and [PublicKey] from the same pair have the same `KeyId`, thus the former
+ * - [DecryptingSecretKey] and [EncryptingPublicKey] from the same pair have the same `KeyId`, thus the former
 *   can decrypt what was encrypted with the latter.
 *
 * - [SigningSecretKey] and corresponding [VerifyingKey] have the same `KeyId`. Use it to pick a proper key for
@@ -18,7 +28,7 @@ import kotlinx.serialization.Serializable
 *
 * See [PBKD.Params.deriveKey] for deriving keys from id.
 *
- * See [id], and [BinaryId] class for more. Note that for [PublicKey] and [VerifyingPublicKey] [BinaryId.asPublicKey]
+ * See [id], and [BinaryId] class for more. Note that for [EncryptingPublicKey] and [VerifyingPublicKey] [BinaryId.asPublicKey]
 * and [BinaryId.asVerifyingKey] restore actual keys, providing [BinaryId.magic] has proper value, see [KeysmagicNumber]]
 *
 * @param id actual id used in equality test amd hash code generation. `Id` of the matching keys is the same.
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 /**
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 enum class KeysmagicNumber(val label: String) {
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.SerialName
@@ -50,6 +60,12 @@ sealed class Multikey {
     */
    abstract fun check(keys: Iterable<VerifyingPublicKey>): Boolean

+    /**
+     * Step towards automated picking necessary keys.
+     * Return all the keys mentioned in this multikey condition.
+     */
+    abstract fun mentionedKeys(): Set<VerifyingPublicKey>
+
    /**
     * Check that [verifyingKeys] satisfy the multikey condition
     */
@@ -87,6 +103,10 @@ sealed class Multikey {
            }
            return false
        }
+
+        override fun mentionedKeys(): Set<VerifyingPublicKey> {
+            return validKeys
+        }
    }

    /**
@@ -109,6 +129,10 @@ sealed class Multikey {
            }
            return false
        }
+
+        override fun mentionedKeys(): Set<VerifyingPublicKey> {
+            return validKeys.flatMap { it.mentionedKeys() }.toSet()
+        }
    }

    /**
@@ -119,6 +143,7 @@ sealed class Multikey {
    @Serializable
    object AnyKey : Multikey() {
        override fun check(keys: Iterable<VerifyingPublicKey>): Boolean = true
+        override fun mentionedKeys(): Set<VerifyingPublicKey> = emptySet()
    }


@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 interface NonceBased {
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 /**
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.util.encodeToUByteArray
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.SerialName
@@ -7,20 +17,22 @@ import net.sergeych.bipack.decodeFromBipack
 import net.sergeych.crypto2.VerifyingPublicKey.Companion.toString
 import net.sergeych.mp_tools.decodeBase64Url

+@Deprecated("Use EncryptingPublicKey",ReplaceWith("EncryptingPublicKey"))
+typealias PublicKey = EncryptingPublicKey
 /**
 * The public for public-key encryption. It encrypts messages that can only be decrypted with corresponding
- * [SecretKey].
+ * [DecryptingSecretKey].
 */
@Serializable
@SerialName("encp")
-class PublicKey(override val keyBytes: UByteArray) : UniversalKey(), EncryptingKey {
+class EncryptingPublicKey(override val keyBytes: UByteArray) : UniversalKey(), EncryptingKey {

    override val magic: KeysmagicNumber = KeysmagicNumber.defaultAssymmetric
    @Transient
    override val label: String = "pub"

    /**
-     * Create an anonymous message that could be decrypted only with the [SecretKey] that corresponds this.
+     * Create an anonymous message that could be decrypted only with the [DecryptingSecretKey] that corresponds this.
     * Anonymous message uses one-time secret key, the public part of which is included into the
     * [Asymmetric.Message], so the sender could not be identified.
     *
@@ -57,18 +69,18 @@ class PublicKey(override val keyBytes: UByteArray) : UniversalKey(), EncryptingK
    fun encryptMessage(
        plainData: UByteArray,
        nonce: UByteArray = randomNonce(),
-        senderKey: SecretKey = newSecretKey(),
+        senderKey: DecryptingSecretKey = newSecretKey(),
        randomFill: IntRange? = null,
    ) = Asymmetric.createMessage(senderKey, this, WithFill.encode(plainData, randomFill), nonce)

    /**
     * Encrypt message using the specified secret key as sender authentication. Recipient, the party having
-     * [SecretKey] corresponding to this one, will be able to decrypt the message and be sure that [senderKey]
+     * [DecryptingSecretKey] corresponding to this one, will be able to decrypt the message and be sure that [senderKey]
     * was the author and the message was not altered.
     */
    fun encryptMessage(
        plainData: UByteArray,
-        senderKey: SecretKey,
+        senderKey: DecryptingSecretKey,
        randomFill: IntRange? = null,
    ): Asymmetric.Message =
        Asymmetric.createMessage(senderKey, this, WithFill.encode(plainData, randomFill))
@@ -81,12 +93,12 @@ class PublicKey(override val keyBytes: UByteArray) : UniversalKey(), EncryptingK
         * possible)
         * @throws IllegalArgumentException the public key isn't recognized
         */
-        fun parse(text: String): PublicKey {
+        fun parse(text: String): EncryptingPublicKey {
            val s = text.trim()

-            fun parseId(t: String): PublicKey{
+            fun parseId(t: String): EncryptingPublicKey {
                val id = BinaryId.restoreFromString(t)
-                if( id.magic != KeysmagicNumber.defaultAssymmetric.ordinal)
+                if (id.magic != KeysmagicNumber.defaultAssymmetric.ordinal)
                    throw IllegalArgumentException("invalid magick ${id.magic} for PublicKey")
                return id.asPublicKey
            }
@@ -100,10 +112,10 @@ class PublicKey(override val keyBytes: UByteArray) : UniversalKey(), EncryptingK
                    // consider it is serialized key in base64 format
                    val data = s.decodeBase64Url().asUByteArray()
                    if (data.size == 32)
-                        PublicKey(data)
+                        EncryptingPublicKey(data)
                    else {
-                        runCatching { data.decodeFromBipack<PublicKey>() }.getOrNull()
-                            ?: kotlin.runCatching { data.decodeFromBipack<UniversalKey>() as PublicKey }
+                        runCatching { data.decodeFromBipack<EncryptingPublicKey>() }.getOrNull()
+                            ?: kotlin.runCatching { data.decodeFromBipack<UniversalKey>() as EncryptingPublicKey }
                                .getOrElse { throw IllegalArgumentException("can't parse verifying key") }
                    }
                }
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.keyexchange.KeyExchange
@@ -10,7 +20,7 @@ import net.sergeych.crypto2.SafeKeyExchange.SessionKey
 * Usage:
 *
 * 1. Create [SafeKeyExchange] on both server and client sides
- * 2. Exchange [publicKey] instances
+ * 2. Exchange [EncryptingPublicKey] instances
 * 3. Create [serverSessionKey] and [clientSessionKey] respectively
 * 4. Use [SessionKey.sendingKey] and [SessionKey.receivingKey] to send and receive encrypted data.
 *
@@ -20,7 +30,7 @@ import net.sergeych.crypto2.SafeKeyExchange.SessionKey
 *   instances as often as performance considerations allow.
 * - while it is possible to generate several keys "ahead", the care should be taken when storing them,
 *   encrypt it with some other key to maintain safety.
- * - do not use [publicKey] for anything but creating session keys.
+ * - do not use [EncryptingPublicKey] for anything but creating session keys.
 */
 class SafeKeyExchange {
    private val pair = KeyExchange.keypair()
@@ -1,11 +1,22 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

-import kotlinx.datetime.Instant
+import kotlin.time.Instant
 import kotlinx.serialization.Serializable
 import net.sergeych.bipack.BipackEncoder
 import net.sergeych.bipack.decodeFromBipack
 import net.sergeych.crypto2.Seal.Companion.create
 import net.sergeych.utools.now
+import kotlin.time.Duration.Companion.seconds

 /**
 * Extended public-key signature.
@@ -67,7 +78,7 @@ class Seal(
     */
    fun verify(message: UByteArray) {
        val n = now()
-        if (createdAt > n) throw IllegalSignatureException("signature's timestamp in the future")
+        if (createdAt - 45.seconds > n) throw IllegalSignatureException("signature's timestamp in the future: $createdAt / $n")
        expiresAt?.let {
            if (n >= it) throw ExpiredSignatureException("signature expired at $it")
        }
@@ -98,7 +109,7 @@ class Seal(
         * to check the authenticity of the arbitrary [message] using a public key, [VerifyingPublicKey]
         * instance, using public-key signing algorithms.
         *
-         * Unlike a regular binary signature, Seal contains the signer's [publicKey], and also
+         * Unlike a regular binary signature, Seal contains the signer's [EncryptingPublicKey], and also
         * [createdAt] and [expiresAt] fields which are also signed and are guaranteed to be non-tampered
         * if the [isValid] returns true (or [verify] does not throw). See [isExpired].
         *
@@ -1,6 +1,16 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

-import kotlinx.datetime.Instant
+import kotlin.time.Instant
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.Transient
 import net.sergeych.bipack.BipackDecoder
@@ -82,6 +92,7 @@ class SealedBox(
    /**
     * Unpack bipack-encoded payload
     */
+    @Suppress("unused")
    inline fun <reified T>unpack(): T = BipackDecoder.decode(message)

    init {
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.box.Box
@@ -6,24 +16,28 @@ import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.Transient

+@Deprecated("Use DecryptingSecretKey instead",ReplaceWith("DecryptingSecretKey"))
+typealias SecretKey = DecryptingSecretKey
+
 /**
 * The secret key used in public-key encryption; it is used to _decrypt_ data encrypted with its
- * public counterpart, see [publicKey].
+ * public counterpart, see [EncryptingPublicKey].
 */
@Serializable
@SerialName("encs")
-class SecretKey(
+class DecryptingSecretKey(
    override val keyBytes: UByteArray,
    @Transient
-    val _cachedPublicKey: PublicKey? = null,
+    val _cachedPublicKey: EncryptingPublicKey? = null,
 ) : DecryptingKey, UniversalKey() {

    @Transient
    override val label: String = "sec"
+
    /**
     * Decrypt with authentication checks the message which must have [Asymmetric.Message.senderPublicKey] set.
     * Use [decryptWithSenderKey] otherwise. Note that the authenticated encryption is always use, even if
-     * the [PublicKey.encryptAnonymousMessage] was used to create a message, if it is successfully decrypted,
+     * the [EncryptingPublicKey.encryptAnonymousMessage] was used to create a message, if it is successfully decrypted,
     * it is guaranteed that the message was not altered after creation.
     *
     * @throws DecryptionFailedException If the message is tampered (changed after creation) or was not intended for us,
@@ -35,20 +49,20 @@ class SecretKey(
     * Decrypt using [senderPublicKey] as a sender key (overriding the [Asymmetric.Message.senderPublicKey] if set).
     * See [decrypt] for more.
     */
-    fun decryptWithSenderKey(message: Asymmetric.Message, senderPublicKey: PublicKey): UByteArray =
+    fun decryptWithSenderKey(message: Asymmetric.Message, senderPublicKey: EncryptingPublicKey): UByteArray =
        message.decryptWithSenderKey(senderPublicKey, this)

    @Transient
-    private var cachedPublicKey: PublicKey? = _cachedPublicKey
+    private var cachedPublicKey: EncryptingPublicKey? = _cachedPublicKey

    /**
     * The corresponding public key
     */
-    val publicKey: PublicKey by lazy {
+    val publicKey: EncryptingPublicKey by lazy {
        if (cachedPublicKey != null)
            cachedPublicKey!!
        else
-            PublicKey(ScalarMultiplication.scalarMultiplicationBase(keyBytes))
+            EncryptingPublicKey(ScalarMultiplication.scalarMultiplicationBase(keyBytes))
                .also { cachedPublicKey = it }
    }

@@ -71,18 +85,18 @@ class SecretKey(
        get() = 0

    companion object {
-        data class KeyPair(val secretKey: SecretKey, val publicKey: PublicKey)
+        data class KeyPair(val secretKey: DecryptingSecretKey, val publicKey: EncryptingPublicKey)

        /**
         * Generate a new random pair of public and secret keys.
         */
        fun generateKeys(): KeyPair {
            val p = Box.keypair()
-            val pk = PublicKey(p.publicKey)
-            return KeyPair(SecretKey(p.secretKey, pk), pk)
+            val pk = EncryptingPublicKey(p.publicKey)
+            return KeyPair(DecryptingSecretKey(p.secretKey, pk), pk)
        }

-        fun new(): SecretKey = generateKeys().secretKey
+        fun new(): DecryptingSecretKey = generateKeys().secretKey

    }
 }
@@ -1,6 +1,16 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

-import kotlinx.datetime.Instant
+import kotlin.time.Instant

 interface SigningKey: KeyInstance {
    val verifyingKey: VerifyingPublicKey
@@ -1,7 +1,17 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.signature.Signature
-import kotlinx.datetime.Instant
+import kotlin.time.Instant
 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.Transient
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.secretbox.SecretBox
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.Serializable
@@ -17,7 +27,7 @@ sealed class UniversalKey : KeyInstance {

    /**
     * Key ID positively identify key from the point of view of _decrypting or verifying_. So matching [VerifyingKey]
-     * and [SigningKey] will have the same id, same as matching [PublicKey] and [SecretKey].
+     * and [SigningKey] will have the same id, same as matching [EncryptingPublicKey] and [DecryptingSecretKey].
     *
     * KeyId is based on [BinaryId] which includes checksum (crc8) and magick number for additional security,
     * see [KeysmagicNumber].
@@ -43,7 +53,7 @@ sealed class UniversalKey : KeyInstance {
    }

    companion object {
-        fun newSecretKey() = SecretKey.new()
+        fun newSecretKey() = DecryptingSecretKey.new()
        fun newSigningKey() = SigningSecretKey.new()

        @Suppress("unused")
@@ -57,7 +67,7 @@ sealed class UniversalKey : KeyInstance {
            val s = text.trim()
            return when {
                s.startsWith("\uD83D\uDDDDpub#") || s.startsWith("pub#") ->
-                    PublicKey.parse(s)
+                    EncryptingPublicKey.parse(s)
                s.startsWith("\uD83D\uDDDDver#") || s.startsWith("ver#") ->
                    VerifyingPublicKey.parse(s)
                else -> {
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.SerialName
@@ -14,7 +24,7 @@ import kotlinx.serialization.Transient
@SerialName("uprv")
 class UniversalPrivateKey(
    val signingKey: SigningSecretKey,
-    val decryptingKey: SecretKey
+    val decryptingKey: DecryptingSecretKey
 ) : UniversalKey(), DecryptingKey by decryptingKey, SigningKey by signingKey {

    override val keyBytes by lazy { signingKey.keyBytes + decryptingKey.keyBytes }
@@ -42,6 +52,6 @@ class UniversalPrivateKey(
         * Generate 2 new random keys (4 key pairs under the hood) to securely signd and
         * decrypt data.
         */
-        fun new() = UniversalPrivateKey(SigningSecretKey.new(), SecretKey.new())
+        fun new() = UniversalPrivateKey(SigningSecretKey.new(), DecryptingSecretKey.new())
    }
 }
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.SerialName
@@ -15,7 +25,7 @@ import kotlinx.serialization.Transient
@SerialName("upub")
 class UniversalPublicKey(
    val verifyingKey: VerifyingPublicKey,
-    val encryptingKey: PublicKey
+    val encryptingKey: EncryptingPublicKey
 ): UniversalKey(), VerifyingKey by verifyingKey, EncryptingKey by encryptingKey{

    override val keyBytes by lazy { verifyingKey.keyBytes + encryptingKey.keyBytes }
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.Serializable
@@ -38,7 +48,7 @@ class UniversalRing(

    /**
     * Find a key of the specified type that matches the id. In general, you require key implementations like
-     * [SecretKey], [PublicKey], [VerifyingPublicKey], [SigningSecretKey] and [SymmetricKey],
+     * [DecryptingSecretKey], [EncryptingPublicKey], [VerifyingPublicKey], [SigningSecretKey] and [SymmetricKey],
     * or just key interfaces: [EncryptingKey], [DecryptingKey], [SigningKey] and [VerifyingKey].
     *
     * Note that key interfaces are not serializable as for now, you should try to cast to a serializable
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 interface VerifyingKey: KeyInstance {
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.signature.InvalidSignatureException
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import kotlinx.serialization.Serializable
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 /**
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.crypto2

 import com.ionspin.kotlin.crypto.pwhash.*
@@ -34,7 +44,8 @@ sealed class KDF {
         *
         * Random salt of proper size is used
         */
-        fun kdfForSize(numberOfKeys: Int): KDF = creteDefault(SymmetricKey.keyLength * numberOfKeys, this)
+        fun kdfForSize(numberOfKeys: Int,salt: UByteArray = Argon.randomSalt()): KDF =
+            creteDefault(SymmetricKey.keyLength * numberOfKeys, this, salt)

        /**
         * Derive multiple keys from the password. Derivation params will be included in the key ids, see
@@ -48,13 +59,13 @@ sealed class KDF {
         * to change with time.
         */
        @Suppress("unused")
-        fun deriveMultiple(password: String, count: Int): List<SymmetricKey> =
-            kdfForSize(count).deriveMultipleKeys(password, count)
+        fun deriveMultiple(password: String, count: Int,salt: UByteArray): List<SymmetricKey> =
+            kdfForSize(count, salt).deriveMultipleKeys(password, count)

        /**
         * Derive single key from password, same as [deriveMultiple] with count=1.
         */
-        fun derive(password: String): SymmetricKey = deriveMultiple(password, 1).first()
+        fun derive(password: String, salt: UByteArray): SymmetricKey = deriveMultiple(password, 1, salt).first()
    }

    /**
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
@file:Suppress("unused")

 package net.sergeych.crypto2
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
@file:Suppress("unused")

 package net.sergeych.crypto2
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.tools

@Suppress("unused")
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.tools

 import net.sergeych.synctools.ProtectedOp
@@ -5,7 +15,7 @@ import net.sergeych.synctools.invoke

 /**
 * Multiplatform (JS and battery included) atomically mutable value.
- * Actual value can be either changed in a block of [mutuate] when
+ * Actual value can be either changed in a block of [mutate] when
 * new value _depends on the current value_ or use a same [value]
 * property that is thread-safe where there are threads and just safe
 * otherwise ;)
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
@file:Suppress("unused")

 package net.sergeych.tools
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.tools

 import net.sergeych.bipack.BipackDecoder
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
@file:Suppress("unused")

 package net.sergeych.utools
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package net.sergeych.utools

 import kotlinx.serialization.KSerializer
@@ -1,9 +1,19 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
@file:Suppress("unused")

 package net.sergeych.utools

-import kotlinx.datetime.Clock
-import kotlinx.datetime.Instant
+import kotlin.time.Clock
+import kotlin.time.Instant

 fun now(): Instant = Clock.System.now()
 fun nowToSeconds(): Instant = Clock.System.now().truncateToSeconds()
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package org.komputing.khash.keccak

 import com.ionspin.kotlin.bignum.integer.BigInteger
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
@file:Suppress("unused")

 package org.komputing.khash.keccak
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 package org.komputing.khash.keccak.extensions

 /**
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
@file:Suppress("unused")
 package org.komputing.khash.keccak.extensions

@@ -1,5 +1,21 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
+import kotlinx.coroutines.test.runTest
+import net.sergeych.bintools.ByteChunk
+import net.sergeych.bintools.toDump
+import net.sergeych.bipack.BipackEncoder
 import net.sergeych.crypto2.BinaryId
+import net.sergeych.crypto2.initCrypto
 import kotlin.test.Test
+import kotlin.test.assertContentEquals
 import kotlin.test.assertEquals

 class BinaryIdTest {
@@ -13,4 +29,16 @@ class BinaryIdTest {
        assertEquals(4, a.id.size)

    }
+
+    @Test
+    fun testByteChunkSizes() = runTest {
+        initCrypto()
+        val x = ByteChunk.random(3)
+        assertEquals(3, x.data.size)
+        assertEquals(3, x.asByteArray.size)
+        assertEquals(3, x.data.size)
+        println(BipackEncoder.encode(x).toDump())
+        assertEquals(4, BipackEncoder.encode(x).size)
+        assertContentEquals(BipackEncoder.encode(x.asByteArray), BipackEncoder.encode(x))
+    }
 }
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import com.ionspin.kotlin.crypto.util.encodeToUByteArray
 import kotlinx.coroutines.test.runTest
 import kotlinx.serialization.encodeToString
@@ -1,24 +1,26 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import kotlinx.coroutines.flow.asFlow
 import kotlinx.coroutines.test.runTest
-import kotlinx.datetime.Clock
+import kotlin.time.Clock
 import net.sergeych.crypto2.Hash
 import net.sergeych.crypto2.initCrypto
 import kotlin.random.Random
 import kotlin.random.nextUBytes
+import kotlin.test.Ignore
 import kotlin.test.Test
 import kotlin.test.assertContentEquals
 import kotlin.test.assertEquals
 import kotlin.test.assertFalse

-@Suppress("UNUSED_PARAMETER", "UNUSED_VARIABLE")
-suspend fun <T> sw(label: String, f: suspend () -> T): T {
-    val t1 = Clock.System.now()
-    val result = f()
-    val t2 = Clock.System.now()
-//    println("$label: ${t2 - t1}")
-    return result
-}
-
 class HashTest {
    @Test
    fun testEqualMethods() {
@@ -67,3 +69,13 @@ class HashTest {

 }

+@Suppress("UNUSED_PARAMETER", "UNUSED_VARIABLE")
+suspend fun <T> sw(label: String, f: suspend () -> T): T {
+    val t1 = Clock.System.now()
+    val result = f()
+    val t2 = Clock.System.now()
+//    println("$label: ${t2 - t1}")
+    return result
+}
+
+
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import kotlinx.coroutines.test.runTest
 import net.sergeych.crypto2.KDF
 import net.sergeych.crypto2.initCrypto
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import com.ionspin.kotlin.crypto.util.decodeFromUByteArray
 import com.ionspin.kotlin.crypto.util.encodeToUByteArray
 import kotlinx.coroutines.test.runTest
@@ -177,7 +187,7 @@ class KeysTest {
 //        println(sk0.publicKey)
        val j = Json { prettyPrint = true }

-        val sk1 = j.decodeFromString<SecretKey>(j.encodeToString(sk0))
+        val sk1 = j.decodeFromString<DecryptingSecretKey>(j.encodeToString(sk0))
        assertEquals(sk0, sk1)
        assertEquals(pk0, sk1.publicKey)
 //        println(j.encodeToString(sk1))
@@ -206,9 +216,9 @@ class KeysTest {
        assertEquals(usy2, usy1)
        assertFalse { usy1 == usy3 }

-        val sk1 = SecretKey.new()
-        val sk2 = SecretKey(sk1.keyBytes)
-        val sk3 = SecretKey.new()
+        val sk1 = DecryptingSecretKey.new()
+        val sk2 = DecryptingSecretKey(sk1.keyBytes)
+        val sk3 = DecryptingSecretKey.new()

        assertEquals(sk1, sk2)
        assertEquals(sk2, sk1)
@@ -408,13 +418,13 @@ class KeysTest {
    @Test
    fun testEncodedSizes2() = runTest {
        initCrypto()
-        val x = SecretKey.new()
+        val x = DecryptingSecretKey.new()
 //        println("key bytes: ${x.keyBytes.size}:\n${x.keyBytes.toDump()}")
        val y = BipackEncoder.encode(x)
 //        println("packed: ${y.size}: ${y.toDump()}")
        assertTrue { x.keyBytes.size + 5 > y.size }
-        assertEquals(x, BipackDecoder.decode<SecretKey>(y))
-        assertContentEquals(x.keyBytes, BipackDecoder.decode<SecretKey>(y).keyBytes)
+        assertEquals(x, BipackDecoder.decode<DecryptingSecretKey>(y))
+        assertContentEquals(x.keyBytes, BipackDecoder.decode<DecryptingSecretKey>(y).keyBytes)
    }

    @Test
@@ -422,7 +432,7 @@ class KeysTest {
        initCrypto()
        val k1 = SigningSecretKey.new()
        val k2 = k1.verifyingKey
-        val k3 = SecretKey.new()
+        val k3 = DecryptingSecretKey.new()
        val k4 = k3.publicKey

        val k5 = UniversalPrivateKey.new()
@@ -432,7 +442,7 @@ class KeysTest {
        assertContentEquals(k2.keyBytes, k2.id.id.body)

        val k7 = SymmetricKey.new()
-        val k8 = KDF.Complexity.Interactive.derive("super")
+        val k8 = KDF.Complexity.Interactive.derive("super", KDF.Argon.randomSalt())

        fun testToString(k: UniversalKey) {
            val s = k.toString()
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import kotlinx.coroutines.test.runTest
 import net.sergeych.crypto2.PBKD
 import net.sergeych.crypto2.initCrypto
@@ -1,5 +1,15 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import kotlinx.coroutines.test.runTest
-import kotlinx.datetime.Instant
+import kotlin.time.Instant
 import net.sergeych.crypto2.initCrypto
 import net.sergeych.utools.nowToSeconds
 import net.sergeych.utools.pack
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import com.ionspin.kotlin.crypto.util.encodeToUByteArray
 import kotlinx.coroutines.test.runTest
 import net.sergeych.bintools.toDump
@@ -17,7 +27,7 @@ class RingTest {
        assertEquals(y1, y2)

        val e1 = Asymmetric.newSecretKey()
-        val e2: SecretKey = BipackDecoder.decode(BipackEncoder.encode(e1))
+        val e2: DecryptingSecretKey = BipackDecoder.decode(BipackEncoder.encode(e1))
        assertEquals(e1, e2)

        val k1 = SymmetricKey("1234567890Hello,dolly.here-we-go".encodeToUByteArray()) as UniversalKey
@@ -154,14 +164,14 @@ class RingTest {

        var r1 = ra + rb + rc + rd

-        assertEquals(a, r1.findKey<SecretKey>(a.id))
+        assertEquals(a, r1.findKey<DecryptingSecretKey>(a.id))
        assertEquals(a, r1.keyByTag<UniversalKey>("foo_a"))
        assertEquals(b, r1.findKey<SigningKey>(b.id))
        assertEquals(c, r1.findById(c.id).first())

        r1 = UniversalRing.join(listOf(ra, rb, rc, rd))

-        assertEquals(a, r1.findKey<SecretKey>(a.id))
+        assertEquals(a, r1.findKey<DecryptingSecretKey>(a.id))
        assertEquals(a, r1.keyByTag<UniversalKey>("foo_a"))
        assertEquals(b, r1.findKey<SigningKey>(b.id))
        assertEquals(c, r1.findById(c.id).first())
@@ -0,0 +1,87 @@
+import kotlinx.coroutines.test.runTest
+import net.sergeych.bintools.*
+import net.sergeych.bipack.decodeFromBipack
+import net.sergeych.crypto2.DecryptionFailedException
+import net.sergeych.crypto2.EncryptedKVStorage
+import net.sergeych.crypto2.SymmetricKey
+import net.sergeych.crypto2.initCrypto
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+import kotlin.test.assertNull
+
+class StorageTest {
+
+    @Test
+    fun testGetAndSet() = runTest {
+        initCrypto()
+        val plain = MemoryKVStorage()
+        val key = SymmetricKey.new()
+        val storage = EncryptedKVStorage(plain, key, removeExisting = false)
+
+        var hello by storage.optStored<String>()
+        assertNull(hello)
+        hello = "world"
+        assertEquals("world", storage["hello"]?.decodeFromBipack<String>())
+        println("plain: ${plain.keys}")
+        assertEquals(setOf("hello"), storage.keys)
+        var foo by storage.stored("bar")
+        assertEquals("bar", foo)
+        foo = "bar2"
+//        plain.dump()
+//        storage.dump()
+        assertEquals(setOf("hello", "foo"), storage.keys)
+    }
+
+    @Test
+    fun testReEncrypt() = runTest {
+        initCrypto()
+        fun test(x: KVStorage) {
+            val foo by x.stored("1")
+            val bar by x.stored("2")
+            val bazz by x.stored("3")
+            assertEquals("foo", foo)
+            assertEquals("bar", bar)
+            assertEquals("bazz", bazz)
+        }
+
+        fun setup(s: KVStorage, k: SymmetricKey): EncryptedKVStorage {
+            val x = EncryptedKVStorage(s, k, removeExisting = false)
+            var foo by x.stored("1")
+            var bar by x.stored("2")
+            var bazz by x.stored("3")
+            foo = "foo"
+            bar = "bar"
+            bazz = "bazz"
+            return x
+        }
+
+        val k1 = SymmetricKey.new()
+        val k2 = SymmetricKey.new()
+        val plain = MemoryKVStorage()
+        val s1 = setup(plain, k1)
+        test(s1)
+        s1.reEncrypt(k2)
+        test(s1)
+//        val s2  = EncryptedKVStorage(plain, k2)
+//        test(s2)
+    }
+
+    @Test
+    fun testDeleteExisting() = runTest {
+        initCrypto()
+        val plain = MemoryKVStorage()
+        val c1 = EncryptedKVStorage(plain, SymmetricKey.new(), removeExisting = false)  // 1
+        c1.write("hello", "world")
+        assertFailsWith<DecryptionFailedException> {
+            EncryptedKVStorage(plain, SymmetricKey.new(), removeExisting = false)  // 2
+        }
+        EncryptedKVStorage(plain, SymmetricKey.new(), removeExisting = true)  // 2
+    }
+}
+
+@Suppress("unused")
+fun KVStorage.dump() {
+    for (k in keys)
+        println("$k: ${this[k]?.toDump()}")
+}
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import kotlinx.coroutines.test.runTest
 import net.sergeych.bintools.encodeToHex
 import net.sergeych.crypto2.BinaryId
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import kotlin.test.fail

 inline fun <reified T: Throwable>assertThrows(f: ()->Unit): T {
@@ -1,3 +1,13 @@
+/*
+ * Copyright (c) 2025. Sergey S. Chernov - All Rights Reserved
+ *
+ *  You may use, distribute and modify this code under the
+ * terms of the private license, which you must obtain from the author
+ *
+ * To obtain the license, contact the author: https://t.me/real_sergeych or email to
+ * real dot sergeych at gmail.
+ */
+
 import net.sergeych.bipack.BipackDecoder
 import net.sergeych.bipack.BipackEncoder
Author	SHA1	Message	Date
sergeych	13dff8d760	v0.9.0: kotlin 2.2.21, kotlin.time fix for deprecated methods in kotlinx.datetime. Should work ok on mac/ios	2025-12-16 19:13:27 +01:00
sergeych	3bd06ac7ff	added Container.decryptWithPassword	2025-12-04 12:14:07 +01:00
sergeych	ca9ab0f7a0	0.8.5: upgrade kotlin & dependencies	2025-10-24 18:05:25 +02:00
sergeych	b86ac6f00b	0.8.4 for all platforms	2025-03-27 00:17:59 +03:00
sergeych	9d338d2f13	merging	2025-03-27 00:14:32 +03:00
sergeych	5228be33ee	fixed README.md	2025-03-26 23:45:31 +03:00
sergeych	528439f61d	0.8.3 for all platforms	2025-03-26 23:38:40 +03:00
sergeych	7c97a843e7	Merge pull request 'multiplatform-crypto-libsodium-bindings version with all targets' (#11 ) from YoungBlood/crypto2:master into master Reviewed-on: #11	2025-03-25 21:05:37 +03:00
kildishevps	1a81cd5110	multiplatform-crypto-libsodium-bindings version with all targets	2025-03-24 00:53:28 +03:00
sergeych	7d3e396cf7	dependency simplified	2025-03-16 22:29:22 +03:00
sergeych	85b13ed8ca	EncryptedKVStorage: can destroy exisint creating one with a new key	2025-03-16 16:53:05 +03:00
sergeych	fbbe4d3a34	EncryptedKVStorage: can destroy exisint creating one with a new key	2025-03-16 16:52:26 +03:00
sergeych	875c0f7a50	fix #10 KDF.Complexity derivation functions now require salt	2025-03-12 23:39:26 +03:00
sergeych	fe6190eb8d	+EncryptedKVStorage	2025-03-12 23:00:40 +03:00
sergeych	776f4e75ff	0.8.3-SNAPSHOT use updated bintools	2025-03-08 02:11:13 +03:00
sergeych	fa7263b0e7	0.8.3-SNAPSHOT uaw mp_bintools bytechunk for compatibility	2025-03-08 01:53:35 +03:00
sergeych	bd81f88dd8	0.8.2-SNAPSHOT support for wasmJs using youngblood, no mingw yet	2025-03-07 15:14:54 +03:00
sergeych	6fcf7841a7	Merge pull request 'Change multiplatform-crypto-libsodium-bindings version and bring wasmJs back' (#9 ) from YoungBlood/crypto2:master into master Reviewed-on: #9	2025-03-07 09:31:04 +03:00
kildishevps	4748ea0d65	Change commonMain multiplatform-crypto-libsodium-bindings version and bring wasmJs back	2025-03-03 12:48:10 +03:00
sergeych	e2d4fb07ad	0.7.4-SNAPSHOT back to no wasm; public/secret key renamed with compatibility aliases and deprecation warnings	2025-02-24 09:26:11 +03:00
sergeych	d180da309b	added copyright, license mention and other #10x2linus stuff.	2025-02-20 12:21:42 +03:00
sergeych	c9e3c57ee2	0.8.1 started: experimental support of the wasmJS target.	2025-02-13 10:04:16 +03:00
sergeych	81e02ac88e	Merge pull request 'Fixing multiplatform-crypto-libsodium-bindings dependencies' (#8 ) from YoungBlood/crypto2:master into master Reviewed-on: #8	2025-02-13 09:54:58 +03:00
kildishevps	e8d6b2fc02	Fixing multiplatform-crypto-libsodium-bindings dependencies	2025-02-09 21:59:28 +03:00
sergeych	277dc62553	Merge pull request 'Add wasmJs target' (#7 ) from YoungBlood/crypto2:master into master Reviewed-on: #7	2025-02-09 16:57:38 +03:00
PlaceboAddict	7e52a72c6a	Add wasmJs target	2025-02-05 16:39:10 +03:00
sergeych	7fa3ab1ca8	seal now allows up to 45s in future to tolerate some time difference	2025-02-03 17:13:28 +03:00
sergeych	242cc7d0f5	more tests	2024-11-29 15:42:54 +07:00