crypto2/RELEASE-0.9.6-SNAPSHOT.md

crypto2 0.9.6-SNAPSHOT

SafeKeyExchange now rejects peer public keys whose encoded length is not exactly 32 bytes before calling native bindings. Low-order DH rejection remains delegated to libsodium crypto_kx; its failure already propagates through the Kotlin bindings. Regression tests cover low-order inputs (including nonzero inputs and high-bit aliases), malformed lengths, and valid bidirectional exchange.

This snapshot retains the distinct-signer threshold fix described in SECURITY-0.9.5.md. Wire formats are unchanged.

Validation: all 67 JVM tests and all 67 Linux x64 Native tests passed. The three focused JavaScript/Node tests fail during initialization with the previously documented _sodium_init is not a function loader error, before exercising DH. Other platform runtimes were not qualified. This snapshot does not fix the JS loader.