# crypto2 0.9.6-SNAPSHOT

SafeKeyExchange now rejects peer public keys whose encoded length is not exactly
32 bytes before calling native bindings. Low-order DH rejection remains delegated
to libsodium crypto_kx; its failure already propagates through the Kotlin bindings.
Regression tests cover low-order inputs (including nonzero inputs and high-bit
aliases), malformed lengths, and valid bidirectional exchange.

This snapshot retains the distinct-signer threshold fix described in
[SECURITY-0.9.5.md](SECURITY-0.9.5.md). Wire formats are unchanged.

Validation: all 67 JVM tests and all 67 Linux x64 Native tests passed. The three
focused JavaScript/Node tests fail during initialization with the previously
documented `_sodium_init is not a function` loader error, before exercising DH.
Other platform runtimes were not qualified. This snapshot does not fix the JS loader.