Refactor KeyManager and TagRecogniser. #55

briar-android/src/org/briarproject/android/AndroidNotificationManagerImpl.java

@@ -32,7 +32,6 @@ import org.briarproject.api.event.Event;
 import org.briarproject.api.event.EventBus;
 import org.briarproject.api.event.EventListener;
 import org.briarproject.api.event.SettingsUpdatedEvent;
-import org.briarproject.api.lifecycle.Service;
 import org.briarproject.api.messaging.GroupId;
 import org.briarproject.util.StringUtils;
 
@@ -45,7 +44,7 @@ import android.support.v4.app.NotificationCompat;
 import android.support.v4.app.TaskStackBuilder;
 
 class AndroidNotificationManagerImpl implements AndroidNotificationManager,
-Service, EventListener {
+EventListener {
 
 	private static final int PRIVATE_MESSAGE_NOTIFICATION_ID = 3;
 	private static final int GROUP_POST_NOTIFICATION_ID = 4;

briar-api/src/org/briarproject/api/android/AndroidNotificationManager.java

@@ -1,13 +1,14 @@
 package org.briarproject.api.android;
 
 import org.briarproject.api.ContactId;
+import org.briarproject.api.lifecycle.Service;
 import org.briarproject.api.messaging.GroupId;
 
 /**
  * Manages notifications for private messages and group posts. All methods must
  * be called from the Android UI thread.
  */
-public interface AndroidNotificationManager {
+public interface AndroidNotificationManager extends Service {
 
 	public void showPrivateMessageNotification(ContactId c);
 

briar-api/src/org/briarproject/api/crypto/CryptoComponent.java

@@ -1,5 +1,8 @@
 package org.briarproject.api.crypto;
 
+import org.briarproject.api.TransportId;
+import org.briarproject.api.transport.TransportKeys;
+
 import java.security.GeneralSecurityException;
 import java.security.SecureRandom;
 
@@ -26,56 +29,50 @@ public interface CryptoComponent {
 	/** Generates a random invitation code. */
 	int generateInvitationCode();
 
-	/**
-	 * Derives two confirmation codes from the given master secret. The first
-	 * code is for Alice to give to Bob; the second is for Bob to give to
-	 * Alice.
-	 */
-	int[] deriveConfirmationCodes(byte[] secret);
-
-	/**
-	 * Derives two nonces from the given master secret. The first nonce is for
-	 * Alice to sign; the second is for Bob to sign.
-	 */
-	byte[][] deriveInvitationNonces(byte[] secret);
-
 	/**
 	 * Derives a shared master secret from two public keys and one of the
 	 * corresponding private keys.
-	 * @param alice indicates whether the private key belongs to Alice or Bob.
+	 * @param alice whether the private key belongs to Alice or Bob.
 	 */
-	byte[] deriveMasterSecret(byte[] theirPublicKey, KeyPair ourKeyPair,
+	SecretKey deriveMasterSecret(byte[] theirPublicKey, KeyPair ourKeyPair,
 			boolean alice) throws GeneralSecurityException;
 
-	/** Derives a group salt from the given master secret. */
+	/**
-	byte[] deriveGroupSalt(byte[] secret);
+	 * Derives a confirmation code from the given master secret.
+	 * @param alice whether the code is for use by Alice or Bob.
+	 */
+	int deriveConfirmationCode(SecretKey master, boolean alice);
 
 	/**
-	 * Derives an initial secret for the given transport from the given master
+	 * Derives a header key for an invitation stream from the given master
 	 * secret.
+	 * @param alice whether the key is for use by Alice or Bob.
 	 */
-	byte[] deriveInitialSecret(byte[] secret, int transportIndex);
+	SecretKey deriveInvitationKey(SecretKey master, boolean alice);
 
 	/**
-	 * Derives a temporary secret for the given period from the given secret,
+	 * Derives a nonce from the given master secret for one of the parties to
-	 * which is either the initial shared secret or the previous period's
+	 * sign.
-	 * temporary secret.
+	 * @param alice whether the nonce is for use by Alice or Bob.
 	 */
-	byte[] deriveNextSecret(byte[] secret, long period);
+	byte[] deriveSignatureNonce(SecretKey master, boolean alice);
+
+	/** Derives a group salt from the given master secret. */
+	byte[] deriveGroupSalt(SecretKey master);
 
 	/**
-	 * Derives a tag key from the given temporary secret.
+	 * Derives initial transport keys for the given transport in the given
-	 * @param alice indicates whether the key is for streams initiated by
+	 * rotation period from the given master secret.
-	 * Alice or Bob.
+	 * @param alice whether the keys are for use by Alice or Bob.
 	 */
-	SecretKey deriveTagKey(byte[] secret, boolean alice);
+	TransportKeys deriveTransportKeys(TransportId t, SecretKey master,
+			long rotationPeriod, boolean alice);
 
 	/**
-	 * Derives a frame key from the given temporary secret and stream number.
+	 * Rotates the given transport keys to the given rotation period. If the
-	 * @param alice indicates whether the key is for a stream initiated by
+	 * keys are for a future rotation period they are not rotated.
-	 * Alice or Bob.
 	 */
-	SecretKey deriveFrameKey(byte[] secret, long streamNumber, boolean alice);
+	TransportKeys rotateTransportKeys(TransportKeys k, long rotationPeriod);
 
 	/** Encodes the pseudo-random tag that is used to recognise a stream. */
 	void encodeTag(byte[] tag, SecretKey tagKey, long streamNumber);

briar-api/src/org/briarproject/api/crypto/KeyManager.java

@@ -1,21 +0,0 @@
-package org.briarproject.api.crypto;
-
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.lifecycle.Service;
-import org.briarproject.api.transport.Endpoint;
-import org.briarproject.api.transport.StreamContext;
-
-public interface KeyManager extends Service {
-
-	/**
-	 * Returns a {@link org.briarproject.api.transport.StreamContext
-	 * StreamContext} for sending data to the given contact over the given
-	 * transport, or null if an error occurs or the contact does not support
-	 * the transport.
-	 */
-	StreamContext getStreamContext(ContactId c, TransportId t);
-
-	/** Called whenever an endpoint has been added. */
-	void endpointAdded(Endpoint ep, int maxLatency, byte[] initialSecret);
-}

briar-api/src/org/briarproject/api/crypto/StreamDecrypterFactory.java

@@ -13,5 +13,5 @@ public interface StreamDecrypterFactory {
 	 * Creates a {@link StreamDecrypter} for decrypting an invitation stream.
 	 */
 	StreamDecrypter createInvitationStreamDecrypter(InputStream in,
-			byte[] secret, boolean alice);
+			SecretKey headerKey);
 }

briar-api/src/org/briarproject/api/crypto/StreamEncrypterFactory.java

@@ -13,5 +13,5 @@ public interface StreamEncrypterFactory {
 	 * Creates a {@link StreamEncrypter} for encrypting an invitation stream.
 	 */
 	StreamEncrypter createInvitationStreamEncrypter(OutputStream out,
-			byte[] secret, boolean alice);
+			SecretKey headerKey);
 }

briar-api/src/org/briarproject/api/db/DatabaseComponent.java

@@ -1,9 +1,5 @@
 package org.briarproject.api.db;
 
-import java.io.IOException;
-import java.util.Collection;
-import java.util.Map;
-
 import org.briarproject.api.Author;
 import org.briarproject.api.AuthorId;
 import org.briarproject.api.Contact;
@@ -26,8 +22,11 @@ import org.briarproject.api.messaging.SubscriptionAck;
 import org.briarproject.api.messaging.SubscriptionUpdate;
 import org.briarproject.api.messaging.TransportAck;
 import org.briarproject.api.messaging.TransportUpdate;
-import org.briarproject.api.transport.Endpoint;
+import org.briarproject.api.transport.TransportKeys;
-import org.briarproject.api.transport.TemporarySecret;
+
+import java.io.IOException;
+import java.util.Collection;
+import java.util.Map;
 
 /**
  * Encapsulates the database implementation and exposes high-level operations
@@ -47,9 +46,6 @@ public interface DatabaseComponent {
 	 */
 	ContactId addContact(Author remote, AuthorId local) throws DbException;
 
-	/** Stores an endpoint. */
-	void addEndpoint(Endpoint ep) throws DbException;
-
 	/**
 	 * Subscribes to a group, or returns false if the user already has the
 	 * maximum number of public subscriptions.
@@ -62,18 +58,17 @@ public interface DatabaseComponent {
 	/** Stores a local message. */
 	void addLocalMessage(Message m) throws DbException;
 
-	/**
-	 * Stores the given temporary secrets and deletes any secrets that have
-	 * been made obsolete.
-	 */
-	void addSecrets(Collection<TemporarySecret> secrets) throws DbException;
-
 	/**
 	 * Stores a transport and returns true if the transport was not previously
 	 * in the database.
 	 */
 	boolean addTransport(TransportId t, int maxLatency) throws DbException;
 
+	/**
+	 * Stores the given transport keys for a newly added contact.
+	 */
+	void addTransportKeys(ContactId c, TransportKeys k) throws DbException;
+
 	/**
 	 * Returns an acknowledgement for the given contact, or null if there are
 	 * no messages to acknowledge.
@@ -214,16 +209,17 @@ public interface DatabaseComponent {
 	Map<ContactId, TransportProperties> getRemoteProperties(TransportId t)
 			throws DbException;
 
-	/** Returns all temporary secrets. */
-	Collection<TemporarySecret> getSecrets() throws DbException;
-
 	/** Returns all settings. */
 	Settings getSettings() throws DbException;
 
 	/** Returns all contacts who subscribe to the given group. */
 	Collection<Contact> getSubscribers(GroupId g) throws DbException;
 
-	/** Returns the maximum latencies of all supported transports. */
+	/** Returns all transport keys for the given transport. */
+	Map<ContactId, TransportKeys> getTransportKeys(TransportId t)
+			throws DbException;
+
+	/** Returns the maximum latencies in milliseconds of all transports. */
 	Map<TransportId, Integer> getTransportLatencies() throws DbException;
 
 	/** Returns the number of unread messages in each subscribed group. */
@@ -233,11 +229,10 @@ public interface DatabaseComponent {
 	Collection<ContactId> getVisibility(GroupId g) throws DbException;
 
 	/**
-	 * Increments the outgoing stream counter for the given endpoint in the
+	 * Increments the outgoing stream counter for the given contact and
-	 * given rotation period and returns the old value, or -1 if the counter
+	 * transport in the given rotation period .
-	 * does not exist.
 	 */
-	long incrementStreamCounter(ContactId c, TransportId t, long period)
+	void incrementStreamCounter(ContactId c, TransportId t, long rotationPeriod)
 			throws DbException;
 
 	/**
@@ -310,18 +305,11 @@ public interface DatabaseComponent {
 	 */
 	void removeTransport(TransportId t) throws DbException;
 
-	/**
-	 * Sets the reordering window for the given endpoint in the given rotation
-	 * period.
-	 */
-	void setReorderingWindow(ContactId c, TransportId t, long period,
-			long centre, byte[] bitmap) throws DbException;
-
 	/**
 	 * Makes a group visible to the given contact, adds it to the contact's
 	 * subscriptions, and sets it as the inbox group for the contact.
 	 */
-	public void setInboxGroup(ContactId c, Group g) throws DbException;
+	void setInboxGroup(ContactId c, Group g) throws DbException;
 
 	/**
 	 * Marks a message as read or unread.
@@ -335,6 +323,13 @@ public interface DatabaseComponent {
 	void setRemoteProperties(ContactId c,
 			Map<TransportId, TransportProperties> p) throws DbException;
 
+	/**
+	 * Sets the reordering window for the given contact and transport in the
+	 * given rotation period.
+	 */
+	void setReorderingWindow(ContactId c, TransportId t, long rotationPeriod,
+			long base, byte[] bitmap) throws DbException;
+
 	/**
 	 * Makes a group visible to the given set of contacts and invisible to any
 	 * other current or future contacts.
@@ -347,4 +342,10 @@ public interface DatabaseComponent {
 	 * to future contacts.
 	 */
 	void setVisibleToAll(GroupId g, boolean all) throws DbException;
+
+	/**
+	 * Stores the given transport keys, deleting any keys they have replaced.
+	 */
+	void updateTransportKeys(Map<ContactId, TransportKeys> keys)
+			throws DbException;
 }

briar-api/src/org/briarproject/api/messaging/Message.java

@@ -28,7 +28,7 @@ public interface Message {
 	/** Returns the message's content type. */
 	String getContentType();
 
-	/** Returns the message's timestamp. */
+	/** Returns the message's timestamp in milliseconds since the Unix epoch. */
 	long getTimestamp();
 
 	/** Returns the serialised message. */

briar-api/src/org/briarproject/api/transport/Endpoint.java

@@ -1,36 +0,0 @@
-package org.briarproject.api.transport;
-
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-
-public class Endpoint {
-
-	protected final ContactId contactId;
-	protected final TransportId transportId;
-	private final long epoch;
-	private final boolean alice;
-
-	public Endpoint(ContactId contactId, TransportId transportId, long epoch,
-			boolean alice) {
-		this.contactId = contactId;
-		this.transportId = transportId;
-		this.epoch = epoch;
-		this.alice = alice;
-	}
-
-	public ContactId getContactId() {
-		return contactId;
-	}
-
-	public TransportId getTransportId() {
-		return transportId;
-	}
-
-	public long getEpoch() {
-		return epoch;
-	}
-
-	public boolean getAlice() {
-		return alice;
-	}
-}

briar-api/src/org/briarproject/api/transport/IncomingKeys.java

@@ -0,0 +1,51 @@
+package org.briarproject.api.transport;
+
+import org.briarproject.api.crypto.SecretKey;
+
+import static org.briarproject.api.transport.TransportConstants.REORDERING_WINDOW_SIZE;
+
+/**
+ * Contains transport keys for receiving streams from a given contact over a
+ * given transport in a given rotation period.
+ */
+public class IncomingKeys {
+
+	private final SecretKey tagKey, headerKey;
+	private final long rotationPeriod, windowBase;
+	private final byte[] windowBitmap;
+
+	public IncomingKeys(SecretKey tagKey, SecretKey headerKey,
+			long rotationPeriod) {
+		this(tagKey, headerKey, rotationPeriod, 0,
+				new byte[REORDERING_WINDOW_SIZE / 8]);
+	}
+
+	public IncomingKeys(SecretKey tagKey, SecretKey headerKey,
+			long rotationPeriod, long windowBase, byte[] windowBitmap) {
+		this.tagKey = tagKey;
+		this.headerKey = headerKey;
+		this.rotationPeriod = rotationPeriod;
+		this.windowBase = windowBase;
+		this.windowBitmap = windowBitmap;
+	}
+
+	public SecretKey getTagKey() {
+		return tagKey;
+	}
+
+	public SecretKey getHeaderKey() {
+		return headerKey;
+	}
+
+	public long getRotationPeriod() {
+		return rotationPeriod;
+	}
+
+	public long getWindowBase() {
+		return windowBase;
+	}
+
+	public byte[] getWindowBitmap() {
+		return windowBitmap;
+	}
+}

briar-api/src/org/briarproject/api/transport/KeyManager.java

@@ -0,0 +1,36 @@
+package org.briarproject.api.transport;
+
+import org.briarproject.api.ContactId;
+import org.briarproject.api.TransportId;
+import org.briarproject.api.db.DbException;
+import org.briarproject.api.lifecycle.Service;
+
+import java.util.Collection;
+
+/**
+ * Responsible for managing transport keys and recognising the pseudo-random
+ * tags of incoming streams.
+ */
+public interface KeyManager extends Service {
+
+	/**
+	 * Informs the key manager that a new contact has been added.
+	 * {@link StreamContext StreamContexts} for the contact can be created
+	 * after this method has returned.
+	 */
+	void contactAdded(ContactId c, Collection<TransportKeys> keys);
+
+	/**
+	 * Returns a {@link StreamContext} for sending a stream to the given
+	 * contact over the given transport, or null if an error occurs or the
+	 * contact does not support the transport.
+	 */
+	StreamContext getStreamContext(ContactId c, TransportId t);
+
+	/**
+	 * Looks up the given tag and returns a {@link StreamContext} for reading
+	 * from the corresponding stream if the tag was expected, or null if the
+	 * tag was unexpected.
+	 */
+	StreamContext recogniseTag(TransportId t, byte[] tag) throws DbException;
+}

briar-api/src/org/briarproject/api/transport/OutgoingKeys.java

@@ -0,0 +1,42 @@
+package org.briarproject.api.transport;
+
+import org.briarproject.api.crypto.SecretKey;
+
+/**
+ * Contains transport keys for sending streams to a given contact over a given
+ * transport in a given rotation period.
+ */
+public class OutgoingKeys {
+
+	private final SecretKey tagKey, headerKey;
+	private final long rotationPeriod, streamCounter;
+
+	public OutgoingKeys(SecretKey tagKey, SecretKey headerKey,
+			long rotationPeriod) {
+		this(tagKey, headerKey, rotationPeriod, 0);
+	}
+
+	public OutgoingKeys(SecretKey tagKey, SecretKey headerKey,
+			long rotationPeriod, long streamCounter) {
+		this.tagKey = tagKey;
+		this.headerKey = headerKey;
+		this.rotationPeriod = rotationPeriod;
+		this.streamCounter = streamCounter;
+	}
+
+	public SecretKey getTagKey() {
+		return tagKey;
+	}
+
+	public SecretKey getHeaderKey() {
+		return headerKey;
+	}
+
+	public long getRotationPeriod() {
+		return rotationPeriod;
+	}
+
+	public long getStreamCounter() {
+		return streamCounter;
+	}
+}

briar-api/src/org/briarproject/api/transport/StreamContext.java

@@ -2,22 +2,22 @@ package org.briarproject.api.transport;
 
 import org.briarproject.api.ContactId;
 import org.briarproject.api.TransportId;
+import org.briarproject.api.crypto.SecretKey;
 
 public class StreamContext {
 
 	private final ContactId contactId;
 	private final TransportId transportId;
-	private final byte[] secret;
+	private final SecretKey tagKey, headerKey;
 	private final long streamNumber;
-	private final boolean alice;
 
 	public StreamContext(ContactId contactId, TransportId transportId,
-			byte[] secret, long streamNumber, boolean alice) {
+			SecretKey tagKey, SecretKey headerKey, long streamNumber) {
 		this.contactId = contactId;
 		this.transportId = transportId;
-		this.secret = secret;
+		this.tagKey = tagKey;
+		this.headerKey = headerKey;
 		this.streamNumber = streamNumber;
-		this.alice = alice;
 	}
 
 	public ContactId getContactId() {
@@ -28,15 +28,15 @@ public class StreamContext {
 		return transportId;
 	}
 
-	public byte[] getSecret() {
+	public SecretKey getTagKey() {
-		return secret;
+		return tagKey;
+	}
+
+	public SecretKey getHeaderKey() {
+		return headerKey;
 	}
 
 	public long getStreamNumber() {
 		return streamNumber;
 	}
-
-	public boolean getAlice() {
-		return alice;
-	}
 }

briar-api/src/org/briarproject/api/transport/StreamReaderFactory.java

@@ -2,6 +2,8 @@ package org.briarproject.api.transport;
 
 import java.io.InputStream;
 
+import org.briarproject.api.crypto.SecretKey;
+
 public interface StreamReaderFactory {
 
 	/**
@@ -15,5 +17,5 @@ public interface StreamReaderFactory {
 	 * invitation stream.
 	 */
 	InputStream createInvitationStreamReader(InputStream in,
-			byte[] secret, boolean alice);
+			SecretKey headerKey);
 }

briar-api/src/org/briarproject/api/transport/StreamWriterFactory.java

@@ -2,6 +2,8 @@ package org.briarproject.api.transport;
 
 import java.io.OutputStream;
 
+import org.briarproject.api.crypto.SecretKey;
+
 public interface StreamWriterFactory {
 
 	/**
@@ -15,5 +17,5 @@ public interface StreamWriterFactory {
 	 * invitation stream.
 	 */
 	OutputStream createInvitationStreamWriter(OutputStream out,
-			byte[] secret, boolean alice);
+			SecretKey headerKey);
 }

briar-api/src/org/briarproject/api/transport/TagRecogniser.java

@@ -1,26 +0,0 @@
-package org.briarproject.api.transport;
-
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.db.DbException;
-
-/** Keeps track of expected tags and uses them to recognise incoming streams. */
-public interface TagRecogniser {
-
-	/**
-	 * Looks up the given tag and returns a {@link StreamContext} for reading
-	 * from the stream if the tag was expected, or null if the tag was
-	 * unexpected.
-	 */
-	StreamContext recogniseTag(TransportId t, byte[] tag) throws DbException;
-
-	void addSecret(TemporarySecret s);
-
-	void removeSecret(ContactId c, TransportId t, long period);
-
-	void removeSecrets(ContactId c);
-
-	void removeSecrets(TransportId t);
-
-	void removeSecrets();
-}

briar-api/src/org/briarproject/api/transport/TemporarySecret.java

@@ -1,73 +0,0 @@
-package org.briarproject.api.transport;
-
-import static org.briarproject.api.transport.TransportConstants.REORDERING_WINDOW_SIZE;
-
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-
-public class TemporarySecret extends Endpoint {
-
-	private final long period, outgoing, centre;
-	private final byte[] secret, bitmap;
-
-	/** Creates a temporary secret with the given reordering window. */
-	public TemporarySecret(ContactId contactId, TransportId transportId,
-			long epoch, boolean alice, long period, byte[] secret,
-			long outgoing, long centre, byte[] bitmap) {
-		super(contactId, transportId, epoch, alice);
-		this.period = period;
-		this.secret = secret;
-		this.outgoing = outgoing;
-		this.centre = centre;
-		this.bitmap = bitmap;
-	}
-
-	/** Creates a temporary secret with a new reordering window. */
-	public TemporarySecret(ContactId contactId, TransportId transportId,
-			long epoch, boolean alice, long period, byte[] secret) {
-		this(contactId, transportId, epoch, alice, period, secret, 0, 0,
-				new byte[REORDERING_WINDOW_SIZE / 8]);
-	}
-
-	/** Creates a temporary secret derived from the given endpoint. */
-	public TemporarySecret(Endpoint ep, long period, byte[] secret) {
-		this(ep.getContactId(), ep.getTransportId(), ep.getEpoch(),
-				ep.getAlice(), period, secret);
-	}
-
-	public long getPeriod() {
-		return period;
-	}
-
-	public byte[] getSecret() {
-		return secret;
-	}
-
-	public long getOutgoingStreamCounter() {
-		return outgoing;
-	}
-
-	public long getWindowCentre() {
-		return centre;
-	}
-
-	public byte[] getWindowBitmap() {
-		return bitmap;
-	}
-
-	@Override
-	public int hashCode() {
-		int periodHashCode = (int) (period ^ (period >>> 32));
-		return contactId.hashCode() ^ transportId.hashCode() ^ periodHashCode;
-	}
-
-	@Override
-	public boolean equals(Object o) {
-		if (o instanceof TemporarySecret) {
-			TemporarySecret s = (TemporarySecret) o;
-			return contactId.equals(s.contactId) &&
-					transportId.equals(s.transportId) && period == s.period;
-		}
-		return false;
-	}
-}

briar-api/src/org/briarproject/api/transport/TransportConstants.java

@@ -28,8 +28,8 @@ public interface TransportConstants {
 	 */
 	int MIN_STREAM_LENGTH = 64 * 1024; // 64 KiB
 
-	/** The maximum difference between two communicating devices' clocks. */
+	/** The maximum difference in milliseconds between two peers' clocks. */
-	int MAX_CLOCK_DIFFERENCE = 60 * 60 * 1000; // 1 hour
+	int MAX_CLOCK_DIFFERENCE = 24 * 60 * 60 * 1000; // 24 hours
 
 	/** The size of the reordering window. */
 	int REORDERING_WINDOW_SIZE = 32;

briar-api/src/org/briarproject/api/transport/TransportKeys.java

@@ -0,0 +1,44 @@
+package org.briarproject.api.transport;
+
+import org.briarproject.api.TransportId;
+
+/** Keys for communicating with a given contact over a given transport. */
+public class TransportKeys {
+
+	private final TransportId transportId;
+	private final IncomingKeys inPrev, inCurr, inNext;
+	private final OutgoingKeys outCurr;
+
+	public TransportKeys(TransportId transportId, IncomingKeys inPrev,
+			IncomingKeys inCurr, IncomingKeys inNext, OutgoingKeys outCurr) {
+		this.transportId = transportId;
+		this.inPrev = inPrev;
+		this.inCurr = inCurr;
+		this.inNext = inNext;
+		this.outCurr = outCurr;
+	}
+
+	public TransportId getTransportId() {
+		return transportId;
+	}
+
+	public IncomingKeys getPreviousIncomingKeys() {
+		return inPrev;
+	}
+
+	public IncomingKeys getCurrentIncomingKeys() {
+		return inCurr;
+	}
+
+	public IncomingKeys getNextIncomingKeys() {
+		return inNext;
+	}
+
+	public OutgoingKeys getCurrentOutgoingKeys() {
+		return outCurr;
+	}
+
+	public long getRotationPeriod() {
+		return outCurr.getRotationPeriod();
+	}
+}

briar-core/src/org/briarproject/crypto/CryptoComponentImpl.java

@@ -1,20 +1,6 @@
 package org.briarproject.crypto;
 
-import static java.util.logging.Level.INFO;
+import org.briarproject.api.TransportId;
-import static org.briarproject.api.invitation.InvitationConstants.CODE_BITS;
-import static org.briarproject.api.transport.TransportConstants.TAG_LENGTH;
-import static org.briarproject.crypto.EllipticCurveConstants.PARAMETERS;
-import static org.briarproject.util.ByteUtils.MAX_32_BIT_UNSIGNED;
-
-import java.security.GeneralSecurityException;
-import java.security.SecureRandom;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.logging.Logger;
-
-import javax.inject.Inject;
-
 import org.briarproject.api.crypto.CryptoComponent;
 import org.briarproject.api.crypto.KeyPair;
 import org.briarproject.api.crypto.KeyParser;
@@ -25,6 +11,9 @@ import org.briarproject.api.crypto.PublicKey;
 import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.crypto.Signature;
 import org.briarproject.api.system.SeedProvider;
+import org.briarproject.api.transport.IncomingKeys;
+import org.briarproject.api.transport.OutgoingKeys;
+import org.briarproject.api.transport.TransportKeys;
 import org.briarproject.util.ByteUtils;
 import org.briarproject.util.StringUtils;
 import org.spongycastle.crypto.AsymmetricCipherKeyPair;
@@ -43,6 +32,21 @@ import org.spongycastle.crypto.params.ECPrivateKeyParameters;
 import org.spongycastle.crypto.params.ECPublicKeyParameters;
 import org.spongycastle.crypto.params.KeyParameter;
 
+import java.security.GeneralSecurityException;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.logging.Logger;
+
+import javax.inject.Inject;
+
+import static java.util.logging.Level.INFO;
+import static org.briarproject.api.invitation.InvitationConstants.CODE_BITS;
+import static org.briarproject.api.transport.TransportConstants.TAG_LENGTH;
+import static org.briarproject.crypto.EllipticCurveConstants.PARAMETERS;
+import static org.briarproject.util.ByteUtils.MAX_32_BIT_UNSIGNED;
+
 class CryptoComponentImpl implements CryptoComponent {
 
 	private static final Logger LOG =
@@ -55,22 +59,33 @@ class CryptoComponentImpl implements CryptoComponent {
 	private static final int PBKDF_TARGET_MILLIS = 500;
 	private static final int PBKDF_SAMPLES = 30;
 
-	// Labels for secret derivation
+	// KDF label for master key derivation
-	private static final byte[] MASTER = { 'M', 'A', 'S', 'T', 'E', 'R', '\0' };
+	private static final byte[] MASTER = { 'M', 'A', 'S', 'T', 'E', 'R' };
-	private static final byte[] SALT = { 'S', 'A', 'L', 'T', '\0' };
+	// KDF labels for confirmation code derivation
-	private static final byte[] FIRST = { 'F', 'I', 'R', 'S', 'T', '\0' };
+	private static final byte[] A_CONFIRM =
-	private static final byte[] ROTATE = { 'R', 'O', 'T', 'A', 'T', 'E', '\0' };
+			{ 'A', '_', 'C', 'O', 'N', 'F', 'I', 'R', 'M' };
-	// Label for confirmation code derivation
+	private static final byte[] B_CONFIRM =
-	private static final byte[] CODE = { 'C', 'O', 'D', 'E', '\0' };
+			{ 'B', '_', 'C', 'O', 'N', 'F', 'I', 'R', 'M' };
-	// Label for invitation nonce derivation
+	// KDF labels for invitation stream header key derivation
-	private static final byte[] NONCE = { 'N', 'O', 'N', 'C', 'E', '\0' };
+	private static final byte[] A_INVITE =
-	// Labels for key derivation
+			{ 'A', '_', 'I', 'N', 'V', 'I', 'T', 'E' };
-	private static final byte[] A_TAG = { 'A', '_', 'T', 'A', 'G', '\0' };
+	private static final byte[] B_INVITE =
-	private static final byte[] B_TAG = { 'B', '_', 'T', 'A', 'G', '\0' };
+			{ 'B', '_', 'I', 'N', 'V', 'I', 'T', 'E' };
-	private static final byte[] A_FRAME =
+	// KDF labels for signature nonce derivation
-		{ 'A', '_', 'F', 'R', 'A', 'M', 'E', '\0' };
+	private static final byte[] A_NONCE = { 'A', '_', 'N', 'O', 'N', 'C', 'E' };
-	private static final byte[] B_FRAME =
+	private static final byte[] B_NONCE = { 'B', '_', 'N', 'O', 'N', 'C', 'E' };
-		{ 'B', '_', 'F', 'R', 'A', 'M', 'E', '\0' };
+	// KDF label for group salt derivation
+	private static final byte[] SALT = { 'S', 'A', 'L', 'T' };
+	// KDF labels for tag key derivation
+	private static final byte[] A_TAG = { 'A', '_', 'T', 'A', 'G' };
+	private static final byte[] B_TAG = { 'B', '_', 'T', 'A', 'G' };
+	// KDF labels for header key derivation
+	private static final byte[] A_HEADER =
+			{ 'A', '_', 'H', 'E', 'A', 'D', 'E', 'R' };
+	private static final byte[] B_HEADER =
+			{ 'B', '_', 'H', 'E', 'A', 'D', 'E', 'R' };
+	// KDF label for key rotation
+	private static final byte[] ROTATE = { 'R', 'O', 'T', 'A', 'T', 'E' };
 
 	private final SecureRandom secureRandom;
 	private final ECKeyPairGenerator agreementKeyPairGenerator;
@@ -167,26 +182,7 @@ class CryptoComponentImpl implements CryptoComponent {
 		return ByteUtils.readUint(random, CODE_BITS);
 	}
 
-	public int[] deriveConfirmationCodes(byte[] secret) {
+	public SecretKey deriveMasterSecret(byte[] theirPublicKey,
-		if (secret.length != SecretKey.LENGTH)
-			throw new IllegalArgumentException();
-		byte[] alice = counterModeKdf(secret, CODE, 0);
-		byte[] bob = counterModeKdf(secret, CODE, 1);
-		int[] codes = new int[2];
-		codes[0] = ByteUtils.readUint(alice, CODE_BITS);
-		codes[1] = ByteUtils.readUint(bob, CODE_BITS);
-		return codes;
-	}
-
-	public byte[][] deriveInvitationNonces(byte[] secret) {
-		if (secret.length != SecretKey.LENGTH)
-			throw new IllegalArgumentException();
-		byte[] alice = counterModeKdf(secret, NONCE, 0);
-		byte[] bob = counterModeKdf(secret, NONCE, 1);
-		return new byte[][] { alice, bob };
-	}
-
-	public byte[] deriveMasterSecret(byte[] theirPublicKey,
 			KeyPair ourKeyPair, boolean alice) throws GeneralSecurityException {
 		MessageDigest messageDigest = getMessageDigest();
 		byte[] ourPublicKey = ourKeyPair.getPublic().getEncoded();
@@ -204,9 +200,8 @@ class CryptoComponentImpl implements CryptoComponent {
 		PublicKey theirPub = agreementKeyParser.parsePublicKey(theirPublicKey);
 		// The raw secret comes from the key agreement algorithm
 		byte[] raw = deriveSharedSecret(ourPriv, theirPub);
-		// Derive the cooked secret from the raw secret using the
+		// Derive the master secret from the raw secret using the hash KDF
-		// concatenation KDF
+		return new SecretKey(hashKdf(raw, MASTER, aliceInfo, bobInfo));
-		return concatenationKdf(raw, MASTER, aliceInfo, bobInfo);
 	}
 
 	// Package access for testing
@@ -228,46 +223,90 @@ class CryptoComponentImpl implements CryptoComponent {
 		return secret;
 	}
 
-	public byte[] deriveGroupSalt(byte[] secret) {
+	public int deriveConfirmationCode(SecretKey master, boolean alice) {
-		if (secret.length != SecretKey.LENGTH)
+		byte[] b = macKdf(master, alice ? A_CONFIRM : B_CONFIRM);
-			throw new IllegalArgumentException();
+		return ByteUtils.readUint(b, CODE_BITS);
-		return counterModeKdf(secret, SALT, 0);
 	}
 
-	public byte[] deriveInitialSecret(byte[] secret, int transportIndex) {
+	public SecretKey deriveInvitationKey(SecretKey master, boolean alice) {
-		if (secret.length != SecretKey.LENGTH)
+		return new SecretKey(macKdf(master, alice ? A_INVITE : B_INVITE));
-			throw new IllegalArgumentException();
-		if (transportIndex < 0) throw new IllegalArgumentException();
-		return counterModeKdf(secret, FIRST, transportIndex);
 	}
 
-	public byte[] deriveNextSecret(byte[] secret, long period) {
+	public byte[] deriveSignatureNonce(SecretKey master, boolean alice) {
-		if (secret.length != SecretKey.LENGTH)
+		return macKdf(master, alice ? A_NONCE : B_NONCE);
-			throw new IllegalArgumentException();
-		if (period < 0 || period > MAX_32_BIT_UNSIGNED)
-			throw new IllegalArgumentException();
-		return counterModeKdf(secret, ROTATE, period);
 	}
 
-	public SecretKey deriveTagKey(byte[] secret, boolean alice) {
+	public byte[] deriveGroupSalt(SecretKey master) {
-		if (secret.length != SecretKey.LENGTH)
+		return macKdf(master, SALT);
-			throw new IllegalArgumentException();
-		if (alice) return deriveKey(secret, A_TAG, 0);
-		else return deriveKey(secret, B_TAG, 0);
 	}
 
-	public SecretKey deriveFrameKey(byte[] secret, long streamNumber,
+	public TransportKeys deriveTransportKeys(TransportId t,
+			SecretKey master, long rotationPeriod, boolean alice) {
+		// Keys for the previous period are derived from the master secret
+		SecretKey inTagPrev = deriveTagKey(master, t, !alice);
+		SecretKey inHeaderPrev = deriveHeaderKey(master, t, !alice);
+		SecretKey outTagPrev = deriveTagKey(master, t, alice);
+		SecretKey outHeaderPrev = deriveHeaderKey(master, t, alice);
+		// Derive the keys for the current and next periods
+		SecretKey inTagCurr = rotateKey(inTagPrev, rotationPeriod);
+		SecretKey inHeaderCurr = rotateKey(inHeaderPrev, rotationPeriod);
+		SecretKey inTagNext = rotateKey(inTagCurr, rotationPeriod + 1);
+		SecretKey inHeaderNext = rotateKey(inHeaderCurr, rotationPeriod + 1);
+		SecretKey outTagCurr = rotateKey(outTagPrev, rotationPeriod);
+		SecretKey outHeaderCurr = rotateKey(outHeaderPrev, rotationPeriod);
+		// Initialise the reordering windows and stream counters
+		IncomingKeys inPrev = new IncomingKeys(inTagPrev, inHeaderPrev,
+				rotationPeriod - 1);
+		IncomingKeys inCurr = new IncomingKeys(inTagCurr, inHeaderCurr,
+				rotationPeriod);
+		IncomingKeys inNext = new IncomingKeys(inTagNext, inHeaderNext,
+				rotationPeriod + 1);
+		OutgoingKeys outCurr = new OutgoingKeys(outTagCurr, outHeaderCurr,
+				rotationPeriod);
+		// Collect and return the keys
+		return new TransportKeys(t, inPrev, inCurr, inNext, outCurr);
+	}
+
+	public TransportKeys rotateTransportKeys(TransportKeys k,
+			long rotationPeriod) {
+		if (k.getRotationPeriod() >= rotationPeriod) return k;
+		IncomingKeys inPrev = k.getPreviousIncomingKeys();
+		IncomingKeys inCurr = k.getCurrentIncomingKeys();
+		IncomingKeys inNext = k.getNextIncomingKeys();
+		OutgoingKeys outCurr = k.getCurrentOutgoingKeys();
+		long startPeriod = outCurr.getRotationPeriod();
+		// Rotate the keys
+		for (long p = startPeriod + 1; p <= rotationPeriod; p++) {
+			inPrev = inCurr;
+			inCurr = inNext;
+			SecretKey inNextTag = rotateKey(inNext.getTagKey(), p + 1);
+			SecretKey inNextHeader = rotateKey(inNext.getHeaderKey(), p + 1);
+			inNext = new IncomingKeys(inNextTag, inNextHeader, p);
+			SecretKey outCurrTag = rotateKey(outCurr.getTagKey(), p);
+			SecretKey outCurrHeader = rotateKey(outCurr.getHeaderKey(), p);
+			outCurr = new OutgoingKeys(outCurrTag, outCurrHeader, p);
+		}
+		// Collect and return the keys
+		return new TransportKeys(k.getTransportId(), inPrev, inCurr, inNext,
+				outCurr);
+	}
+
+	private SecretKey rotateKey(SecretKey k, long rotationPeriod) {
+		byte[] period = new byte[4];
+		ByteUtils.writeUint32(rotationPeriod, period, 0);
+		return new SecretKey(macKdf(k, ROTATE, period));
+	}
+
+	private SecretKey deriveTagKey(SecretKey master, TransportId t,
 			boolean alice) {
-		if (secret.length != SecretKey.LENGTH)
+		byte[] id = StringUtils.toUtf8(t.getString());
-			throw new IllegalArgumentException();
+		return new SecretKey(macKdf(master, alice ? A_TAG : B_TAG, id));
-		if (streamNumber < 0 || streamNumber > MAX_32_BIT_UNSIGNED)
-			throw new IllegalArgumentException();
-		if (alice) return deriveKey(secret, A_FRAME, streamNumber);
-		else return deriveKey(secret, B_FRAME, streamNumber);
 	}
 
-	private SecretKey deriveKey(byte[] secret, byte[] label, long context) {
+	private SecretKey deriveHeaderKey(SecretKey master, TransportId t,
-		return new SecretKey(counterModeKdf(secret, label, context));
+			boolean alice) {
+		byte[] id = StringUtils.toUtf8(t.getString());
+		return new SecretKey(macKdf(master, alice ? A_HEADER : B_HEADER, id));
 	}
 
 	public void encodeTag(byte[] tag, SecretKey tagKey, long streamNumber) {
@@ -277,7 +316,8 @@ class CryptoComponentImpl implements CryptoComponent {
 		for (int i = 0; i < TAG_LENGTH; i++) tag[i] = 0;
 		ByteUtils.writeUint32(streamNumber, tag, 0);
 		BlockCipher cipher = new AESLightEngine();
-		assert cipher.getBlockSize() == TAG_LENGTH;
+		if (cipher.getBlockSize() != TAG_LENGTH)
+			throw new IllegalStateException();
 		KeyParameter k = new KeyParameter(tagKey.getBytes());
 		cipher.init(true, k);
 		cipher.processBlock(tag, 0, tag, 0);
@@ -348,16 +388,16 @@ class CryptoComponentImpl implements CryptoComponent {
 
 	// Key derivation function based on a hash function - see NIST SP 800-56A,
 	// section 5.8
-	private byte[] concatenationKdf(byte[]... inputs) {
+	private byte[] hashKdf(byte[]... inputs) {
 		// The output of the hash function must be long enough to use as a key
 		MessageDigest messageDigest = getMessageDigest();
 		if (messageDigest.getDigestLength() < SecretKey.LENGTH)
-			throw new RuntimeException();
+			throw new IllegalStateException();
-		// Each input is length-prefixed - the length must fit in an
+		// Calculate the hash over the concatenated length-prefixed inputs
-		// unsigned 8-bit integer
+		byte[] length = new byte[4];
 		for (byte[] input : inputs) {
-			if (input.length > 255) throw new IllegalArgumentException();
+			ByteUtils.writeUint32(input.length, length, 0);
-			messageDigest.update((byte) input.length);
+			messageDigest.update(length);
 			messageDigest.update(input);
 		}
 		byte[] hash = messageDigest.digest();
@@ -368,28 +408,24 @@ class CryptoComponentImpl implements CryptoComponent {
 		return truncated;
 	}
 
-	// Key derivation function based on a PRF in counter mode - see
+	// Key derivation function based on a pseudo-random function - see
 	// NIST SP 800-108, section 5.1
-	private byte[] counterModeKdf(byte[] secret, byte[] label, long context) {
+	private byte[] macKdf(SecretKey key, byte[]... inputs) {
-		if (secret.length != SecretKey.LENGTH)
-			throw new IllegalArgumentException();
-		// The label must be null-terminated
-		if (label[label.length - 1] != '\0')
-			throw new IllegalArgumentException();
 		// Initialise the PRF
 		Mac prf = new HMac(new SHA256Digest());
-		KeyParameter k = new KeyParameter(secret);
+		prf.init(new KeyParameter(key.getBytes()));
-		prf.init(k);
-		int macLength = prf.getMacSize();
 		// The output of the PRF must be long enough to use as a key
-		if (macLength < SecretKey.LENGTH) throw new RuntimeException();
+		int macLength = prf.getMacSize();
+		if (macLength < SecretKey.LENGTH)
+			throw new IllegalStateException();
+		// Calculate the PRF over the concatenated length-prefixed inputs
+		byte[] length = new byte[4];
+		for (byte[] input : inputs) {
+			ByteUtils.writeUint32(input.length, length, 0);
+			prf.update(length, 0, length.length);
+			prf.update(input, 0, input.length);
+		}
 		byte[] mac = new byte[macLength];
-		prf.update((byte) 0); // Counter
-		prf.update(label, 0, label.length); // Null-terminated
-		byte[] contextBytes = new byte[4];
-		ByteUtils.writeUint32(context, contextBytes, 0);
-		prf.update(contextBytes, 0, contextBytes.length);
-		prf.update((byte) SecretKey.LENGTH); // Output length
 		prf.doFinal(mac, 0);
 		// The output is the first SecretKey.LENGTH bytes of the MAC
 		if (mac.length == SecretKey.LENGTH) return mac;

briar-core/src/org/briarproject/crypto/StreamDecrypterFactoryImpl.java

@@ -5,7 +5,6 @@ import java.io.InputStream;
 import javax.inject.Inject;
 import javax.inject.Provider;
 
-import org.briarproject.api.crypto.CryptoComponent;
 import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.crypto.StreamDecrypter;
 import org.briarproject.api.crypto.StreamDecrypterFactory;
@@ -13,34 +12,21 @@ import org.briarproject.api.transport.StreamContext;
 
 class StreamDecrypterFactoryImpl implements StreamDecrypterFactory {
 
-	private final CryptoComponent crypto;
 	private final Provider<AuthenticatedCipher> cipherProvider;
 
 	@Inject
-	StreamDecrypterFactoryImpl(CryptoComponent crypto,
+	StreamDecrypterFactoryImpl(Provider<AuthenticatedCipher> cipherProvider) {
-			Provider<AuthenticatedCipher> cipherProvider) {
-		this.crypto = crypto;
 		this.cipherProvider = cipherProvider;
 	}
 
 	public StreamDecrypter createStreamDecrypter(InputStream in,
 			StreamContext ctx) {
-		// Derive the frame key
-		byte[] secret = ctx.getSecret();
-		long streamNumber = ctx.getStreamNumber();
-		boolean alice = !ctx.getAlice();
-		SecretKey frameKey = crypto.deriveFrameKey(secret, streamNumber, alice);
-		// Create the decrypter
 		AuthenticatedCipher cipher = cipherProvider.get();
-		return new StreamDecrypterImpl(in, cipher, frameKey);
+		return new StreamDecrypterImpl(in, cipher, ctx.getHeaderKey());
 	}
 
 	public StreamDecrypter createInvitationStreamDecrypter(InputStream in,
-			byte[] secret, boolean alice) {
+			SecretKey headerKey) {
-		// Derive the frame key
+		return new StreamDecrypterImpl(in, cipherProvider.get(), headerKey);
-		SecretKey frameKey = crypto.deriveFrameKey(secret, 0, alice);
-		// Create the decrypter
-		AuthenticatedCipher cipher = cipherProvider.get();
-		return new StreamDecrypterImpl(in, cipher, frameKey);
 	}
 }

briar-core/src/org/briarproject/crypto/StreamDecrypterImpl.java

@@ -1,75 +1,77 @@
 package org.briarproject.crypto;
 
+import org.briarproject.api.FormatException;
+import org.briarproject.api.crypto.SecretKey;
+import org.briarproject.api.crypto.StreamDecrypter;
+
+import java.io.EOFException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.GeneralSecurityException;
+
 import static org.briarproject.api.transport.TransportConstants.HEADER_LENGTH;
 import static org.briarproject.api.transport.TransportConstants.IV_LENGTH;
 import static org.briarproject.api.transport.TransportConstants.MAC_LENGTH;
 import static org.briarproject.api.transport.TransportConstants.MAX_FRAME_LENGTH;
 import static org.briarproject.api.transport.TransportConstants.MAX_PAYLOAD_LENGTH;
 
-import java.io.EOFException;
+// FIXME: Implementation is incomplete, doesn't read the stream header
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.GeneralSecurityException;
-
-import org.briarproject.api.FormatException;
-import org.briarproject.api.crypto.SecretKey;
-import org.briarproject.api.crypto.StreamDecrypter;
-
 class StreamDecrypterImpl implements StreamDecrypter {
 
 	private final InputStream in;
 	private final AuthenticatedCipher frameCipher;
 	private final SecretKey frameKey;
-	private final byte[] iv, header, ciphertext;
+	private final byte[] iv, frameHeader, frameCiphertext;
 
 	private long frameNumber;
 	private boolean finalFrame;
 
 	StreamDecrypterImpl(InputStream in, AuthenticatedCipher frameCipher,
-			SecretKey frameKey) {
+			SecretKey headerKey) {
 		this.in = in;
 		this.frameCipher = frameCipher;
-		this.frameKey = frameKey;
+		this.frameKey = headerKey; // FIXME
 		iv = new byte[IV_LENGTH];
-		header = new byte[HEADER_LENGTH];
+		frameHeader = new byte[HEADER_LENGTH];
-		ciphertext = new byte[MAX_FRAME_LENGTH];
+		frameCiphertext = new byte[MAX_FRAME_LENGTH];
 		frameNumber = 0;
 		finalFrame = false;
 	}
 
 	public int readFrame(byte[] payload) throws IOException {
+		// The buffer must be big enough for a full-size frame
 		if (payload.length < MAX_PAYLOAD_LENGTH)
 			throw new IllegalArgumentException();
 		if (finalFrame) return -1;
-		// Read the header
+		// Read the frame header
 		int offset = 0;
 		while (offset < HEADER_LENGTH) {
-			int read = in.read(ciphertext, offset, HEADER_LENGTH - offset);
+			int read = in.read(frameCiphertext, offset, HEADER_LENGTH - offset);
 			if (read == -1) throw new EOFException();
 			offset += read;
 		}
-		// Decrypt and authenticate the header
+		// Decrypt and authenticate the frame header
 		FrameEncoder.encodeIv(iv, frameNumber, true);
 		try {
 			frameCipher.init(false, frameKey, iv);
-			int decrypted = frameCipher.process(ciphertext, 0, HEADER_LENGTH,
+			int decrypted = frameCipher.process(frameCiphertext, 0,
-					header, 0);
+					HEADER_LENGTH, frameHeader, 0);
 			if (decrypted != HEADER_LENGTH - MAC_LENGTH)
 				throw new RuntimeException();
 		} catch (GeneralSecurityException e) {
 			throw new FormatException();
 		}
-		// Decode and validate the header
+		// Decode and validate the frame header
-		finalFrame = FrameEncoder.isFinalFrame(header);
+		finalFrame = FrameEncoder.isFinalFrame(frameHeader);
-		int payloadLength = FrameEncoder.getPayloadLength(header);
+		int payloadLength = FrameEncoder.getPayloadLength(frameHeader);
-		int paddingLength = FrameEncoder.getPaddingLength(header);
+		int paddingLength = FrameEncoder.getPaddingLength(frameHeader);
 		if (payloadLength + paddingLength > MAX_PAYLOAD_LENGTH)
 			throw new FormatException();
 		// Read the payload and padding
 		int frameLength = HEADER_LENGTH + payloadLength + paddingLength
 				+ MAC_LENGTH;
 		while (offset < frameLength) {
-			int read = in.read(ciphertext, offset, frameLength - offset);
+			int read = in.read(frameCiphertext, offset, frameLength - offset);
 			if (read == -1) throw new EOFException();
 			offset += read;
 		}
@@ -77,7 +79,7 @@ class StreamDecrypterImpl implements StreamDecrypter {
 		FrameEncoder.encodeIv(iv, frameNumber, false);
 		try {
 			frameCipher.init(false, frameKey, iv);
-			int decrypted = frameCipher.process(ciphertext, HEADER_LENGTH,
+			int decrypted = frameCipher.process(frameCiphertext, HEADER_LENGTH,
 					payloadLength + paddingLength + MAC_LENGTH, payload, 0);
 			if (decrypted != payloadLength + paddingLength)
 				throw new RuntimeException();

briar-core/src/org/briarproject/crypto/StreamEncrypterFactoryImpl.java

@@ -27,26 +27,15 @@ class StreamEncrypterFactoryImpl implements StreamEncrypterFactory {
 
 	public StreamEncrypter createStreamEncrypter(OutputStream out,
 			StreamContext ctx) {
-		byte[] secret = ctx.getSecret();
-		long streamNumber = ctx.getStreamNumber();
-		boolean alice = ctx.getAlice();
-		// Encode the tag
 		byte[] tag = new byte[TAG_LENGTH];
-		SecretKey tagKey = crypto.deriveTagKey(secret, alice);
+		crypto.encodeTag(tag, ctx.getTagKey(), ctx.getStreamNumber());
-		crypto.encodeTag(tag, tagKey, streamNumber);
-		// Derive the frame key
-		SecretKey frameKey = crypto.deriveFrameKey(secret, streamNumber, alice);
-		// Create the encrypter
 		AuthenticatedCipher cipher = cipherProvider.get();
-		return new StreamEncrypterImpl(out, cipher, frameKey, tag);
+		return new StreamEncrypterImpl(out, cipher, ctx.getHeaderKey(), tag);
 	}
 
 	public StreamEncrypter createInvitationStreamEncrypter(OutputStream out,
-			byte[] secret, boolean alice) {
+			SecretKey headerKey) {
-		// Derive the frame key
-		SecretKey frameKey = crypto.deriveFrameKey(secret, 0, alice);
-		// Create the encrypter
 		AuthenticatedCipher cipher = cipherProvider.get();
-		return new StreamEncrypterImpl(out, cipher, frameKey, null);
+		return new StreamEncrypterImpl(out, cipher, headerKey, null);
 	}
 }

briar-core/src/org/briarproject/crypto/StreamEncrypterImpl.java

@@ -1,5 +1,12 @@
 package org.briarproject.crypto;
 
+import org.briarproject.api.crypto.SecretKey;
+import org.briarproject.api.crypto.StreamEncrypter;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.security.GeneralSecurityException;
+
 import static org.briarproject.api.transport.TransportConstants.HEADER_LENGTH;
 import static org.briarproject.api.transport.TransportConstants.IV_LENGTH;
 import static org.briarproject.api.transport.TransportConstants.MAC_LENGTH;
@@ -7,32 +14,26 @@ import static org.briarproject.api.transport.TransportConstants.MAX_FRAME_LENGTH
 import static org.briarproject.api.transport.TransportConstants.MAX_PAYLOAD_LENGTH;
 import static org.briarproject.util.ByteUtils.MAX_32_BIT_UNSIGNED;
 
-import java.io.IOException;
+// FIXME: Implementation is incomplete, doesn't write the stream header
-import java.io.OutputStream;
-import java.security.GeneralSecurityException;
-
-import org.briarproject.api.crypto.SecretKey;
-import org.briarproject.api.crypto.StreamEncrypter;
-
 class StreamEncrypterImpl implements StreamEncrypter {
 
 	private final OutputStream out;
 	private final AuthenticatedCipher frameCipher;
 	private final SecretKey frameKey;
-	private final byte[] tag, iv, plaintext, ciphertext;
+	private final byte[] tag, iv, framePlaintext, frameCiphertext;
 
 	private long frameNumber;
 	private boolean writeTag;
 
 	StreamEncrypterImpl(OutputStream out, AuthenticatedCipher frameCipher,
-			SecretKey frameKey, byte[] tag) {
+			SecretKey headerKey, byte[] tag) {
 		this.out = out;
 		this.frameCipher = frameCipher;
-		this.frameKey = frameKey;
+		this.frameKey = headerKey; // FIXME
 		this.tag = tag;
 		iv = new byte[IV_LENGTH];
-		plaintext = new byte[HEADER_LENGTH + MAX_PAYLOAD_LENGTH];
+		framePlaintext = new byte[HEADER_LENGTH + MAX_PAYLOAD_LENGTH];
-		ciphertext = new byte[MAX_FRAME_LENGTH];
+		frameCiphertext = new byte[MAX_FRAME_LENGTH];
 		frameNumber = 0;
 		writeTag = (tag != null);
 	}
@@ -48,37 +49,39 @@ class StreamEncrypterImpl implements StreamEncrypter {
 			out.write(tag, 0, tag.length);
 			writeTag = false;
 		}
-		// Encode the header
+		// Encode the frame header
-		FrameEncoder.encodeHeader(plaintext, finalFrame, payloadLength,
+		FrameEncoder.encodeHeader(framePlaintext, finalFrame, payloadLength,
 				paddingLength);
-		// Encrypt and authenticate the header
+		// Encrypt and authenticate the frame header
 		FrameEncoder.encodeIv(iv, frameNumber, true);
 		try {
 			frameCipher.init(true, frameKey, iv);
-			int encrypted = frameCipher.process(plaintext, 0,
+			int encrypted = frameCipher.process(framePlaintext, 0,
-					HEADER_LENGTH - MAC_LENGTH, ciphertext, 0);
+					HEADER_LENGTH - MAC_LENGTH, frameCiphertext, 0);
 			if (encrypted != HEADER_LENGTH) throw new RuntimeException();
 		} catch (GeneralSecurityException badCipher) {
 			throw new RuntimeException(badCipher);
 		}
 		// Combine the payload and padding
-		System.arraycopy(payload, 0, plaintext, HEADER_LENGTH, payloadLength);
+		System.arraycopy(payload, 0, framePlaintext, HEADER_LENGTH,
+				payloadLength);
 		for (int i = 0; i < paddingLength; i++)
-			plaintext[HEADER_LENGTH + payloadLength + i] = 0;
+			framePlaintext[HEADER_LENGTH + payloadLength + i] = 0;
 		// Encrypt and authenticate the payload and padding
 		FrameEncoder.encodeIv(iv, frameNumber, false);
 		try {
 			frameCipher.init(true, frameKey, iv);
-			int encrypted = frameCipher.process(plaintext, HEADER_LENGTH,
+			int encrypted = frameCipher.process(framePlaintext, HEADER_LENGTH,
-					payloadLength + paddingLength, ciphertext, HEADER_LENGTH);
+					payloadLength + paddingLength, frameCiphertext,
+					HEADER_LENGTH);
 			if (encrypted != payloadLength + paddingLength + MAC_LENGTH)
 				throw new RuntimeException();
 		} catch (GeneralSecurityException badCipher) {
 			throw new RuntimeException(badCipher);
 		}
 		// Write the frame
-		out.write(ciphertext, 0, HEADER_LENGTH + payloadLength + paddingLength
+		out.write(frameCiphertext, 0, HEADER_LENGTH + payloadLength
-				+ MAC_LENGTH);
+				+ paddingLength + MAC_LENGTH);
 		frameNumber++;
 	}
 

briar-core/src/org/briarproject/db/Database.java

@@ -1,9 +1,5 @@
 package org.briarproject.db;
 
-import java.io.IOException;
-import java.util.Collection;
-import java.util.Map;
-
 import org.briarproject.api.Author;
 import org.briarproject.api.AuthorId;
 import org.briarproject.api.Contact;
@@ -25,8 +21,11 @@ import org.briarproject.api.messaging.SubscriptionAck;
 import org.briarproject.api.messaging.SubscriptionUpdate;
 import org.briarproject.api.messaging.TransportAck;
 import org.briarproject.api.messaging.TransportUpdate;
-import org.briarproject.api.transport.Endpoint;
+import org.briarproject.api.transport.TransportKeys;
-import org.briarproject.api.transport.TemporarySecret;
+
+import java.io.IOException;
+import java.util.Collection;
+import java.util.Map;
 
 // FIXME: Document the preconditions for calling each method
 
@@ -89,13 +88,6 @@ interface Database<T> {
 	ContactId addContact(T txn, Author remote, AuthorId local)
 			throws DbException;
 
-	/**
-	 * Stores an endpoint.
-	 * <p>
-	 * Locking: write.
-	 */
-	void addEndpoint(T txn, Endpoint ep) throws DbException;
-
 	/**
 	 * Subscribes to a group, or returns false if the user already has the
 	 * maximum number of subscriptions.
@@ -125,15 +117,6 @@ interface Database<T> {
 	 */
 	void addOfferedMessage(T txn, ContactId c, MessageId m) throws DbException;
 
-	/**
-	 * Stores the given temporary secrets and deletes any secrets that have
-	 * been made obsolete.
-	 * <p>
-	 * Locking: write.
-	 */
-	void addSecrets(T txn, Collection<TemporarySecret> secrets)
-			throws DbException;
-
 	/**
 	 * Initialises the status of the given message with respect to the given
 	 * contact.
@@ -154,6 +137,13 @@ interface Database<T> {
 	boolean addTransport(T txn, TransportId t, int maxLatency)
 			throws DbException;
 
+	/**
+	 * Stores the given transport keys for a newly added contact.
+	 * <p>
+	 * Locking: write.
+	 */
+	void addTransportKeys(T txn, ContactId c, TransportKeys k) throws DbException;
+
 	/**
 	 * Makes a group visible to the given contact.
 	 * <p>
@@ -270,13 +260,6 @@ interface Database<T> {
 	 */
 	Collection<ContactId> getContacts(T txn, AuthorId a) throws DbException;
 
-	/**
-	 * Returns all endpoints.
-	 * <p>
-	 * Locking: read.
-	 */
-	Collection<Endpoint> getEndpoints(T txn) throws DbException;
-
 	/**
 	 * Returns the amount of free storage space available to the database, in
 	 * bytes. This is based on the minimum of the space available on the device
@@ -461,13 +444,6 @@ interface Database<T> {
 	RetentionUpdate getRetentionUpdate(T txn, ContactId c, int maxLatency)
 			throws DbException;
 
-	/**
-	 * Returns all temporary secrets.
-	 * <p>
-	 * Locking: read.
-	 */
-	Collection<TemporarySecret> getSecrets(T txn) throws DbException;
-
 	/**
 	 * Returns all settings.
 	 * <p>
@@ -509,7 +485,15 @@ interface Database<T> {
 			throws DbException;
 
 	/**
-	 * Returns the maximum latencies of all supported transports.
+	 * Returns all transport keys for the given transport.
+	 * <p>
+	 * Locking: read.
+	 */
+	Map<ContactId, TransportKeys> getTransportKeys(T txn, TransportId t)
+			throws DbException;
+
+	/**
+	 * Returns the maximum latencies in milliseconds of all transports.
 	 * <p>
 	 * Locking: read.
 	 */
@@ -540,14 +524,13 @@ interface Database<T> {
 	Collection<ContactId> getVisibility(T txn, GroupId g) throws DbException;
 
 	/**
-	 * Increments the outgoing stream counter for the given endpoint in the
+	 * Increments the outgoing stream counter for the given contact and
-	 * given rotation period and returns the old value, or -1 if the counter
+	 * transport in the given rotation period.
-	 * does not exist.
 	 * <p>
 	 * Locking: write.
 	 */
-	long incrementStreamCounter(T txn, ContactId c, TransportId t, long period)
+	void incrementStreamCounter(T txn, ContactId c, TransportId t,
-			throws DbException;
+			long rotationPeriod) throws DbException;
 
 	/**
 	 * Increments the retention time versions for all contacts to indicate that
@@ -692,13 +675,13 @@ interface Database<T> {
 	void resetExpiryTime(T txn, ContactId c, MessageId m) throws DbException;
 
 	/**
-	 * Sets the reordering window for the given endpoint in the given rotation
+	 * Sets the reordering window for the given contact and transport in the
-	 * period.
+	 * given rotation period.
 	 * <p>
 	 * Locking: write.
 	 */
-	void setReorderingWindow(T txn, ContactId c, TransportId t, long period,
+	void setReorderingWindow(T txn, ContactId c, TransportId t,
-			long centre, byte[] bitmap) throws DbException;
+			long rotationPeriod, long base, byte[] bitmap) throws DbException;
 
 	/**
 	 * Updates the groups to which the given contact subscribes and returns
@@ -716,7 +699,7 @@ interface Database<T> {
 	 * <p>
 	 * Locking: write.
 	 */
-	public void setInboxGroup(T txn, ContactId c, Group g) throws DbException;
+	void setInboxGroup(T txn, ContactId c, Group g) throws DbException;
 
 	/**
 	 * Marks a message as read or unread.
@@ -798,4 +781,12 @@ interface Database<T> {
 	 */
 	void updateExpiryTime(T txn, ContactId c, MessageId m, int maxLatency)
 			throws DbException;
+
+	/**
+	 * Stores the given transport keys, deleting any keys they have replaced.
+	 * <p>
+	 * Locking: write.
+	 */
+	void updateTransportKeys(T txn, Map<ContactId, TransportKeys> keys)
+			throws DbException;
 }

briar-core/src/org/briarproject/db/DatabaseComponentImpl.java

@@ -1,25 +1,5 @@
 package org.briarproject.db;
 
-import static java.util.logging.Level.INFO;
-import static java.util.logging.Level.WARNING;
-import static org.briarproject.db.DatabaseConstants.BYTES_PER_SWEEP;
-import static org.briarproject.db.DatabaseConstants.CRITICAL_FREE_SPACE;
-import static org.briarproject.db.DatabaseConstants.MAX_OFFERED_MESSAGES;
-import static org.briarproject.db.DatabaseConstants.MAX_TRANSACTIONS_BETWEEN_SPACE_CHECKS;
-import static org.briarproject.db.DatabaseConstants.MIN_FREE_SPACE;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.locks.ReentrantReadWriteLock;
-import java.util.logging.Logger;
-
-import javax.inject.Inject;
-
 import org.briarproject.api.Author;
 import org.briarproject.api.AuthorId;
 import org.briarproject.api.Contact;
@@ -75,8 +55,29 @@ import org.briarproject.api.messaging.SubscriptionAck;
 import org.briarproject.api.messaging.SubscriptionUpdate;
 import org.briarproject.api.messaging.TransportAck;
 import org.briarproject.api.messaging.TransportUpdate;
-import org.briarproject.api.transport.Endpoint;
+import org.briarproject.api.transport.TransportKeys;
-import org.briarproject.api.transport.TemporarySecret;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.concurrent.locks.ReentrantReadWriteLock;
+import java.util.logging.Logger;
+
+import javax.inject.Inject;
+
+import static java.util.logging.Level.INFO;
+import static java.util.logging.Level.WARNING;
+import static org.briarproject.db.DatabaseConstants.BYTES_PER_SWEEP;
+import static org.briarproject.db.DatabaseConstants.CRITICAL_FREE_SPACE;
+import static org.briarproject.db.DatabaseConstants.MAX_OFFERED_MESSAGES;
+import static org.briarproject.db.DatabaseConstants.MAX_TRANSACTIONS_BETWEEN_SPACE_CHECKS;
+import static org.briarproject.db.DatabaseConstants.MIN_FREE_SPACE;
 
 /**
  * An implementation of DatabaseComponent using reentrant read-write locks.
@@ -85,7 +86,7 @@ import org.briarproject.api.transport.TemporarySecret;
  * implementation is safe on a given JVM.
  */
 class DatabaseComponentImpl<T> implements DatabaseComponent,
-DatabaseCleaner.Callback {
+		DatabaseCleaner.Callback {
 
 	private static final Logger LOG =
 			Logger.getLogger(DatabaseComponentImpl.class.getName());
@@ -180,26 +181,6 @@ DatabaseCleaner.Callback {
 		return c;
 	}
 
-	public void addEndpoint(Endpoint ep) throws DbException {
-		lock.writeLock().lock();
-		try {
-			T txn = db.startTransaction();
-			try {
-				if (!db.containsContact(txn, ep.getContactId()))
-					throw new NoSuchContactException();
-				if (!db.containsTransport(txn, ep.getTransportId()))
-					throw new NoSuchTransportException();
-				db.addEndpoint(txn, ep);
-				db.commitTransaction(txn);
-			} catch (DbException e) {
-				db.abortTransaction(txn);
-				throw e;
-			}
-		} finally {
-			lock.writeLock().unlock();
-		}
-	}
-
 	public boolean addGroup(Group g) throws DbException {
 		boolean added = false;
 		lock.writeLock().lock();
@@ -290,30 +271,6 @@ DatabaseCleaner.Callback {
 		}
 	}
 
-	public void addSecrets(Collection<TemporarySecret> secrets)
-			throws DbException {
-		lock.writeLock().lock();
-		try {
-			T txn = db.startTransaction();
-			try {
-				Collection<TemporarySecret> relevant =
-						new ArrayList<TemporarySecret>();
-				for (TemporarySecret s : secrets) {
-					if (db.containsContact(txn, s.getContactId()))
-						if (db.containsTransport(txn, s.getTransportId()))
-							relevant.add(s);
-				}
-				if (!secrets.isEmpty()) db.addSecrets(txn, relevant);
-				db.commitTransaction(txn);
-			} catch (DbException e) {
-				db.abortTransaction(txn);
-				throw e;
-			}
-		} finally {
-			lock.writeLock().unlock();
-		}
-	}
-
 	public boolean addTransport(TransportId t, int maxLatency)
 			throws DbException {
 		boolean added;
@@ -334,6 +291,27 @@ DatabaseCleaner.Callback {
 		return added;
 	}
 
+	public void addTransportKeys(ContactId c, TransportKeys k)
+			throws DbException {
+		lock.writeLock().lock();
+		try {
+			T txn = db.startTransaction();
+			try {
+				if (!db.containsContact(txn, c))
+					throw new NoSuchContactException();
+				if (!db.containsTransport(txn, k.getTransportId()))
+					throw new NoSuchTransportException();
+				db.addTransportKeys(txn, c, k);
+				db.commitTransaction(txn);
+			} catch (DbException e) {
+				db.abortTransaction(txn);
+				throw e;
+			}
+		} finally {
+			lock.writeLock().unlock();
+		}
+	}
+
 	public Ack generateAck(ContactId c, int maxMessages) throws DbException {
 		Collection<MessageId> ids;
 		lock.writeLock().lock();
@@ -883,23 +861,6 @@ DatabaseCleaner.Callback {
 		}
 	}
 
-	public Collection<TemporarySecret> getSecrets() throws DbException {
-		lock.readLock().lock();
-		try {
-			T txn = db.startTransaction();
-			try {
-				Collection<TemporarySecret> secrets = db.getSecrets(txn);
-				db.commitTransaction(txn);
-				return secrets;
-			} catch (DbException e) {
-				db.abortTransaction(txn);
-				throw e;
-			}
-		} finally {
-			lock.readLock().unlock();
-		}
-	}
-
 	public Settings getSettings() throws DbException {
 		lock.readLock().lock();
 		try {
@@ -934,6 +895,27 @@ DatabaseCleaner.Callback {
 		}
 	}
 
+	public Map<ContactId, TransportKeys> getTransportKeys(TransportId t)
+			throws DbException {
+		lock.readLock().lock();
+		try {
+			T txn = db.startTransaction();
+			try {
+				if (!db.containsTransport(txn, t))
+					throw new NoSuchTransportException();
+				Map<ContactId, TransportKeys> keys =
+						db.getTransportKeys(txn, t);
+				db.commitTransaction(txn);
+				return keys;
+			} catch (DbException e) {
+				db.abortTransaction(txn);
+				throw e;
+			}
+		} finally {
+			lock.readLock().unlock();
+		}
+	}
+
 	public Map<TransportId, Integer> getTransportLatencies()
 			throws DbException {
 		lock.readLock().lock();
@@ -989,8 +971,8 @@ DatabaseCleaner.Callback {
 		}
 	}
 
-	public long incrementStreamCounter(ContactId c, TransportId t,
+	public void incrementStreamCounter(ContactId c, TransportId t,
-			long period) throws DbException {
+			long rotationPeriod) throws DbException {
 		lock.writeLock().lock();
 		try {
 			T txn = db.startTransaction();
@@ -999,9 +981,8 @@ DatabaseCleaner.Callback {
 					throw new NoSuchContactException();
 				if (!db.containsTransport(txn, t))
 					throw new NoSuchTransportException();
-				long counter = db.incrementStreamCounter(txn, c, t, period);
+				db.incrementStreamCounter(txn, c, t, rotationPeriod);
 				db.commitTransaction(txn);
-				return counter;
 			} catch (DbException e) {
 				db.abortTransaction(txn);
 				throw e;
@@ -1404,27 +1385,6 @@ DatabaseCleaner.Callback {
 		eventBus.broadcast(new TransportRemovedEvent(t));
 	}
 
-	public void setReorderingWindow(ContactId c, TransportId t, long period,
-			long centre, byte[] bitmap) throws DbException {
-		lock.writeLock().lock();
-		try {
-			T txn = db.startTransaction();
-			try {
-				if (!db.containsContact(txn, c))
-					throw new NoSuchContactException();
-				if (!db.containsTransport(txn, t))
-					throw new NoSuchTransportException();
-				db.setReorderingWindow(txn, c, t, period, centre, bitmap);
-				db.commitTransaction(txn);
-			} catch (DbException e) {
-				db.abortTransaction(txn);
-				throw e;
-			}
-		} finally {
-			lock.writeLock().unlock();
-		}
-	}
-
 	public void setInboxGroup(ContactId c, Group g) throws DbException {
 		lock.writeLock().lock();
 		try {
@@ -1480,6 +1440,27 @@ DatabaseCleaner.Callback {
 		}
 	}
 
+	public void setReorderingWindow(ContactId c, TransportId t,
+			long rotationPeriod, long base, byte[] bitmap) throws DbException {
+		lock.writeLock().lock();
+		try {
+			T txn = db.startTransaction();
+			try {
+				if (!db.containsContact(txn, c))
+					throw new NoSuchContactException();
+				if (!db.containsTransport(txn, t))
+					throw new NoSuchTransportException();
+				db.setReorderingWindow(txn, c, t, rotationPeriod, base, bitmap);
+				db.commitTransaction(txn);
+			} catch (DbException e) {
+				db.abortTransaction(txn);
+				throw e;
+			}
+		} finally {
+			lock.writeLock().unlock();
+		}
+	}
+
 	public void setVisibility(GroupId g, Collection<ContactId> visible)
 			throws DbException {
 		Collection<ContactId> affected = new ArrayList<ContactId>();
@@ -1552,6 +1533,33 @@ DatabaseCleaner.Callback {
 			eventBus.broadcast(new LocalSubscriptionsUpdatedEvent(affected));
 	}
 
+	public void updateTransportKeys(Map<ContactId, TransportKeys> keys)
+			throws DbException {
+		lock.writeLock().lock();
+		try {
+			T txn = db.startTransaction();
+			try {
+				Map<ContactId, TransportKeys> filtered =
+						new HashMap<ContactId, TransportKeys>();
+				for (Entry<ContactId, TransportKeys> e : keys.entrySet()) {
+					ContactId c = e.getKey();
+					TransportKeys k = e.getValue();
+					if (db.containsContact(txn, c)
+							&& db.containsTransport(txn, k.getTransportId())) {
+						filtered.put(c, k);
+					}
+				}
+				db.updateTransportKeys(txn, filtered);
+				db.commitTransaction(txn);
+			} catch (DbException e) {
+				db.abortTransaction(txn);
+				throw e;
+			}
+		} finally {
+			lock.writeLock().unlock();
+		}
+	}
+
 	public void checkFreeSpaceAndClean() throws DbException {
 		long freeSpace = db.getFreeSpace();
 		if (LOG.isLoggable(INFO)) LOG.info(freeSpace + " bytes free space");

briar-core/src/org/briarproject/db/JdbcDatabase.java

@@ -1,14 +1,33 @@
 package org.briarproject.db;
 
-import static java.sql.Types.BINARY;
+import org.briarproject.api.Author;
-import static java.sql.Types.VARCHAR;
+import org.briarproject.api.AuthorId;
-import static java.util.logging.Level.WARNING;
+import org.briarproject.api.Contact;
-import static org.briarproject.api.Author.Status.ANONYMOUS;
+import org.briarproject.api.ContactId;
-import static org.briarproject.api.Author.Status.UNKNOWN;
+import org.briarproject.api.LocalAuthor;
-import static org.briarproject.api.Author.Status.VERIFIED;
+import org.briarproject.api.Settings;
-import static org.briarproject.api.messaging.MessagingConstants.MAX_SUBSCRIPTIONS;
+import org.briarproject.api.TransportConfig;
-import static org.briarproject.api.messaging.MessagingConstants.RETENTION_GRANULARITY;
+import org.briarproject.api.TransportId;
-import static org.briarproject.db.ExponentialBackoff.calculateExpiry;
+import org.briarproject.api.TransportProperties;
+import org.briarproject.api.crypto.SecretKey;
+import org.briarproject.api.db.DbClosedException;
+import org.briarproject.api.db.DbException;
+import org.briarproject.api.db.MessageHeader;
+import org.briarproject.api.db.MessageHeader.State;
+import org.briarproject.api.messaging.Group;
+import org.briarproject.api.messaging.GroupId;
+import org.briarproject.api.messaging.Message;
+import org.briarproject.api.messaging.MessageId;
+import org.briarproject.api.messaging.RetentionAck;
+import org.briarproject.api.messaging.RetentionUpdate;
+import org.briarproject.api.messaging.SubscriptionAck;
+import org.briarproject.api.messaging.SubscriptionUpdate;
+import org.briarproject.api.messaging.TransportAck;
+import org.briarproject.api.messaging.TransportUpdate;
+import org.briarproject.api.system.Clock;
+import org.briarproject.api.transport.IncomingKeys;
+import org.briarproject.api.transport.OutgoingKeys;
+import org.briarproject.api.transport.TransportKeys;
 
 import java.io.IOException;
 import java.sql.Connection;
@@ -32,32 +51,15 @@ import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
 import java.util.logging.Logger;
 
-import org.briarproject.api.Author;
+import static java.sql.Types.BINARY;
-import org.briarproject.api.AuthorId;
+import static java.sql.Types.VARCHAR;
-import org.briarproject.api.Contact;
+import static java.util.logging.Level.WARNING;
-import org.briarproject.api.ContactId;
+import static org.briarproject.api.Author.Status.ANONYMOUS;
-import org.briarproject.api.LocalAuthor;
+import static org.briarproject.api.Author.Status.UNKNOWN;
-import org.briarproject.api.Settings;
+import static org.briarproject.api.Author.Status.VERIFIED;
-import org.briarproject.api.TransportConfig;
+import static org.briarproject.api.messaging.MessagingConstants.MAX_SUBSCRIPTIONS;
-import org.briarproject.api.TransportId;
+import static org.briarproject.api.messaging.MessagingConstants.RETENTION_GRANULARITY;
-import org.briarproject.api.TransportProperties;
+import static org.briarproject.db.ExponentialBackoff.calculateExpiry;
-import org.briarproject.api.db.DbClosedException;
-import org.briarproject.api.db.DbException;
-import org.briarproject.api.db.MessageHeader;
-import org.briarproject.api.db.MessageHeader.State;
-import org.briarproject.api.messaging.Group;
-import org.briarproject.api.messaging.GroupId;
-import org.briarproject.api.messaging.Message;
-import org.briarproject.api.messaging.MessageId;
-import org.briarproject.api.messaging.RetentionAck;
-import org.briarproject.api.messaging.RetentionUpdate;
-import org.briarproject.api.messaging.SubscriptionAck;
-import org.briarproject.api.messaging.SubscriptionUpdate;
-import org.briarproject.api.messaging.TransportAck;
-import org.briarproject.api.messaging.TransportUpdate;
-import org.briarproject.api.system.Clock;
-import org.briarproject.api.transport.Endpoint;
-import org.briarproject.api.transport.TemporarySecret;
 
 /**
  * A generic database implementation that can be used with any JDBC-compatible
@@ -65,8 +67,8 @@ import org.briarproject.api.transport.TemporarySecret;
  */
 abstract class JdbcDatabase implements Database<Connection> {
 
-	private static final int SCHEMA_VERSION = 9;
+	private static final int SCHEMA_VERSION = 10;
-	private static final int MIN_SCHEMA_VERSION = 9;
+	private static final int MIN_SCHEMA_VERSION = 10;
 
 	private static final String CREATE_SETTINGS =
 			"CREATE TABLE settings"
@@ -277,13 +279,16 @@ abstract class JdbcDatabase implements Database<Connection> {
 					+ " REFERENCES contacts (contactId)"
 					+ " ON DELETE CASCADE)";
 
-	private static final String CREATE_ENDPOINTS =
+	private static final String CREATE_INCOMING_KEYS =
-			"CREATE TABLE endpoints"
+			"CREATE TABLE incomingKeys"
 					+ " (contactId INT NOT NULL,"
 					+ " transportId VARCHAR NOT NULL,"
-					+ " epoch BIGINT NOT NULL,"
+					+ " period BIGINT NOT NULL,"
-					+ " alice BOOLEAN NOT NULL,"
+					+ " tagKey SECRET NOT NULL,"
-					+ " PRIMARY KEY (contactId, transportId),"
+					+ " headerKey SECRET NOT NULL,"
+					+ " base BIGINT NOT NULL,"
+					+ " bitmap BINARY NOT NULL,"
+					+ " PRIMARY KEY (contactId, transportId, period),"
 					+ " FOREIGN KEY (contactId)"
 					+ " REFERENCES contacts (contactId)"
 					+ " ON DELETE CASCADE,"
@@ -291,16 +296,15 @@ abstract class JdbcDatabase implements Database<Connection> {
 					+ " REFERENCES transports (transportId)"
 					+ " ON DELETE CASCADE)";
 
-	private static final String CREATE_SECRETS =
+	private static final String CREATE_OUTGOING_KEYS =
-			"CREATE TABLE secrets"
+			"CREATE TABLE outgoingKeys"
 					+ " (contactId INT NOT NULL,"
 					+ " transportId VARCHAR NOT NULL,"
 					+ " period BIGINT NOT NULL,"
-					+ " secret SECRET NOT NULL,"
+					+ " tagKey SECRET NOT NULL,"
-					+ " outgoing BIGINT NOT NULL,"
+					+ " headerKey SECRET NOT NULL,"
-					+ " centre BIGINT NOT NULL,"
+					+ " stream BIGINT NOT NULL,"
-					+ " bitmap BINARY NOT NULL,"
+					+ " PRIMARY KEY (contactId, transportId),"
-					+ " PRIMARY KEY (contactId, transportId, period),"
 					+ " FOREIGN KEY (contactId)"
 					+ " REFERENCES contacts (contactId)"
 					+ " ON DELETE CASCADE,"
@@ -324,6 +328,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 	private boolean closed = false; // Locking: connectionsLock
 
 	protected abstract Connection createConnection() throws SQLException;
+
 	protected abstract void flushBuffersToDisk(Statement s) throws SQLException;
 
 	private final Lock connectionsLock = new ReentrantLock();
@@ -339,7 +344,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 	}
 
 	protected void open(String driverClass, boolean reopen) throws DbException,
-	IOException {
+			IOException {
 		// Load the JDBC driver
 		try {
 			Class.forName(driverClass);
@@ -382,7 +387,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		try {
 			if (rs != null) rs.close();
 		} catch (SQLException e) {
-			if (LOG.isLoggable(WARNING))LOG.log(WARNING, e.toString(), e);
+			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 		}
 	}
 
@@ -390,7 +395,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		try {
 			if (s != null) s.close();
 		} catch (SQLException e) {
-			if (LOG.isLoggable(WARNING))LOG.log(WARNING, e.toString(), e);
+			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 		}
 	}
 
@@ -418,8 +423,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 			s.executeUpdate(insertTypeNames(CREATE_TRANSPORT_VERSIONS));
 			s.executeUpdate(insertTypeNames(CREATE_CONTACT_TRANSPORT_PROPS));
 			s.executeUpdate(insertTypeNames(CREATE_CONTACT_TRANSPORT_VERSIONS));
-			s.executeUpdate(insertTypeNames(CREATE_ENDPOINTS));
+			s.executeUpdate(insertTypeNames(CREATE_INCOMING_KEYS));
-			s.executeUpdate(insertTypeNames(CREATE_SECRETS));
+			s.executeUpdate(insertTypeNames(CREATE_OUTGOING_KEYS));
 			s.close();
 		} catch (SQLException e) {
 			tryToClose(s);
@@ -480,7 +485,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 			try {
 				txn.close();
 			} catch (SQLException e1) {
-				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e1.toString(), e1);
+				if (LOG.isLoggable(WARNING))
+					LOG.log(WARNING, e1.toString(), e1);
 			}
 			// Whatever happens, allow the database to close
 			connectionsLock.lock();
@@ -679,26 +685,6 @@ abstract class JdbcDatabase implements Database<Connection> {
 		}
 	}
 
-	public void addEndpoint(Connection txn, Endpoint ep) throws DbException {
-		PreparedStatement ps = null;
-		try {
-			String sql = "INSERT INTO endpoints"
-					+ " (contactId, transportId, epoch, alice)"
-					+ " VALUES (?, ?, ?, ?)";
-			ps = txn.prepareStatement(sql);
-			ps.setInt(1, ep.getContactId().getInt());
-			ps.setString(2, ep.getTransportId().getString());
-			ps.setLong(3, ep.getEpoch());
-			ps.setBoolean(4, ep.getAlice());
-			int affected = ps.executeUpdate();
-			if (affected != 1) throw new DbStateException();
-			ps.close();
-		} catch (SQLException e) {
-			tryToClose(ps);
-			throw new DbException(e);
-		}
-	}
-
 	public boolean addGroup(Connection txn, Group g) throws DbException {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
@@ -824,52 +810,6 @@ abstract class JdbcDatabase implements Database<Connection> {
 		}
 	}
 
-	public void addSecrets(Connection txn, Collection<TemporarySecret> secrets)
-			throws DbException {
-		PreparedStatement ps = null;
-		try {
-			// Store the new secrets
-			String sql = "INSERT INTO secrets (contactId, transportId, period,"
-					+ " secret, outgoing, centre, bitmap)"
-					+ " VALUES (?, ?, ?, ?, ?, ?, ?)";
-			ps = txn.prepareStatement(sql);
-			for (TemporarySecret s : secrets) {
-				ps.setInt(1, s.getContactId().getInt());
-				ps.setString(2, s.getTransportId().getString());
-				ps.setLong(3, s.getPeriod());
-				ps.setBytes(4, s.getSecret());
-				ps.setLong(5, s.getOutgoingStreamCounter());
-				ps.setLong(6, s.getWindowCentre());
-				ps.setBytes(7, s.getWindowBitmap());
-				ps.addBatch();
-			}
-			int[] batchAffected = ps.executeBatch();
-			if (batchAffected.length != secrets.size())
-				throw new DbStateException();
-			for (int i = 0; i < batchAffected.length; i++) {
-				if (batchAffected[i] != 1) throw new DbStateException();
-			}
-			ps.close();
-			// Delete any obsolete secrets
-			sql = "DELETE FROM secrets"
-					+ " WHERE contactId = ? AND transportId = ? AND period < ?";
-			ps = txn.prepareStatement(sql);
-			for (TemporarySecret s : secrets) {
-				ps.setInt(1, s.getContactId().getInt());
-				ps.setString(2, s.getTransportId().getString());
-				ps.setLong(3, s.getPeriod() - 2);
-				ps.addBatch();
-			}
-			batchAffected = ps.executeBatch();
-			if (batchAffected.length != secrets.size())
-				throw new DbStateException();
-			ps.close();
-		} catch (SQLException e) {
-			tryToClose(ps);
-			throw new DbException(e);
-		}
-	}
-
 	public void addStatus(Connection txn, ContactId c, MessageId m, boolean ack,
 			boolean seen) throws DbException {
 		PreparedStatement ps = null;
@@ -947,6 +887,68 @@ abstract class JdbcDatabase implements Database<Connection> {
 		}
 	}
 
+	public void addTransportKeys(Connection txn, ContactId c, TransportKeys k)
+			throws DbException {
+		PreparedStatement ps = null;
+		try {
+			// Store the incoming keys
+			String sql = "INSERT INTO incomingKeys (contactId, transportId,"
+					+ " period, tagKey, headerKey, base, bitmap)"
+					+ " VALUES (?, ?, ?, ?, ?, ?, ?)";
+			ps = txn.prepareStatement(sql);
+			ps.setInt(1, c.getInt());
+			ps.setString(2, k.getTransportId().getString());
+			// Previous rotation period
+			IncomingKeys inPrev = k.getPreviousIncomingKeys();
+			ps.setLong(3, inPrev.getRotationPeriod());
+			ps.setBytes(4, inPrev.getTagKey().getBytes());
+			ps.setBytes(5, inPrev.getHeaderKey().getBytes());
+			ps.setLong(6, inPrev.getWindowBase());
+			ps.setBytes(7, inPrev.getWindowBitmap());
+			ps.addBatch();
+			// Current rotation period
+			IncomingKeys inCurr = k.getCurrentIncomingKeys();
+			ps.setLong(3, inCurr.getRotationPeriod());
+			ps.setBytes(4, inCurr.getTagKey().getBytes());
+			ps.setBytes(5, inCurr.getHeaderKey().getBytes());
+			ps.setLong(6, inCurr.getWindowBase());
+			ps.setBytes(7, inCurr.getWindowBitmap());
+			ps.addBatch();
+			// Next rotation period
+			IncomingKeys inNext = k.getNextIncomingKeys();
+			ps.setLong(3, inNext.getRotationPeriod());
+			ps.setBytes(4, inNext.getTagKey().getBytes());
+			ps.setBytes(5, inNext.getHeaderKey().getBytes());
+			ps.setLong(6, inNext.getWindowBase());
+			ps.setBytes(7, inNext.getWindowBitmap());
+			ps.addBatch();
+			int[] batchAffected = ps.executeBatch();
+			if (batchAffected.length != 3) throw new DbStateException();
+			for (int i = 0; i < batchAffected.length; i++) {
+				if (batchAffected[i] != 1) throw new DbStateException();
+			}
+			ps.close();
+			// Store the outgoing keys
+			sql = "INSERT INTO outgoingKeys (contactId, transportId, period,"
+					+ " tagKey, headerKey, stream)"
+					+ " VALUES (?, ?, ?, ?, ?, ?)";
+			ps = txn.prepareStatement(sql);
+			ps.setInt(1, c.getInt());
+			ps.setString(2, k.getTransportId().getString());
+			OutgoingKeys outCurr = k.getCurrentOutgoingKeys();
+			ps.setLong(3, outCurr.getRotationPeriod());
+			ps.setBytes(4, outCurr.getTagKey().getBytes());
+			ps.setBytes(5, outCurr.getHeaderKey().getBytes());
+			ps.setLong(6, outCurr.getStreamCounter());
+			int affected = ps.executeUpdate();
+			if (affected != 1) throw new DbStateException();
+			ps.close();
+		} catch (SQLException e) {
+			tryToClose(ps);
+			throw new DbException(e);
+		}
+	}
+
 	public void addVisibility(Connection txn, ContactId c, GroupId g)
 			throws DbException {
 		PreparedStatement ps = null;
@@ -1326,32 +1328,6 @@ abstract class JdbcDatabase implements Database<Connection> {
 		}
 	}
 
-	public Collection<Endpoint> getEndpoints(Connection txn)
-			throws DbException {
-		PreparedStatement ps = null;
-		ResultSet rs = null;
-		try {
-			String sql = "SELECT contactId, transportId, epoch, alice"
-					+ " FROM endpoints";
-			ps = txn.prepareStatement(sql);
-			rs = ps.executeQuery();
-			List<Endpoint> endpoints = new ArrayList<Endpoint>();
-			while (rs.next()) {
-				ContactId contactId = new ContactId(rs.getInt(1));
-				TransportId transportId = new TransportId(rs.getString(2));
-				long epoch = rs.getLong(3);
-				boolean alice = rs.getBoolean(4);
-				endpoints.add(new Endpoint(contactId, transportId, epoch,
-						alice));
-			}
-			return Collections.unmodifiableList(endpoints);
-		} catch (SQLException e) {
-			tryToClose(rs);
-			tryToClose(ps);
-			throw new DbException(e);
-		}
-	}
-
 	public Group getGroup(Connection txn, GroupId g) throws DbException {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
@@ -2098,43 +2074,6 @@ abstract class JdbcDatabase implements Database<Connection> {
 		}
 	}
 
-	public Collection<TemporarySecret> getSecrets(Connection txn)
-			throws DbException {
-		PreparedStatement ps = null;
-		ResultSet rs = null;
-		try {
-			String sql = "SELECT e.contactId, e.transportId, epoch, alice,"
-					+ " period, secret, outgoing, centre, bitmap"
-					+ " FROM endpoints AS e"
-					+ " JOIN secrets AS s"
-					+ " ON e.contactId = s.contactId"
-					+ " AND e.transportId = s.transportId";
-			ps = txn.prepareStatement(sql);
-			rs = ps.executeQuery();
-			List<TemporarySecret> secrets = new ArrayList<TemporarySecret>();
-			while (rs.next()) {
-				ContactId contactId = new ContactId(rs.getInt(1));
-				TransportId transportId = new TransportId(rs.getString(2));
-				long epoch = rs.getLong(3);
-				boolean alice = rs.getBoolean(4);
-				long period = rs.getLong(5);
-				byte[] secret = rs.getBytes(6);
-				long outgoing = rs.getLong(7);
-				long centre = rs.getLong(8);
-				byte[] bitmap = rs.getBytes(9);
-				secrets.add(new TemporarySecret(contactId, transportId, epoch,
-						alice, period, secret, outgoing, centre, bitmap));
-			}
-			rs.close();
-			ps.close();
-			return Collections.unmodifiableList(secrets);
-		} catch (SQLException e) {
-			tryToClose(rs);
-			tryToClose(ps);
-			throw new DbException(e);
-		}
-	}
-
 	public Settings getSettings(Connection txn) throws DbException {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
@@ -2317,6 +2256,67 @@ abstract class JdbcDatabase implements Database<Connection> {
 		}
 	}
 
+	public Map<ContactId, TransportKeys> getTransportKeys(Connection txn,
+			TransportId t) throws DbException {
+		PreparedStatement ps = null;
+		ResultSet rs = null;
+		try {
+			// Retrieve the incoming keys
+			String sql = "SELECT period, tagKey, headerKey, base, bitmap"
+					+ " FROM incomingKeys"
+					+ " WHERE transportId = ?"
+					+ " ORDER BY contactId, period";
+			ps = txn.prepareStatement(sql);
+			ps.setString(1, t.getString());
+			rs = ps.executeQuery();
+			List<IncomingKeys> inKeys = new ArrayList<IncomingKeys>();
+			while (rs.next()) {
+				long rotationPeriod = rs.getLong(1);
+				SecretKey tagKey = new SecretKey(rs.getBytes(2));
+				SecretKey headerKey = new SecretKey(rs.getBytes(3));
+				long windowBase = rs.getLong(4);
+				byte[] windowBitmap = rs.getBytes(5);
+				inKeys.add(new IncomingKeys(tagKey, headerKey, rotationPeriod,
+						windowBase, windowBitmap));
+			}
+			rs.close();
+			ps.close();
+			// Retrieve the outgoing keys in the same order
+			sql = "SELECT contactId, period, tagKey, headerKey, stream"
+					+ " FROM outgoingKeys"
+					+ " WHERE transportId = ?"
+					+ " ORDER BY contactId, period";
+			ps = txn.prepareStatement(sql);
+			ps.setString(1, t.getString());
+			rs = ps.executeQuery();
+			Map<ContactId, TransportKeys> keys =
+					new HashMap<ContactId, TransportKeys>();
+			for (int i = 0; rs.next(); i++) {
+				// There should be three times as many incoming keys
+				if (inKeys.size() < (i + 1) * 3) throw new DbStateException();
+				ContactId contactId = new ContactId(rs.getInt(1));
+				long rotationPeriod = rs.getLong(2);
+				SecretKey tagKey = new SecretKey(rs.getBytes(3));
+				SecretKey headerKey = new SecretKey(rs.getBytes(4));
+				long streamCounter = rs.getLong(5);
+				OutgoingKeys outCurr = new OutgoingKeys(tagKey, headerKey,
+						rotationPeriod, streamCounter);
+				IncomingKeys inPrev = inKeys.get(i * 3);
+				IncomingKeys inCurr = inKeys.get(i * 3 + 1);
+				IncomingKeys inNext = inKeys.get(i * 3 + 2);
+				keys.put(contactId, new TransportKeys(t, inPrev, inCurr,
+						inNext, outCurr));
+			}
+			rs.close();
+			ps.close();
+			return Collections.unmodifiableMap(keys);
+		} catch (SQLException e) {
+			tryToClose(rs);
+			tryToClose(ps);
+			throw new DbException(e);
+		}
+	}
+
 	public Map<TransportId, Integer> getTransportLatencies(Connection txn)
 			throws DbException {
 		PreparedStatement ps = null;
@@ -2327,7 +2327,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 			rs = ps.executeQuery();
 			Map<TransportId, Integer> latencies =
 					new HashMap<TransportId, Integer>();
-			while (rs.next()){
+			while (rs.next()) {
 				TransportId id = new TransportId(rs.getString(1));
 				latencies.put(id, rs.getInt(2));
 			}
@@ -2392,7 +2392,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 				ps.setString(3, u.getId().getString());
 				ps.addBatch();
 			}
-			int [] batchAffected = ps.executeBatch();
+			int[] batchAffected = ps.executeBatch();
 			if (batchAffected.length != updates.size())
 				throw new DbStateException();
 			for (i = 0; i < batchAffected.length; i++) {
@@ -2455,42 +2455,21 @@ abstract class JdbcDatabase implements Database<Connection> {
 		}
 	}
 
-	public long incrementStreamCounter(Connection txn, ContactId c,
+	public void incrementStreamCounter(Connection txn, ContactId c,
-			TransportId t, long period) throws DbException {
+			TransportId t, long rotationPeriod) throws DbException {
 		PreparedStatement ps = null;
-		ResultSet rs = null;
 		try {
-			// Get the current stream counter
+			String sql = "UPDATE outgoingKeys SET stream = stream + 1"
-			String sql = "SELECT outgoing FROM secrets"
 					+ " WHERE contactId = ? AND transportId = ? AND period = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setInt(1, c.getInt());
 			ps.setString(2, t.getString());
-			ps.setLong(3, period);
+			ps.setLong(3, rotationPeriod);
-			rs = ps.executeQuery();
-			if (!rs.next()) {
-				rs.close();
-				ps.close();
-				return -1;
-			}
-			long streamNumber = rs.getLong(1);
-			if (rs.next()) throw new DbStateException();
-			rs.close();
-			ps.close();
-			// Increment the stream counter
-			sql = "UPDATE secrets SET outgoing = outgoing + 1"
-					+ " WHERE contactId = ? AND transportId = ? AND period = ?";
-			ps = txn.prepareStatement(sql);
-			ps.setInt(1, c.getInt());
-			ps.setString(2, t.getString());
-			ps.setLong(3, period);
 			int affected = ps.executeUpdate();
 			if (affected != 1) throw new DbStateException();
 			ps.close();
-			return streamNumber;
 		} catch (SQLException e) {
 			tryToClose(ps);
-			tryToClose(rs);
 			throw new DbException(e);
 		}
 	}
@@ -2929,18 +2908,19 @@ abstract class JdbcDatabase implements Database<Connection> {
 			throw new DbException(e);
 		}
 	}
+
 	public void setReorderingWindow(Connection txn, ContactId c, TransportId t,
-			long period, long centre, byte[] bitmap) throws DbException {
+			long rotationPeriod, long base, byte[] bitmap) throws DbException {
 		PreparedStatement ps = null;
 		try {
-			String sql = "UPDATE secrets SET centre = ?, bitmap = ?"
+			String sql = "UPDATE incomingKeys SET base = ?, bitmap = ?"
 					+ " WHERE contactId = ? AND transportId = ? AND period = ?";
 			ps = txn.prepareStatement(sql);
-			ps.setLong(1, centre);
+			ps.setLong(1, base);
 			ps.setBytes(2, bitmap);
 			ps.setInt(3, c.getInt());
 			ps.setString(4, t.getString());
-			ps.setLong(5, period);
+			ps.setLong(5, rotationPeriod);
 			int affected = ps.executeUpdate();
 			if (affected < 0 || affected > 1) throw new DbStateException();
 			ps.close();
@@ -3139,7 +3119,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	public boolean setRemoteProperties(Connection txn, ContactId c,
 			TransportId t, TransportProperties p, long version)
-					throws DbException {
+			throws DbException {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
@@ -3354,4 +3334,46 @@ abstract class JdbcDatabase implements Database<Connection> {
 			throw new DbException(e);
 		}
 	}
+
+	public void updateTransportKeys(Connection txn,
+			Map<ContactId, TransportKeys> keys) throws DbException {
+		PreparedStatement ps = null;
+		try {
+			// Delete any existing incoming keys
+			String sql = "DELETE FROM incomingKeys"
+					+ " WHERE contactId = ?"
+					+ " AND transportId = ?";
+			ps = txn.prepareStatement(sql);
+			for (Entry<ContactId, TransportKeys> e : keys.entrySet()) {
+				ps.setInt(1, e.getKey().getInt());
+				ps.setString(2, e.getValue().getTransportId().getString());
+				ps.addBatch();
+			}
+			int[] batchAffected = ps.executeBatch();
+			if (batchAffected.length != keys.size())
+				throw new DbStateException();
+			ps.close();
+			// Delete any existing outgoing keys
+			sql = "DELETE FROM outgoingKeys"
+					+ " WHERE contactId = ?"
+					+ " AND transportId = ?";
+			ps = txn.prepareStatement(sql);
+			for (Entry<ContactId, TransportKeys> e : keys.entrySet()) {
+				ps.setInt(1, e.getKey().getInt());
+				ps.setString(2, e.getValue().getTransportId().getString());
+				ps.addBatch();
+			}
+			batchAffected = ps.executeBatch();
+			if (batchAffected.length != keys.size())
+				throw new DbStateException();
+			ps.close();
+		} catch (SQLException e) {
+			tryToClose(ps);
+			throw new DbException(e);
+		}
+		// Store the new keys
+		for (Entry<ContactId, TransportKeys> e : keys.entrySet()) {
+			addTransportKeys(txn, e.getKey(), e.getValue());
+		}
+	}
 }

briar-core/src/org/briarproject/invitation/AliceConnector.java

@@ -1,23 +1,13 @@
 package org.briarproject.invitation;
 
-import static java.util.logging.Level.INFO;
-import static java.util.logging.Level.WARNING;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.security.GeneralSecurityException;
-import java.util.Map;
-import java.util.logging.Logger;
-
 import org.briarproject.api.Author;
 import org.briarproject.api.AuthorFactory;
 import org.briarproject.api.LocalAuthor;
 import org.briarproject.api.TransportId;
 import org.briarproject.api.TransportProperties;
 import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.KeyManager;
 import org.briarproject.api.crypto.PseudoRandom;
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.data.Reader;
 import org.briarproject.api.data.ReaderFactory;
 import org.briarproject.api.data.Writer;
@@ -29,9 +19,20 @@ import org.briarproject.api.plugins.ConnectionManager;
 import org.briarproject.api.plugins.duplex.DuplexPlugin;
 import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
 import org.briarproject.api.system.Clock;
+import org.briarproject.api.transport.KeyManager;
 import org.briarproject.api.transport.StreamReaderFactory;
 import org.briarproject.api.transport.StreamWriterFactory;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.security.GeneralSecurityException;
+import java.util.Map;
+import java.util.logging.Logger;
+
+import static java.util.logging.Level.INFO;
+import static java.util.logging.Level.WARNING;
+
 /** A connection thread for the peer being Alice in the invitation protocol. */
 class AliceConnector extends Connector {
 
@@ -49,9 +50,9 @@ class AliceConnector extends Connector {
 			Map<TransportId, TransportProperties> localProps,
 			PseudoRandom random) {
 		super(crypto, db, readerFactory, writerFactory, streamReaderFactory,
-				streamWriterFactory, authorFactory, groupFactory, keyManager,
+				streamWriterFactory, authorFactory, groupFactory,
-				connectionManager, clock, reuseConnection, group, plugin,
+				keyManager, connectionManager, clock, reuseConnection, group,
-				localAuthor, localProps, random);
+				plugin, localAuthor, localProps, random);
 	}
 
 	@Override
@@ -71,7 +72,7 @@ class AliceConnector extends Connector {
 		OutputStream out;
 		Reader r;
 		Writer w;
-		byte[] secret;
+		SecretKey master;
 		try {
 			in = conn.getReader().getInputStream();
 			out = conn.getWriter().getOutputStream();
@@ -82,7 +83,7 @@ class AliceConnector extends Connector {
 			byte[] hash = receivePublicKeyHash(r);
 			sendPublicKey(w);
 			byte[] key = receivePublicKey(r);
-			secret = deriveMasterSecret(hash, key, true);
+			master = deriveMasterSecret(hash, key, true);
 		} catch (IOException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			group.keyAgreementFailed();
@@ -96,8 +97,8 @@ class AliceConnector extends Connector {
 		}
 		// The key agreement succeeded - derive the confirmation codes
 		if (LOG.isLoggable(INFO)) LOG.info(pluginName + " agreement succeeded");
-		int[] codes = crypto.deriveConfirmationCodes(secret);
+		int aliceCode = crypto.deriveConfirmationCode(master, true);
-		int aliceCode = codes[0], bobCode = codes[1];
+		int bobCode = crypto.deriveConfirmationCode(master, false);
 		group.keyAgreementSucceeded(aliceCode, bobCode);
 		// Exchange confirmation results
 		boolean localMatched, remoteMatched;
@@ -130,19 +131,22 @@ class AliceConnector extends Connector {
 		// Confirmation succeeded - upgrade to a secure connection
 		if (LOG.isLoggable(INFO))
 			LOG.info(pluginName + " confirmation succeeded");
+		// Derive the header keys
+		SecretKey aliceHeaderKey = crypto.deriveInvitationKey(master, true);
+		SecretKey bobHeaderKey = crypto.deriveInvitationKey(master, false);
 		// Create the readers
 		InputStream streamReader =
 				streamReaderFactory.createInvitationStreamReader(in,
-						secret, false); // Bob's stream
+						bobHeaderKey);
 		r = readerFactory.createReader(streamReader);
 		// Create the writers
 		OutputStream streamWriter =
 				streamWriterFactory.createInvitationStreamWriter(out,
-						secret, true); // Alice's stream
+						aliceHeaderKey);
 		w = writerFactory.createWriter(streamWriter);
 		// Derive the invitation nonces
-		byte[][] nonces = crypto.deriveInvitationNonces(secret);
+		byte[] aliceNonce = crypto.deriveSignatureNonce(master, true);
-		byte[] aliceNonce = nonces[0], bobNonce = nonces[1];
+		byte[] bobNonce = crypto.deriveSignatureNonce(master, false);
 		// Exchange pseudonyms, signed nonces, timestamps and transports
 		Author remoteAuthor;
 		long remoteTimestamp;
@@ -171,11 +175,11 @@ class AliceConnector extends Connector {
 			tryToClose(conn, true);
 			return;
 		}
-		// The epoch is the minimum of the peers' timestamps
+		// The agreed timestamp is the minimum of the peers' timestamps
-		long epoch = Math.min(localTimestamp, remoteTimestamp);
+		long timestamp = Math.min(localTimestamp, remoteTimestamp);
 		// Add the contact and store the transports
 		try {
-			addContact(remoteAuthor, remoteProps, secret, epoch, true);
+			addContact(remoteAuthor, remoteProps, master, timestamp, true);
 		} catch (DbException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			tryToClose(conn, true);

briar-core/src/org/briarproject/invitation/BobConnector.java

@@ -1,23 +1,13 @@
 package org.briarproject.invitation;
 
-import static java.util.logging.Level.INFO;
-import static java.util.logging.Level.WARNING;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.security.GeneralSecurityException;
-import java.util.Map;
-import java.util.logging.Logger;
-
 import org.briarproject.api.Author;
 import org.briarproject.api.AuthorFactory;
 import org.briarproject.api.LocalAuthor;
 import org.briarproject.api.TransportId;
 import org.briarproject.api.TransportProperties;
 import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.KeyManager;
 import org.briarproject.api.crypto.PseudoRandom;
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.data.Reader;
 import org.briarproject.api.data.ReaderFactory;
 import org.briarproject.api.data.Writer;
@@ -29,9 +19,20 @@ import org.briarproject.api.plugins.ConnectionManager;
 import org.briarproject.api.plugins.duplex.DuplexPlugin;
 import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
 import org.briarproject.api.system.Clock;
+import org.briarproject.api.transport.KeyManager;
 import org.briarproject.api.transport.StreamReaderFactory;
 import org.briarproject.api.transport.StreamWriterFactory;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.security.GeneralSecurityException;
+import java.util.Map;
+import java.util.logging.Logger;
+
+import static java.util.logging.Level.INFO;
+import static java.util.logging.Level.WARNING;
+
 /** A connection thread for the peer being Bob in the invitation protocol. */
 class BobConnector extends Connector {
 
@@ -49,9 +50,9 @@ class BobConnector extends Connector {
 			Map<TransportId, TransportProperties> localProps,
 			PseudoRandom random) {
 		super(crypto, db, readerFactory, writerFactory, streamReaderFactory,
-				streamWriterFactory, authorFactory, groupFactory, keyManager,
+				streamWriterFactory, authorFactory, groupFactory,
-				connectionManager, clock, reuseConnection, group, plugin,
+				keyManager, connectionManager, clock, reuseConnection, group,
-				localAuthor, localProps, random);
+				plugin, localAuthor, localProps, random);
 	}
 
 	@Override
@@ -65,7 +66,7 @@ class BobConnector extends Connector {
 		OutputStream out;
 		Reader r;
 		Writer w;
-		byte[] secret;
+		SecretKey master;
 		try {
 			in = conn.getReader().getInputStream();
 			out = conn.getWriter().getOutputStream();
@@ -82,7 +83,7 @@ class BobConnector extends Connector {
 			sendPublicKeyHash(w);
 			byte[] key = receivePublicKey(r);
 			sendPublicKey(w);
-			secret = deriveMasterSecret(hash, key, false);
+			master = deriveMasterSecret(hash, key, false);
 		} catch (IOException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			group.keyAgreementFailed();
@@ -96,8 +97,8 @@ class BobConnector extends Connector {
 		}
 		// The key agreement succeeded - derive the confirmation codes
 		if (LOG.isLoggable(INFO)) LOG.info(pluginName + " agreement succeeded");
-		int[] codes = crypto.deriveConfirmationCodes(secret);
+		int aliceCode = crypto.deriveConfirmationCode(master, true);
-		int aliceCode = codes[0], bobCode = codes[1];
+		int bobCode = crypto.deriveConfirmationCode(master, false);
 		group.keyAgreementSucceeded(bobCode, aliceCode);
 		// Exchange confirmation results
 		boolean localMatched, remoteMatched;
@@ -130,19 +131,22 @@ class BobConnector extends Connector {
 		// Confirmation succeeded - upgrade to a secure connection
 		if (LOG.isLoggable(INFO))
 			LOG.info(pluginName + " confirmation succeeded");
+		// Derive the header keys
+		SecretKey aliceHeaderKey = crypto.deriveInvitationKey(master, true);
+		SecretKey bobHeaderKey = crypto.deriveInvitationKey(master, false);
 		// Create the readers
 		InputStream streamReader =
 				streamReaderFactory.createInvitationStreamReader(in,
-						secret, true); // Alice's stream
+						aliceHeaderKey);
 		r = readerFactory.createReader(streamReader);
 		// Create the writers
 		OutputStream streamWriter =
 				streamWriterFactory.createInvitationStreamWriter(out,
-						secret, false); // Bob's stream
+						bobHeaderKey);
 		w = writerFactory.createWriter(streamWriter);
 		// Derive the nonces
-		byte[][] nonces = crypto.deriveInvitationNonces(secret);
+		byte[] aliceNonce = crypto.deriveSignatureNonce(master, true);
-		byte[] aliceNonce = nonces[0], bobNonce = nonces[1];
+		byte[] bobNonce = crypto.deriveSignatureNonce(master, false);
 		// Exchange pseudonyms, signed nonces, timestamps and transports
 		Author remoteAuthor;
 		long remoteTimestamp;
@@ -171,11 +175,11 @@ class BobConnector extends Connector {
 			tryToClose(conn, true);
 			return;
 		}
-		// The epoch is the minimum of the peers' timestamps
+		// The agreed timestamp is the minimum of the peers' timestamps
-		long epoch = Math.min(localTimestamp, remoteTimestamp);
+		long timestamp = Math.min(localTimestamp, remoteTimestamp);
 		// Add the contact and store the transports
 		try {
-			addContact(remoteAuthor, remoteProps, secret, epoch, false);
+			addContact(remoteAuthor, remoteProps, master, timestamp, false);
 		} catch (DbException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			tryToClose(conn, true);

briar-core/src/org/briarproject/invitation/Connector.java

@@ -1,5 +1,46 @@
 package org.briarproject.invitation;
 
+import org.briarproject.api.Author;
+import org.briarproject.api.AuthorFactory;
+import org.briarproject.api.ContactId;
+import org.briarproject.api.FormatException;
+import org.briarproject.api.LocalAuthor;
+import org.briarproject.api.TransportId;
+import org.briarproject.api.TransportProperties;
+import org.briarproject.api.crypto.CryptoComponent;
+import org.briarproject.api.crypto.KeyPair;
+import org.briarproject.api.crypto.KeyParser;
+import org.briarproject.api.crypto.MessageDigest;
+import org.briarproject.api.crypto.PseudoRandom;
+import org.briarproject.api.crypto.SecretKey;
+import org.briarproject.api.crypto.Signature;
+import org.briarproject.api.data.Reader;
+import org.briarproject.api.data.ReaderFactory;
+import org.briarproject.api.data.Writer;
+import org.briarproject.api.data.WriterFactory;
+import org.briarproject.api.db.DatabaseComponent;
+import org.briarproject.api.db.DbException;
+import org.briarproject.api.messaging.Group;
+import org.briarproject.api.messaging.GroupFactory;
+import org.briarproject.api.plugins.ConnectionManager;
+import org.briarproject.api.plugins.duplex.DuplexPlugin;
+import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
+import org.briarproject.api.system.Clock;
+import org.briarproject.api.transport.KeyManager;
+import org.briarproject.api.transport.StreamReaderFactory;
+import org.briarproject.api.transport.StreamWriterFactory;
+import org.briarproject.api.transport.TransportKeys;
+
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.logging.Logger;
+
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
 import static org.briarproject.api.AuthorConstants.MAX_AUTHOR_NAME_LENGTH;
@@ -9,50 +50,9 @@ import static org.briarproject.api.TransportPropertyConstants.MAX_PROPERTIES_PER
 import static org.briarproject.api.TransportPropertyConstants.MAX_PROPERTY_LENGTH;
 import static org.briarproject.api.TransportPropertyConstants.MAX_TRANSPORT_ID_LENGTH;
 import static org.briarproject.api.invitation.InvitationConstants.CONNECTION_TIMEOUT;
+import static org.briarproject.api.transport.TransportConstants.MAX_CLOCK_DIFFERENCE;
 
-import java.io.IOException;
+// FIXME: This class has way too many dependencies
-import java.security.GeneralSecurityException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.logging.Logger;
-
-import org.briarproject.api.Author;
-import org.briarproject.api.AuthorFactory;
-import org.briarproject.api.ContactId;
-import org.briarproject.api.FormatException;
-import org.briarproject.api.LocalAuthor;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.TransportProperties;
-import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.KeyManager;
-import org.briarproject.api.crypto.KeyPair;
-import org.briarproject.api.crypto.KeyParser;
-import org.briarproject.api.crypto.MessageDigest;
-import org.briarproject.api.crypto.PseudoRandom;
-import org.briarproject.api.crypto.Signature;
-import org.briarproject.api.data.Reader;
-import org.briarproject.api.data.ReaderFactory;
-import org.briarproject.api.data.Writer;
-import org.briarproject.api.data.WriterFactory;
-import org.briarproject.api.db.DatabaseComponent;
-import org.briarproject.api.db.DbException;
-import org.briarproject.api.db.NoSuchTransportException;
-import org.briarproject.api.messaging.Group;
-import org.briarproject.api.messaging.GroupFactory;
-import org.briarproject.api.plugins.ConnectionManager;
-import org.briarproject.api.plugins.duplex.DuplexPlugin;
-import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
-import org.briarproject.api.system.Clock;
-import org.briarproject.api.transport.Endpoint;
-import org.briarproject.api.transport.StreamReaderFactory;
-import org.briarproject.api.transport.StreamWriterFactory;
-
 abstract class Connector extends Thread {
 
 	private static final Logger LOG =
@@ -152,8 +152,8 @@ abstract class Connector extends Thread {
 		return b;
 	}
 
-	protected byte[] deriveMasterSecret(byte[] hash, byte[] key, boolean alice)
+	protected SecretKey deriveMasterSecret(byte[] hash, byte[] key,
-			throws GeneralSecurityException {
+			boolean alice) throws GeneralSecurityException {
 		// Check that the hash matches the key
 		if (!Arrays.equals(hash, messageDigest.digest(key))) {
 			if (LOG.isLoggable(INFO))
@@ -271,39 +271,34 @@ abstract class Connector extends Thread {
 	}
 
 	protected void addContact(Author remoteAuthor,
-			Map<TransportId, TransportProperties> remoteProps,  byte[] secret,
+			Map<TransportId, TransportProperties> remoteProps, SecretKey master,
-			long epoch, boolean alice) throws DbException {
+			long timestamp, boolean alice) throws DbException {
 		// Add the contact to the database
 		contactId = db.addContact(remoteAuthor, localAuthor.getId());
 		// Create and store the inbox group
-		byte[] salt = crypto.deriveGroupSalt(secret);
+		byte[] salt = crypto.deriveGroupSalt(master);
 		Group inbox = groupFactory.createGroup("Inbox", salt);
 		db.addGroup(inbox);
 		db.setInboxGroup(contactId, inbox);
 		// Store the remote transport properties
 		db.setRemoteProperties(contactId, remoteProps);
-		// Create an endpoint for each transport shared with the contact
+		// Derive transport keys for each transport shared with the contact
-		List<TransportId> ids = new ArrayList<TransportId>();
 		Map<TransportId, Integer> latencies = db.getTransportLatencies();
-		for (TransportId id : localProps.keySet()) {
+		List<TransportKeys> keys = new ArrayList<TransportKeys>();
-			if (latencies.containsKey(id) && remoteProps.containsKey(id))
+		for (TransportId t : localProps.keySet()) {
-				ids.add(id);
+			if (remoteProps.containsKey(t) && latencies.containsKey(t)) {
-		}
+				// Work out what rotation period the timestamp belongs to
-		// Assign indices to the transports deterministically and derive keys
+				long latency = latencies.get(t);
-		Collections.sort(ids, TransportIdComparator.INSTANCE);
+				long rotationPeriodLength = latency + MAX_CLOCK_DIFFERENCE;
-		int size = ids.size();
+				long rotationPeriod = timestamp / rotationPeriodLength;
-		for (int i = 0; i < size; i++) {
+				// Derive the transport keys
-			TransportId id = ids.get(i);
+				TransportKeys k = crypto.deriveTransportKeys(t, master,
-			Endpoint ep = new Endpoint(contactId, id, epoch, alice);
+						rotationPeriod, alice);
-			int maxLatency = latencies.get(id);
+				db.addTransportKeys(contactId, k);
-			try {
+				keys.add(k);
-				db.addEndpoint(ep);
-			} catch (NoSuchTransportException e) {
-				continue;
 			}
-			byte[] initialSecret = crypto.deriveInitialSecret(secret, i);
-			keyManager.endpointAdded(ep, maxLatency, initialSecret);
 		}
+		keyManager.contactAdded(contactId, keys);
 	}
 
 	protected void tryToClose(DuplexTransportConnection conn,
@@ -322,16 +317,4 @@ abstract class Connector extends Thread {
 		TransportId t = plugin.getId();
 		connectionManager.manageOutgoingConnection(contactId, t, conn);
 	}
-
-	private static class TransportIdComparator
-	implements Comparator<TransportId> {
-
-		private static final TransportIdComparator INSTANCE =
-				new TransportIdComparator();
-
-		public int compare(TransportId t1, TransportId t2) {
-			String s1 = t1.getString(), s2 = t2.getString();
-			return String.CASE_INSENSITIVE_ORDER.compare(s1, s2);
-		}
-	}
 }

briar-core/src/org/briarproject/invitation/ConnectorGroup.java

@@ -1,19 +1,5 @@
 package org.briarproject.invitation;
 
-import static java.util.concurrent.TimeUnit.MILLISECONDS;
-import static java.util.logging.Level.WARNING;
-import static org.briarproject.api.invitation.InvitationConstants.CONFIRMATION_TIMEOUT;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Map;
-import java.util.concurrent.CopyOnWriteArrayList;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.locks.Lock;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.logging.Logger;
-
 import org.briarproject.api.Author;
 import org.briarproject.api.AuthorFactory;
 import org.briarproject.api.AuthorId;
@@ -21,7 +7,6 @@ import org.briarproject.api.LocalAuthor;
 import org.briarproject.api.TransportId;
 import org.briarproject.api.TransportProperties;
 import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.KeyManager;
 import org.briarproject.api.crypto.PseudoRandom;
 import org.briarproject.api.data.ReaderFactory;
 import org.briarproject.api.data.WriterFactory;
@@ -35,9 +20,24 @@ import org.briarproject.api.plugins.ConnectionManager;
 import org.briarproject.api.plugins.PluginManager;
 import org.briarproject.api.plugins.duplex.DuplexPlugin;
 import org.briarproject.api.system.Clock;
+import org.briarproject.api.transport.KeyManager;
 import org.briarproject.api.transport.StreamReaderFactory;
 import org.briarproject.api.transport.StreamWriterFactory;
 
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Map;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+import java.util.logging.Logger;
+
+import static java.util.concurrent.TimeUnit.MILLISECONDS;
+import static java.util.logging.Level.WARNING;
+import static org.briarproject.api.invitation.InvitationConstants.CONFIRMATION_TIMEOUT;
+
 /** A task consisting of one or more parallel connection attempts. */
 class ConnectorGroup extends Thread implements InvitationTask {
 

briar-core/src/org/briarproject/invitation/InvitationTaskFactoryImpl.java

@@ -5,7 +5,6 @@ import javax.inject.Inject;
 import org.briarproject.api.AuthorFactory;
 import org.briarproject.api.AuthorId;
 import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.KeyManager;
 import org.briarproject.api.data.ReaderFactory;
 import org.briarproject.api.data.WriterFactory;
 import org.briarproject.api.db.DatabaseComponent;
@@ -15,6 +14,7 @@ import org.briarproject.api.messaging.GroupFactory;
 import org.briarproject.api.plugins.ConnectionManager;
 import org.briarproject.api.plugins.PluginManager;
 import org.briarproject.api.system.Clock;
+import org.briarproject.api.transport.KeyManager;
 import org.briarproject.api.transport.StreamReaderFactory;
 import org.briarproject.api.transport.StreamWriterFactory;
 

briar-core/src/org/briarproject/plugins/ConnectionManagerImpl.java

@@ -14,7 +14,6 @@ import javax.inject.Inject;
 
 import org.briarproject.api.ContactId;
 import org.briarproject.api.TransportId;
-import org.briarproject.api.crypto.KeyManager;
 import org.briarproject.api.db.DbException;
 import org.briarproject.api.lifecycle.IoExecutor;
 import org.briarproject.api.messaging.MessagingSession;
@@ -24,10 +23,10 @@ import org.briarproject.api.plugins.ConnectionRegistry;
 import org.briarproject.api.plugins.TransportConnectionReader;
 import org.briarproject.api.plugins.TransportConnectionWriter;
 import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
+import org.briarproject.api.transport.KeyManager;
 import org.briarproject.api.transport.StreamContext;
 import org.briarproject.api.transport.StreamReaderFactory;
 import org.briarproject.api.transport.StreamWriterFactory;
-import org.briarproject.api.transport.TagRecogniser;
 
 class ConnectionManagerImpl implements ConnectionManager {
 
@@ -36,7 +35,6 @@ class ConnectionManagerImpl implements ConnectionManager {
 
 	private final Executor ioExecutor;
 	private final KeyManager keyManager;
-	private final TagRecogniser tagRecogniser;
 	private final StreamReaderFactory streamReaderFactory;
 	private final StreamWriterFactory streamWriterFactory;
 	private final MessagingSessionFactory messagingSessionFactory;
@@ -44,14 +42,12 @@ class ConnectionManagerImpl implements ConnectionManager {
 
 	@Inject
 	ConnectionManagerImpl(@IoExecutor Executor ioExecutor,
-			KeyManager keyManager, TagRecogniser tagRecogniser,
+			KeyManager keyManager, StreamReaderFactory streamReaderFactory,
-			StreamReaderFactory streamReaderFactory,
 			StreamWriterFactory streamWriterFactory,
 			MessagingSessionFactory messagingSessionFactory,
 			ConnectionRegistry connectionRegistry) {
 		this.ioExecutor = ioExecutor;
 		this.keyManager = keyManager;
-		this.tagRecogniser = tagRecogniser;
 		this.streamReaderFactory = streamReaderFactory;
 		this.streamWriterFactory = streamWriterFactory;
 		this.messagingSessionFactory = messagingSessionFactory;
@@ -134,7 +130,7 @@ class ConnectionManagerImpl implements ConnectionManager {
 			StreamContext ctx;
 			try {
 				byte[] tag = readTag(transportId, reader);
-				ctx = tagRecogniser.recogniseTag(transportId, tag);
+				ctx = keyManager.recogniseTag(transportId, tag);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 				disposeReader(true, false);
@@ -238,7 +234,7 @@ class ConnectionManagerImpl implements ConnectionManager {
 			StreamContext ctx;
 			try {
 				byte[] tag = readTag(transportId, reader);
-				ctx = tagRecogniser.recogniseTag(transportId, tag);
+				ctx = keyManager.recogniseTag(transportId, tag);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 				disposeReader(true, false);
@@ -367,7 +363,7 @@ class ConnectionManagerImpl implements ConnectionManager {
 			StreamContext ctx;
 			try {
 				byte[] tag = readTag(transportId, reader);
-				ctx = tagRecogniser.recogniseTag(transportId, tag);
+				ctx = keyManager.recogniseTag(transportId, tag);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 				disposeReader(true, true);

briar-core/src/org/briarproject/plugins/PluginManagerImpl.java

@@ -1,22 +1,5 @@
 package org.briarproject.plugins;
 
-import static java.util.logging.Level.INFO;
-import static java.util.logging.Level.WARNING;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.CopyOnWriteArrayList;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.Executor;
-import java.util.logging.Logger;
-
-import javax.inject.Inject;
-
 import org.briarproject.api.ContactId;
 import org.briarproject.api.TransportConfig;
 import org.briarproject.api.TransportId;
@@ -42,6 +25,23 @@ import org.briarproject.api.plugins.simplex.SimplexPluginFactory;
 import org.briarproject.api.system.Clock;
 import org.briarproject.api.ui.UiCallback;
 
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.Executor;
+import java.util.logging.Logger;
+
+import javax.inject.Inject;
+
+import static java.util.logging.Level.INFO;
+import static java.util.logging.Level.WARNING;
+
 class PluginManagerImpl implements PluginManager {
 
 	private static final Logger LOG =
@@ -367,7 +367,7 @@ class PluginManagerImpl implements PluginManager {
 	}
 
 	private class SimplexCallback extends PluginCallbackImpl
-	implements SimplexPluginCallback {
+			implements SimplexPluginCallback {
 
 		private SimplexCallback(TransportId id) {
 			super(id);
@@ -383,7 +383,7 @@ class PluginManagerImpl implements PluginManager {
 	}
 
 	private class DuplexCallback extends PluginCallbackImpl
-	implements DuplexPluginCallback {
+			implements DuplexPluginCallback {
 
 		private DuplexCallback(TransportId id) {
 			super(id);

briar-core/src/org/briarproject/transport/KeyManagerImpl.java

@@ -1,27 +1,10 @@
 package org.briarproject.transport;
 
-import static java.util.logging.Level.WARNING;
-import static org.briarproject.api.transport.TransportConstants.MAX_CLOCK_DIFFERENCE;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.TimerTask;
-import java.util.concurrent.locks.Lock;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.logging.Logger;
-
-import javax.inject.Inject;
-
 import org.briarproject.api.ContactId;
 import org.briarproject.api.TransportId;
 import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.KeyManager;
 import org.briarproject.api.db.DatabaseComponent;
+import org.briarproject.api.db.DatabaseExecutor;
 import org.briarproject.api.db.DbException;
 import org.briarproject.api.event.ContactRemovedEvent;
 import org.briarproject.api.event.Event;
@@ -31,429 +14,115 @@ import org.briarproject.api.event.TransportAddedEvent;
 import org.briarproject.api.event.TransportRemovedEvent;
 import org.briarproject.api.system.Clock;
 import org.briarproject.api.system.Timer;
-import org.briarproject.api.transport.Endpoint;
+import org.briarproject.api.transport.KeyManager;
 import org.briarproject.api.transport.StreamContext;
-import org.briarproject.api.transport.TagRecogniser;
+import org.briarproject.api.transport.TransportKeys;
-import org.briarproject.api.transport.TemporarySecret;
 
-// FIXME: Don't make alien calls with a lock held
+import java.util.Collection;
-class KeyManagerImpl extends TimerTask implements KeyManager, EventListener {
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.Executor;
+import java.util.logging.Logger;
 
-	private static final int MS_BETWEEN_CHECKS = 60 * 1000;
+import javax.inject.Inject;
+
+import static java.util.logging.Level.WARNING;
+
+class KeyManagerImpl implements KeyManager, EventListener {
 
 	private static final Logger LOG =
 			Logger.getLogger(KeyManagerImpl.class.getName());
 
-	private final CryptoComponent crypto;
 	private final DatabaseComponent db;
+	private final CryptoComponent crypto;
+	private final Executor dbExecutor;
 	private final EventBus eventBus;
-	private final TagRecogniser tagRecogniser;
-	private final Clock clock;
 	private final Timer timer;
-	private final Lock lock = new ReentrantLock();
+	private final Clock clock;
-
+	private final ConcurrentHashMap<TransportId, TransportKeyManager> managers;
-	// The following are locking: lock
-	private final Map<TransportId, Integer> maxLatencies;
-	private final Map<EndpointKey, TemporarySecret> oldSecrets;
-	private final Map<EndpointKey, TemporarySecret> currentSecrets;
-	private final Map<EndpointKey, TemporarySecret> newSecrets;
 
 	@Inject
-	KeyManagerImpl(CryptoComponent crypto, DatabaseComponent db,
+	KeyManagerImpl(DatabaseComponent db, CryptoComponent crypto,
-			EventBus eventBus, TagRecogniser tagRecogniser, Clock clock,
+			@DatabaseExecutor Executor dbExecutor, EventBus eventBus,
-			Timer timer) {
+			Timer timer, Clock clock) {
-		this.crypto = crypto;
 		this.db = db;
+		this.crypto = crypto;
+		this.dbExecutor = dbExecutor;
 		this.eventBus = eventBus;
-		this.tagRecogniser = tagRecogniser;
-		this.clock = clock;
 		this.timer = timer;
-		maxLatencies = new HashMap<TransportId, Integer>();
+		this.clock = clock;
-		oldSecrets = new HashMap<EndpointKey, TemporarySecret>();
+		managers = new ConcurrentHashMap<TransportId, TransportKeyManager>();
-		currentSecrets = new HashMap<EndpointKey, TemporarySecret>();
-		newSecrets = new HashMap<EndpointKey, TemporarySecret>();
 	}
 
 	public boolean start() {
-		lock.lock();
+		eventBus.addListener(this);
 		try {
-			eventBus.addListener(this);
+			Map<TransportId, Integer> latencies = db.getTransportLatencies();
-			// Load the temporary secrets and transport latencies from the DB
+			for (Entry<TransportId, Integer> e : latencies.entrySet())
-			Collection<TemporarySecret> secrets;
+				addTransport(e.getKey(), e.getValue());
-			try {
+		} catch (DbException e) {
-				secrets = db.getSecrets();
+			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				maxLatencies.putAll(db.getTransportLatencies());
+			return false;
-			} catch (DbException e) {
-				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				return false;
-			}
-			// Work out what phase of its lifecycle each secret is in
-			long now = clock.currentTimeMillis();
-			Collection<TemporarySecret> dead =
-					assignSecretsToMaps(now, secrets);
-			// Replace any dead secrets
-			Collection<TemporarySecret> created = replaceDeadSecrets(now, dead);
-			if (!created.isEmpty()) {
-				// Store any secrets that have been created,
-				// removing any dead ones
-				try {
-					db.addSecrets(created);
-				} catch (DbException e) {
-					if (LOG.isLoggable(WARNING))
-						LOG.log(WARNING, e.toString(), e);
-					return false;
-				}
-			}
-			// Pass the old, current and new secrets to the recogniser
-			for (TemporarySecret s : oldSecrets.values())
-				tagRecogniser.addSecret(s);
-			for (TemporarySecret s : currentSecrets.values())
-				tagRecogniser.addSecret(s);
-			for (TemporarySecret s : newSecrets.values())
-				tagRecogniser.addSecret(s);
-			// Schedule periodic key rotation
-			timer.scheduleAtFixedRate(this, MS_BETWEEN_CHECKS,
-					MS_BETWEEN_CHECKS);
-			return true;
-		} finally {
-			lock.unlock();
 		}
-	}
+		return true;
-
-	// Assigns secrets to the appropriate maps and returns any dead secrets
-	// Locking: lock
-	private Collection<TemporarySecret> assignSecretsToMaps(long now,
-			Collection<TemporarySecret> secrets) {
-		Collection<TemporarySecret> dead = new ArrayList<TemporarySecret>();
-		for (TemporarySecret s : secrets) {
-			// Discard the secret if the transport has been removed
-			Integer maxLatency = maxLatencies.get(s.getTransportId());
-			if (maxLatency == null) {
-				LOG.info("Discarding obsolete secret");
-				continue;
-			}
-			long rotation = maxLatency + MAX_CLOCK_DIFFERENCE;
-			long creationTime = s.getEpoch() + rotation * (s.getPeriod() - 2);
-			long activationTime = creationTime + rotation;
-			long deactivationTime = activationTime + rotation;
-			long destructionTime = deactivationTime + rotation;
-			if (now >= destructionTime) {
-				dead.add(s);
-			} else if (now >= deactivationTime) {
-				oldSecrets.put(new EndpointKey(s), s);
-			} else if (now >= activationTime) {
-				currentSecrets.put(new EndpointKey(s), s);
-			} else if (now >= creationTime) {
-				newSecrets.put(new EndpointKey(s), s);
-			} else {
-				// FIXME: Work out what to do here
-				throw new Error("Clock has moved backwards");
-			}
-		}
-		return dead;
-	}
-
-	// Replaces the given secrets and returns any secrets created
-	// Locking: lock
-	private Collection<TemporarySecret> replaceDeadSecrets(long now,
-			Collection<TemporarySecret> dead) {
-		// If there are several dead secrets for an endpoint, use the newest
-		Map<EndpointKey, TemporarySecret> newest =
-				new HashMap<EndpointKey, TemporarySecret>();
-		for (TemporarySecret s : dead) {
-			EndpointKey k = new EndpointKey(s);
-			TemporarySecret exists = newest.get(k);
-			if (exists == null) {
-				// There's no other secret for this endpoint
-				newest.put(k, s);
-			} else if (exists.getPeriod() < s.getPeriod()) {
-				// There's an older secret - use this one instead
-				newest.put(k, s);
-			} else {
-				// There's a newer secret - keep using it
-			}
-		}
-		Collection<TemporarySecret> created = new ArrayList<TemporarySecret>();
-		for (Entry<EndpointKey, TemporarySecret> e : newest.entrySet()) {
-			TemporarySecret s = e.getValue();
-			Integer maxLatency = maxLatencies.get(s.getTransportId());
-			if (maxLatency == null) throw new IllegalStateException();
-			// Work out which rotation period we're in
-			long elapsed = now - s.getEpoch();
-			long rotation = maxLatency + MAX_CLOCK_DIFFERENCE;
-			long period = (elapsed / rotation) + 1;
-			if (period < 1) throw new IllegalStateException();
-			if (period - s.getPeriod() < 2)
-				throw new IllegalStateException();
-			// Derive the old, current and new secrets
-			byte[] b1 = s.getSecret();
-			for (long p = s.getPeriod() + 1; p < period; p++)
-				b1 = crypto.deriveNextSecret(b1, p);
-			byte[] b2 = crypto.deriveNextSecret(b1, period);
-			byte[] b3 = crypto.deriveNextSecret(b2, period + 1);
-			// Add the secrets to their respective maps if not already present
-			EndpointKey k = e.getKey();
-			if (!oldSecrets.containsKey(k)) {
-				TemporarySecret s1 = new TemporarySecret(s, period - 1, b1);
-				oldSecrets.put(k, s1);
-				created.add(s1);
-			}
-			if (!currentSecrets.containsKey(k)) {
-				TemporarySecret s2 = new TemporarySecret(s, period, b2);
-				currentSecrets.put(k, s2);
-				created.add(s2);
-			}
-			if (!newSecrets.containsKey(k)) {
-				TemporarySecret s3 = new TemporarySecret(s, period + 1, b3);
-				newSecrets.put(k, s3);
-				created.add(s3);
-			}
-		}
-		return created;
 	}
 
 	public boolean stop() {
-		lock.lock();
+		eventBus.removeListener(this);
-		try {
+		return true;
-			eventBus.removeListener(this);
+	}
-			timer.cancel();
+
-			tagRecogniser.removeSecrets();
+	public void contactAdded(ContactId c, Collection<TransportKeys> keys) {
-			maxLatencies.clear();
+		for (TransportKeys k : keys) {
-			oldSecrets.clear();
+			TransportKeyManager m = managers.get(k.getTransportId());
-			currentSecrets.clear();
+			if (m != null) m.addContact(c, k);
-			newSecrets.clear();
-			return true;
-		} finally {
-			lock.unlock();
 		}
 	}
 
-	public StreamContext getStreamContext(ContactId c,
+	public StreamContext getStreamContext(ContactId c, TransportId t) {
-			TransportId t) {
+		TransportKeyManager m = managers.get(t);
-		lock.lock();
+		return m == null ? null : m.getStreamContext(c);
-		try {
-			TemporarySecret s = currentSecrets.get(new EndpointKey(c, t));
-			if (s == null) {
-				LOG.info("No secret for endpoint");
-				return null;
-			}
-			long streamNumber;
-			try {
-				streamNumber = db.incrementStreamCounter(c, t, s.getPeriod());
-				if (streamNumber == -1) {
-					LOG.info("No counter for period");
-					return null;
-				}
-			} catch (DbException e) {
-				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				return null;
-			}
-			byte[] secret = s.getSecret();
-			return new StreamContext(c, t, secret, streamNumber, s.getAlice());
-		} finally {
-			lock.unlock();
-		}
 	}
 
-	public void endpointAdded(Endpoint ep, int maxLatency,
+	public StreamContext recogniseTag(TransportId t, byte[] tag)
-			byte[] initialSecret) {
+			throws DbException {
-		lock.lock();
+		TransportKeyManager m = managers.get(t);
-		try {
+		return m == null ? null : m.recogniseTag(tag);
-			maxLatencies.put(ep.getTransportId(), maxLatency);
-			// Work out which rotation period we're in
-			long elapsed = clock.currentTimeMillis() - ep.getEpoch();
-			long rotation = maxLatency + MAX_CLOCK_DIFFERENCE;
-			long period = (elapsed / rotation) + 1;
-			if (period < 1) throw new IllegalStateException();
-			// Derive the old, current and new secrets
-			byte[] b1 = initialSecret;
-			for (long p = 0; p < period; p++)
-				b1 = crypto.deriveNextSecret(b1, p);
-			byte[] b2 = crypto.deriveNextSecret(b1, period);
-			byte[] b3 = crypto.deriveNextSecret(b2, period + 1);
-			TemporarySecret s1 = new TemporarySecret(ep, period - 1, b1);
-			TemporarySecret s2 = new TemporarySecret(ep, period, b2);
-			TemporarySecret s3 = new TemporarySecret(ep, period + 1, b3);
-			// Add the incoming secrets to their respective maps
-			EndpointKey k = new EndpointKey(ep);
-			oldSecrets.put(k, s1);
-			currentSecrets.put(k, s2);
-			newSecrets.put(k, s3);
-			// Store the new secrets
-			try {
-				db.addSecrets(Arrays.asList(s1, s2, s3));
-			} catch (DbException e) {
-				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				return;
-			}
-			// Pass the new secrets to the recogniser
-			tagRecogniser.addSecret(s1);
-			tagRecogniser.addSecret(s2);
-			tagRecogniser.addSecret(s3);
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	@Override
-	public void run() {
-		lock.lock();
-		try {
-			// Rebuild the maps because we may be running a whole period late
-			Collection<TemporarySecret> secrets = new ArrayList<TemporarySecret>();
-			secrets.addAll(oldSecrets.values());
-			secrets.addAll(currentSecrets.values());
-			secrets.addAll(newSecrets.values());
-			oldSecrets.clear();
-			currentSecrets.clear();
-			newSecrets.clear();
-			// Work out what phase of its lifecycle each secret is in
-			long now = clock.currentTimeMillis();
-			Collection<TemporarySecret> dead = assignSecretsToMaps(now, secrets);
-			// Remove any dead secrets from the recogniser
-			for (TemporarySecret s : dead) {
-				ContactId c = s.getContactId();
-				TransportId t = s.getTransportId();
-				long period = s.getPeriod();
-				tagRecogniser.removeSecret(c, t, period);
-			}
-			// Replace any dead secrets
-			Collection<TemporarySecret> created = replaceDeadSecrets(now, dead);
-			if (!created.isEmpty()) {
-				// Store any secrets that have been created
-				try {
-					db.addSecrets(created);
-				} catch (DbException e) {
-					if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				}
-				// Pass any secrets that have been created to the recogniser
-				for (TemporarySecret s : created) tagRecogniser.addSecret(s);
-			}
-		} finally {
-			lock.unlock();
-		}
 	}
 
 	public void eventOccurred(Event e) {
-		if (e instanceof ContactRemovedEvent) {
+		if (e instanceof TransportAddedEvent) {
-			ContactRemovedEvent c = (ContactRemovedEvent) e;
-			timer.schedule(new ContactRemovedTask(c), 0);
-		} else if (e instanceof TransportAddedEvent) {
 			TransportAddedEvent t = (TransportAddedEvent) e;
-			timer.schedule(new TransportAddedTask(t), 0);
+			addTransport(t.getTransportId(), t.getMaxLatency());
 		} else if (e instanceof TransportRemovedEvent) {
-			TransportRemovedEvent t = (TransportRemovedEvent) e;
+			removeTransport(((TransportRemovedEvent) e).getTransportId());
-			timer.schedule(new TransportRemovedTask(t), 0);
+		} else if (e instanceof ContactRemovedEvent) {
+			removeContact(((ContactRemovedEvent) e).getContactId());
 		}
 	}
 
-	// Locking: lock
+	private void addTransport(final TransportId t, final int maxLatency) {
-	private void removeSecrets(ContactId c, Map<?, TemporarySecret> m) {
+		dbExecutor.execute(new Runnable() {
-		Iterator<TemporarySecret> it = m.values().iterator();
+			public void run() {
-		while (it.hasNext())
+				TransportKeyManager m = new TransportKeyManager(db, crypto,
-			if (it.next().getContactId().equals(c)) it.remove();
+						dbExecutor, timer, clock, t, maxLatency);
-	}
+				// Don't add transport twice if event is received during startup
-
+				if (managers.putIfAbsent(t, m) == null) m.start();
-	// Locking: lock
-	private void removeSecrets(TransportId t, Map<?, TemporarySecret> m) {
-		Iterator<TemporarySecret> it = m.values().iterator();
-		while (it.hasNext())
-			if (it.next().getTransportId().equals(t)) it.remove();
-	}
-
-	private static class EndpointKey {
-
-		private final ContactId contactId;
-		private final TransportId transportId;
-
-		private EndpointKey(ContactId contactId, TransportId transportId) {
-			this.contactId = contactId;
-			this.transportId = transportId;
-		}
-
-		private EndpointKey(Endpoint ep) {
-			this(ep.getContactId(), ep.getTransportId());
-		}
-
-		@Override
-		public int hashCode() {
-			return contactId.hashCode() ^ transportId.hashCode();
-		}
-
-		@Override
-		public boolean equals(Object o) {
-			if (o instanceof EndpointKey) {
-				EndpointKey k = (EndpointKey) o;
-				return contactId.equals(k.contactId) &&
-						transportId.equals(k.transportId);
 			}
-			return false;
+		});
-		}
 	}
 
-	private class ContactRemovedTask extends TimerTask {
+	private void removeTransport(TransportId t) {
-
+		managers.remove(t);
-		private final ContactRemovedEvent event;
-
-		private ContactRemovedTask(ContactRemovedEvent event) {
-			this.event = event;
-		}
-
-		@Override
-		public void run() {
-			ContactId c = event.getContactId();
-			tagRecogniser.removeSecrets(c);
-			lock.lock();
-			try {
-				removeSecrets(c, oldSecrets);
-				removeSecrets(c, currentSecrets);
-				removeSecrets(c, newSecrets);
-			} finally {
-				lock.unlock();
-			}
-		}
 	}
 
-	private class TransportAddedTask extends TimerTask {
+	private void removeContact(final ContactId c) {
-
+		dbExecutor.execute(new Runnable() {
-		private final TransportAddedEvent event;
+			public void run() {
-
+				for (TransportKeyManager m : managers.values())
-		private TransportAddedTask(TransportAddedEvent event) {
+					m.removeContact(c);
-			this.event = event;
-		}
-
-		@Override
-		public void run() {
-			lock.lock();
-			try {
-				maxLatencies.put(event.getTransportId(), event.getMaxLatency());
-			} finally {
-				lock.unlock();
 			}
-		}
+		});
-	}
-
-	private class TransportRemovedTask extends TimerTask {
-
-		private TransportRemovedEvent event;
-
-		private TransportRemovedTask(TransportRemovedEvent event) {
-			this.event = event;
-		}
-
-		@Override
-		public void run() {
-			TransportId t = event.getTransportId();
-			tagRecogniser.removeSecrets(t);
-			lock.lock();
-			try {
-				maxLatencies.remove(t);
-				removeSecrets(t, oldSecrets);
-				removeSecrets(t, currentSecrets);
-				removeSecrets(t, newSecrets);
-			} finally {
-				lock.unlock();
-			}
-		}
 	}
 }

briar-core/src/org/briarproject/transport/MutableIncomingKeys.java

@@ -0,0 +1,40 @@
+package org.briarproject.transport;
+
+import org.briarproject.api.crypto.SecretKey;
+import org.briarproject.api.transport.IncomingKeys;
+
+// This class is not thread-safe
+class MutableIncomingKeys {
+
+	private final SecretKey tagKey, headerKey;
+	private final long rotationPeriod;
+	private final ReorderingWindow window;
+
+	MutableIncomingKeys(IncomingKeys in) {
+		tagKey = in.getTagKey();
+		headerKey = in.getHeaderKey();
+		rotationPeriod = in.getRotationPeriod();
+		window = new ReorderingWindow(in.getWindowBase(), in.getWindowBitmap());
+	}
+
+	IncomingKeys snapshot() {
+		return new IncomingKeys(tagKey, headerKey, rotationPeriod,
+				window.getBase(), window.getBitmap());
+	}
+
+	SecretKey getTagKey() {
+		return tagKey;
+	}
+
+	SecretKey getHeaderKey() {
+		return headerKey;
+	}
+
+	long getRotationPeriod() {
+		return rotationPeriod;
+	}
+
+	ReorderingWindow getWindow() {
+		return window;
+	}
+}

briar-core/src/org/briarproject/transport/MutableOutgoingKeys.java

@@ -0,0 +1,44 @@
+package org.briarproject.transport;
+
+import org.briarproject.api.crypto.SecretKey;
+import org.briarproject.api.transport.OutgoingKeys;
+
+// This class is not thread-safe
+class MutableOutgoingKeys {
+
+	private final SecretKey tagKey, headerKey;
+	private final long rotationPeriod;
+	private long streamCounter;
+
+	MutableOutgoingKeys(OutgoingKeys out) {
+		tagKey = out.getTagKey();
+		headerKey = out.getHeaderKey();
+		rotationPeriod = out.getRotationPeriod();
+		streamCounter = out.getStreamCounter();
+	}
+
+	OutgoingKeys snapshot() {
+		return new OutgoingKeys(tagKey, headerKey, rotationPeriod,
+				streamCounter);
+	}
+
+	SecretKey getTagKey() {
+		return tagKey;
+	}
+
+	SecretKey getHeaderKey() {
+		return headerKey;
+	}
+
+	long getRotationPeriod() {
+		return rotationPeriod;
+	}
+
+	long getStreamCounter() {
+		return streamCounter;
+	}
+
+	void incrementStreamCounter() {
+		streamCounter++;
+	}
+}

briar-core/src/org/briarproject/transport/MutableTransportKeys.java

@@ -0,0 +1,44 @@
+package org.briarproject.transport;
+
+import org.briarproject.api.TransportId;
+import org.briarproject.api.transport.TransportKeys;
+
+class MutableTransportKeys {
+
+	private final TransportId transportId;
+	private final MutableIncomingKeys inPrev, inCurr, inNext;
+	private final MutableOutgoingKeys outCurr;
+
+	MutableTransportKeys(TransportKeys k) {
+		transportId = k.getTransportId();
+		inPrev = new MutableIncomingKeys(k.getPreviousIncomingKeys());
+		inCurr = new MutableIncomingKeys(k.getCurrentIncomingKeys());
+		inNext = new MutableIncomingKeys(k.getNextIncomingKeys());
+		outCurr = new MutableOutgoingKeys(k.getCurrentOutgoingKeys());
+	}
+
+	TransportKeys snapshot() {
+		return new TransportKeys(transportId, inPrev.snapshot(),
+				inCurr.snapshot(), inNext.snapshot(), outCurr.snapshot());
+	}
+
+	TransportId getTransportId() {
+		return transportId;
+	}
+
+	MutableIncomingKeys getPreviousIncomingKeys() {
+		return inPrev;
+	}
+
+	MutableIncomingKeys getCurrentIncomingKeys() {
+		return inCurr;
+	}
+
+	MutableIncomingKeys getNextIncomingKeys() {
+		return inNext;
+	}
+
+	MutableOutgoingKeys getCurrentOutgoingKeys() {
+		return outCurr;
+	}
+}

briar-core/src/org/briarproject/transport/ReorderingWindow.java

@@ -1,102 +1,98 @@
 package org.briarproject.transport;
 
-import static org.briarproject.api.transport.TransportConstants.REORDERING_WINDOW_SIZE;
-import static org.briarproject.util.ByteUtils.MAX_32_BIT_UNSIGNED;
-
 import java.util.ArrayList;
-import java.util.Collection;
+import java.util.Collections;
-import java.util.HashSet;
+import java.util.List;
-import java.util.Set;
+
+import static org.briarproject.util.ByteUtils.MAX_32_BIT_UNSIGNED;
 
 // This class is not thread-safe
 class ReorderingWindow {
 
-	private final Set<Long> unseen;
+	private long base;
+	private boolean[] seen;
 
-	private long centre;
+	ReorderingWindow(long base, byte[] bitmap) {
-
+		if (base < 0) throw new IllegalArgumentException();
-	ReorderingWindow() {
+		if (base > MAX_32_BIT_UNSIGNED + 1)
-		unseen = new HashSet<Long>();
-		for (long l = 0; l < REORDERING_WINDOW_SIZE / 2; l++) unseen.add(l);
-		centre = 0;
-	}
-
-	ReorderingWindow(long centre, byte[] bitmap) {
-		if (centre < 0 || centre > MAX_32_BIT_UNSIGNED + 1)
 			throw new IllegalArgumentException();
-		if (bitmap.length != REORDERING_WINDOW_SIZE / 8)
+		this.base = base;
-			throw new IllegalArgumentException();
+		seen = new boolean[bitmap.length * 8];
-		this.centre = centre;
+		for (int i = 0; i < bitmap.length; i++) {
-		unseen = new HashSet<Long>();
+			for (int j = 0; j < 8; j++) {
-		long bitmapBottom = centre - REORDERING_WINDOW_SIZE / 2;
+				if ((bitmap[i] & (128 >> j)) != 0) seen[i * 8 + j] = true;
-		for (int bytes = 0; bytes < bitmap.length; bytes++) {
-			for (int bits = 0; bits < 8; bits++) {
-				long streamNumber = bitmapBottom + bytes * 8 + bits;
-				if (streamNumber >= 0 && streamNumber <= MAX_32_BIT_UNSIGNED) {
-					if ((bitmap[bytes] & (128 >> bits)) == 0)
-						unseen.add(streamNumber);
-				}
 			}
 		}
 	}
 
-	boolean isSeen(long streamNumber) {
+	long getBase() {
-		return !unseen.contains(streamNumber);
+		return base;
-	}
-
-	Collection<Long> setSeen(long streamNumber) {
-		long bottom = getBottom(centre);
-		long top = getTop(centre);
-		if (streamNumber < bottom || streamNumber > top)
-			throw new IllegalArgumentException();
-		if (!unseen.remove(streamNumber))
-			throw new IllegalArgumentException();
-		Collection<Long> changed = new ArrayList<Long>();
-		if (streamNumber >= centre) {
-			centre = streamNumber + 1;
-			long newBottom = getBottom(centre);
-			long newTop = getTop(centre);
-			for (long l = bottom; l < newBottom; l++) {
-				if (unseen.remove(l)) changed.add(l);
-			}
-			for (long l = top + 1; l <= newTop; l++) {
-				if (unseen.add(l)) changed.add(l);
-			}
-		}
-		return changed;
-	}
-
-	long getCentre() {
-		return centre;
 	}
 
 	byte[] getBitmap() {
-		byte[] bitmap = new byte[REORDERING_WINDOW_SIZE / 8];
+		byte[] bitmap = new byte[seen.length / 8];
-		long bitmapBottom = centre - REORDERING_WINDOW_SIZE / 2;
+		for (int i = 0; i < bitmap.length; i++) {
-		for (int bytes = 0; bytes < bitmap.length; bytes++) {
+			for (int j = 0; j < 8; j++) {
-			for (int bits = 0; bits < 8; bits++) {
+				if (seen[i * 8 + j]) bitmap[i] |= 128 >> j;
-				long streamNumber = bitmapBottom + bytes * 8 + bits;
-				if (streamNumber >= 0 && streamNumber <= MAX_32_BIT_UNSIGNED) {
-					if (!unseen.contains(streamNumber))
-						bitmap[bytes] |= 128 >> bits;
-				}
 			}
 		}
 		return bitmap;
 	}
 
-	// Returns the lowest value contained in a window with the given centre
+	List<Long> getUnseen() {
-	private static long getBottom(long centre) {
+		List<Long> unseen = new ArrayList<Long>(seen.length);
-		return Math.max(0, centre - REORDERING_WINDOW_SIZE / 2);
+		for (int i = 0; i < seen.length; i++)
-	}
+			if (!seen[i]) unseen.add(base + i);
-
-	// Returns the highest value contained in a window with the given centre
-	private static long getTop(long centre) {
-		return Math.min(MAX_32_BIT_UNSIGNED,
-				centre + REORDERING_WINDOW_SIZE / 2 - 1);
-	}
-
-	public Collection<Long> getUnseen() {
 		return unseen;
 	}
+
+	Change setSeen(long index) {
+		if (index < base) throw new IllegalArgumentException();
+		if (index >= base + seen.length) throw new IllegalArgumentException();
+		if (index > MAX_32_BIT_UNSIGNED) throw new IllegalArgumentException();
+		int offset = (int) (index - base);
+		if (seen[offset]) throw new IllegalArgumentException();
+		seen[offset] = true;
+		// Rule 1: Slide until all elements above the midpoint are unseen
+		int slide = Math.max(0, offset + 1 - seen.length / 2);
+		// Rule 2: Slide until the lowest element is unseen
+		while (seen[slide]) slide++;
+		// If the window doesn't need to slide, return
+		if (slide == 0) {
+			List<Long> added = Collections.emptyList();
+			List<Long> removed = Collections.singletonList(index);
+			return new Change(added, removed);
+		}
+		// Record the elements that will be added and removed
+		List<Long> added = new ArrayList<Long>(slide);
+		List<Long> removed = new ArrayList<Long>(slide);
+		for (int i = 0; i < slide; i++) {
+			if (!seen[i]) removed.add(base + i);
+			added.add(base + seen.length + i);
+		}
+		removed.add(index);
+		// Update the window
+		base += slide;
+		for (int i = 0; i + slide < seen.length; i++) seen[i] = seen[i + slide];
+		for (int i = seen.length - slide; i < seen.length; i++) seen[i] = false;
+		return new Change(added, removed);
+	}
+
+	static class Change {
+
+		private final List<Long> added, removed;
+
+		Change(List<Long> added, List<Long> removed) {
+			this.added = added;
+			this.removed = removed;
+		}
+
+		List<Long> getAdded() {
+			return added;
+		}
+
+		List<Long> getRemoved() {
+			return removed;
+		}
+	}
 }

briar-core/src/org/briarproject/transport/StreamReaderFactoryImpl.java

@@ -4,6 +4,7 @@ import java.io.InputStream;
 
 import javax.inject.Inject;
 
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.crypto.StreamDecrypterFactory;
 import org.briarproject.api.transport.StreamContext;
 import org.briarproject.api.transport.StreamReaderFactory;
@@ -23,9 +24,9 @@ class StreamReaderFactoryImpl implements StreamReaderFactory {
 	}
 
 	public InputStream createInvitationStreamReader(InputStream in,
-			byte[] secret, boolean alice) {
+			SecretKey headerKey) {
 		return new StreamReaderImpl(
 				streamDecrypterFactory.createInvitationStreamDecrypter(in,
-						secret, alice));
+						headerKey));
 	}
 }

briar-core/src/org/briarproject/transport/StreamReaderImpl.java

@@ -7,6 +7,12 @@ import java.io.InputStream;
 
 import org.briarproject.api.crypto.StreamDecrypter;
 
+/**
+ * An {@link java.io.InputStream InputStream} that unpacks payload data from
+ * transport frames.
+ * <p>
+ * This class is not thread-safe.
+ */
 class StreamReaderImpl extends InputStream {
 
 	private final StreamDecrypter decrypter;
@@ -50,7 +56,7 @@ class StreamReaderImpl extends InputStream {
 	}
 
 	private void readFrame() throws IOException {
-		assert length == 0;
+		if (length != 0) throw new IllegalStateException();
 		offset = 0;
 		length = decrypter.readFrame(payload);
 	}

briar-core/src/org/briarproject/transport/StreamWriterFactoryImpl.java

@@ -4,6 +4,7 @@ import java.io.OutputStream;
 
 import javax.inject.Inject;
 
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.crypto.StreamEncrypterFactory;
 import org.briarproject.api.transport.StreamContext;
 import org.briarproject.api.transport.StreamWriterFactory;
@@ -24,9 +25,9 @@ class StreamWriterFactoryImpl implements StreamWriterFactory {
 	}
 
 	public OutputStream createInvitationStreamWriter(OutputStream out,
-			byte[] secret, boolean alice) {
+			SecretKey headerKey) {
 		return new StreamWriterImpl(
 				streamEncrypterFactory.createInvitationStreamEncrypter(out,
-						secret, alice));
+						headerKey));
 	}
 }

briar-core/src/org/briarproject/transport/StreamWriterImpl.java

@@ -8,9 +8,9 @@ import java.io.OutputStream;
 import org.briarproject.api.crypto.StreamEncrypter;
 
 /**
- * A {@link org.briarproject.api.transport.StreamWriter StreamWriter} that
+ * An {@link java.io.OutputStream OutputStream} that packs data into transport
- * buffers its input and writes a frame whenever there is a full frame to write
+ * frames, writing a frame whenever there is a full frame to write or the
- * or the {@link #flush()} method is called.
+ * {@link #flush()} method is called.
  * <p>
  * This class is not thread-safe.
  */

briar-core/src/org/briarproject/transport/TagRecogniserImpl.java

@@ -1,105 +0,0 @@
-package org.briarproject.transport;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.concurrent.locks.Lock;
-import java.util.concurrent.locks.ReentrantLock;
-
-import javax.inject.Inject;
-
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.db.DatabaseComponent;
-import org.briarproject.api.db.DbException;
-import org.briarproject.api.transport.StreamContext;
-import org.briarproject.api.transport.TagRecogniser;
-import org.briarproject.api.transport.TemporarySecret;
-
-class TagRecogniserImpl implements TagRecogniser {
-
-	private final CryptoComponent crypto;
-	private final DatabaseComponent db;
-	private final Lock lock = new ReentrantLock();
-
-	// Locking: lock
-	private final Map<TransportId, TransportTagRecogniser> recognisers;
-
-	@Inject
-	TagRecogniserImpl(CryptoComponent crypto, DatabaseComponent db) {
-		this.crypto = crypto;
-		this.db = db;
-		recognisers = new HashMap<TransportId, TransportTagRecogniser>();
-	}
-
-	public StreamContext recogniseTag(TransportId t, byte[] tag)
-			throws DbException {
-		TransportTagRecogniser r;
-		lock.lock();
-		try {
-			r = recognisers.get(t);
-		} finally {
-			lock.unlock();
-		}
-		if (r == null) return null;
-		return r.recogniseTag(tag);
-	}
-
-	public void addSecret(TemporarySecret s) {
-		TransportId t = s.getTransportId();
-		TransportTagRecogniser r;
-		lock.lock();
-		try {
-			r = recognisers.get(t);
-			if (r == null) {
-				r = new TransportTagRecogniser(crypto, db, t);
-				recognisers.put(t, r);
-			}
-		} finally {
-			lock.unlock();
-		}
-		r.addSecret(s);
-	}
-
-	public void removeSecret(ContactId c, TransportId t, long period) {
-		TransportTagRecogniser r;
-		lock.lock();
-		try {
-			r = recognisers.get(t);
-		} finally {
-			lock.unlock();
-		}
-		if (r != null) r.removeSecret(c, period);
-	}
-
-	public void removeSecrets(ContactId c) {
-		lock.lock();
-		try {
-			for (TransportTagRecogniser r : recognisers.values())
-				r.removeSecrets(c);
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	public void removeSecrets(TransportId t) {
-		lock.lock();
-		try {
-			recognisers.remove(t);
-		} finally {
-			lock.unlock();
-		}
-
-	}
-
-	public void removeSecrets() {
-		lock.lock();
-		try {
-			for (TransportTagRecogniser r : recognisers.values())
-				r.removeSecrets();
-		} finally {
-			lock.unlock();
-		}
-
-	}
-}

briar-core/src/org/briarproject/transport/TransportKeyManager.java

@@ -0,0 +1,294 @@
+package org.briarproject.transport;
+
+import org.briarproject.api.Bytes;
+import org.briarproject.api.ContactId;
+import org.briarproject.api.TransportId;
+import org.briarproject.api.crypto.CryptoComponent;
+import org.briarproject.api.db.DatabaseComponent;
+import org.briarproject.api.db.DbException;
+import org.briarproject.api.system.Clock;
+import org.briarproject.api.system.Timer;
+import org.briarproject.api.transport.StreamContext;
+import org.briarproject.api.transport.TransportKeys;
+import org.briarproject.transport.ReorderingWindow.Change;
+
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.TimerTask;
+import java.util.concurrent.Executor;
+import java.util.concurrent.locks.ReentrantLock;
+import java.util.logging.Logger;
+
+import static java.util.logging.Level.WARNING;
+import static org.briarproject.api.transport.TransportConstants.MAX_CLOCK_DIFFERENCE;
+import static org.briarproject.api.transport.TransportConstants.TAG_LENGTH;
+import static org.briarproject.util.ByteUtils.MAX_32_BIT_UNSIGNED;
+
+class TransportKeyManager extends TimerTask {
+
+	private static final Logger LOG =
+			Logger.getLogger(TransportKeyManager.class.getName());
+
+	private final DatabaseComponent db;
+	private final CryptoComponent crypto;
+	private final Executor dbExecutor;
+	private final Timer timer;
+	private final Clock clock;
+	private final TransportId transportId;
+	private final long rotationPeriodLength;
+	private final ReentrantLock lock;
+
+	// The following are locking: lock
+	private final Map<Bytes, TagContext> inContexts;
+	private final Map<ContactId, MutableOutgoingKeys> outContexts;
+	private final Map<ContactId, MutableTransportKeys> keys;
+
+	TransportKeyManager(DatabaseComponent db, CryptoComponent crypto,
+			Executor dbExecutor, Timer timer, Clock clock,
+			TransportId transportId, long maxLatency) {
+		this.db = db;
+		this.crypto = crypto;
+		this.dbExecutor = dbExecutor;
+		this.timer = timer;
+		this.clock = clock;
+		this.transportId = transportId;
+		rotationPeriodLength = maxLatency + MAX_CLOCK_DIFFERENCE;
+		lock = new ReentrantLock();
+		inContexts = new HashMap<Bytes, TagContext>();
+		outContexts = new HashMap<ContactId, MutableOutgoingKeys>();
+		keys = new HashMap<ContactId, MutableTransportKeys>();
+	}
+
+	void start() {
+		// Load the transport keys from the DB
+		Map<ContactId, TransportKeys> loaded;
+		try {
+			loaded = db.getTransportKeys(transportId);
+		} catch (DbException e) {
+			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
+			return;
+		}
+		// Rotate the keys to the current rotation period
+		Map<ContactId, TransportKeys> rotated =
+				new HashMap<ContactId, TransportKeys>();
+		Map<ContactId, TransportKeys> current =
+				new HashMap<ContactId, TransportKeys>();
+		long now = clock.currentTimeMillis();
+		long rotationPeriod = now / rotationPeriodLength;
+		for (Entry<ContactId, TransportKeys> e : loaded.entrySet()) {
+			ContactId c = e.getKey();
+			TransportKeys k = e.getValue();
+			TransportKeys k1 = crypto.rotateTransportKeys(k, rotationPeriod);
+			if (k1.getRotationPeriod() > k.getRotationPeriod())
+				rotated.put(c, k1);
+			current.put(c, k1);
+		}
+		lock.lock();
+		try {
+			// Initialise mutable state for all contacts
+			for (Entry<ContactId, TransportKeys> e : current.entrySet())
+				addKeys(e.getKey(), new MutableTransportKeys(e.getValue()));
+			// Write any rotated keys back to the DB
+			saveTransportKeys(rotated);
+		} finally {
+			lock.unlock();
+		}
+		// Schedule a periodic task to rotate the keys
+		long delay = rotationPeriodLength - now % rotationPeriodLength;
+		timer.scheduleAtFixedRate(this, delay, rotationPeriodLength);
+	}
+
+	// Locking: lock
+	private void addKeys(ContactId c, MutableTransportKeys m) {
+		encodeTags(c, m.getPreviousIncomingKeys());
+		encodeTags(c, m.getCurrentIncomingKeys());
+		encodeTags(c, m.getNextIncomingKeys());
+		outContexts.put(c, m.getCurrentOutgoingKeys());
+		keys.put(c, m);
+	}
+
+	// Locking: lock
+	private void encodeTags(ContactId c, MutableIncomingKeys inKeys) {
+		for (long streamNumber : inKeys.getWindow().getUnseen()) {
+			TagContext tagCtx = new TagContext(c, inKeys, streamNumber);
+			byte[] tag = new byte[TAG_LENGTH];
+			crypto.encodeTag(tag, inKeys.getTagKey(), streamNumber);
+			inContexts.put(new Bytes(tag), tagCtx);
+		}
+	}
+
+	private void saveTransportKeys(final Map<ContactId, TransportKeys> rotated) {
+		dbExecutor.execute(new Runnable() {
+			public void run() {
+				try {
+					db.updateTransportKeys(rotated);
+				} catch (DbException e) {
+					if (LOG.isLoggable(WARNING))
+						LOG.log(WARNING, e.toString(), e);
+				}
+			}
+		});
+	}
+
+	void addContact(ContactId c, TransportKeys k) {
+		lock.lock();
+		try {
+			// Initialise mutable state for the contact
+			addKeys(c, new MutableTransportKeys(k));
+		} finally {
+			lock.unlock();
+		}
+	}
+
+	void removeContact(ContactId c) {
+		lock.lock();
+		try {
+			// Remove mutable state for the contact
+			Iterator<Entry<Bytes, TagContext>> it =
+					inContexts.entrySet().iterator();
+			while (it.hasNext())
+				if (it.next().getValue().contactId.equals(c)) it.remove();
+			outContexts.remove(c);
+			keys.remove(c);
+		} finally {
+			lock.unlock();
+		}
+	}
+
+	StreamContext getStreamContext(ContactId c) {
+		StreamContext ctx;
+		lock.lock();
+		try {
+			// Look up the outgoing keys for the contact
+			MutableOutgoingKeys outKeys = outContexts.get(c);
+			if (outKeys == null) return null;
+			if (outKeys.getStreamCounter() > MAX_32_BIT_UNSIGNED) return null;
+			// Create a stream context
+			ctx = new StreamContext(c, transportId, outKeys.getTagKey(),
+					outKeys.getHeaderKey(), outKeys.getStreamCounter());
+			// Increment the stream counter and write it back to the DB
+			outKeys.incrementStreamCounter();
+			saveIncrementedStreamCounter(c, outKeys.getRotationPeriod());
+		} finally {
+			lock.unlock();
+		}
+		// TODO: Wait for save to complete, return null if it fails
+		return ctx;
+	}
+
+	private void saveIncrementedStreamCounter(final ContactId c,
+			final long rotationPeriod) {
+		dbExecutor.execute(new Runnable() {
+			public void run() {
+				try {
+					db.incrementStreamCounter(c, transportId, rotationPeriod);
+				} catch (DbException e) {
+					if (LOG.isLoggable(WARNING))
+						LOG.log(WARNING, e.toString(), e);
+				}
+			}
+		});
+	}
+
+	StreamContext recogniseTag(byte[] tag) {
+		StreamContext ctx;
+		lock.lock();
+		try {
+			// Look up the incoming keys for the tag
+			TagContext tagCtx = inContexts.remove(new Bytes(tag));
+			if (tagCtx == null) return null;
+			MutableIncomingKeys inKeys = tagCtx.inKeys;
+			// Create a stream context
+			ctx = new StreamContext(tagCtx.contactId, transportId,
+					inKeys.getTagKey(), inKeys.getHeaderKey(),
+					tagCtx.streamNumber);
+			// Update the reordering window
+			ReorderingWindow window = inKeys.getWindow();
+			Change change = window.setSeen(tagCtx.streamNumber);
+			// Add tags for any stream numbers added to the window
+			for (long streamNumber : change.getAdded()) {
+				byte[] addTag = new byte[TAG_LENGTH];
+				crypto.encodeTag(addTag, inKeys.getTagKey(), streamNumber);
+				inContexts.put(new Bytes(addTag), new TagContext(
+						tagCtx.contactId, inKeys, streamNumber));
+			}
+			// Remove tags for any stream numbers removed from the window
+			for (long streamNumber : change.getRemoved()) {
+				byte[] removeTag = new byte[TAG_LENGTH];
+				crypto.encodeTag(removeTag, inKeys.getTagKey(), streamNumber);
+				inContexts.remove(new Bytes(removeTag));
+			}
+			// Write the window back to the DB
+			saveReorderingWindow(tagCtx.contactId, inKeys.getRotationPeriod(),
+					window.getBase(), window.getBitmap());
+		} finally {
+			lock.unlock();
+		}
+		// TODO: Wait for save to complete, return null if it fails
+		return ctx;
+	}
+
+	private void saveReorderingWindow(final ContactId c,
+			final long rotationPeriod, final long base, final byte[] bitmap) {
+		dbExecutor.execute(new Runnable() {
+			public void run() {
+				try {
+					db.setReorderingWindow(c, transportId, rotationPeriod,
+							base, bitmap);
+				} catch (DbException e) {
+					if (LOG.isLoggable(WARNING))
+						LOG.log(WARNING, e.toString(), e);
+				}
+			}
+		});
+	}
+
+	@Override
+	public void run() {
+		lock.lock();
+		try {
+			// Rotate the keys to the current rotation period
+			Map<ContactId, TransportKeys> rotated =
+					new HashMap<ContactId, TransportKeys>();
+			Map<ContactId, TransportKeys> current =
+					new HashMap<ContactId, TransportKeys>();
+			long now = clock.currentTimeMillis();
+			long rotationPeriod = now / rotationPeriodLength;
+			for (Entry<ContactId, MutableTransportKeys> e : keys.entrySet()) {
+				ContactId c = e.getKey();
+				TransportKeys k = e.getValue().snapshot();
+				TransportKeys k1 = crypto.rotateTransportKeys(k,
+						rotationPeriod);
+				if (k1.getRotationPeriod() > k.getRotationPeriod())
+					rotated.put(c, k1);
+				current.put(c, k1);
+			}
+			// Rebuild the mutable state for all contacts
+			inContexts.clear();
+			outContexts.clear();
+			keys.clear();
+			for (Entry<ContactId, TransportKeys> e : current.entrySet())
+				addKeys(e.getKey(), new MutableTransportKeys(e.getValue()));
+			// Write any rotated keys back to the DB
+			saveTransportKeys(rotated);
+		} finally {
+			lock.unlock();
+		}
+	}
+
+	private static class TagContext {
+
+		private final ContactId contactId;
+		private final MutableIncomingKeys inKeys;
+		private final long streamNumber;
+
+		private TagContext(ContactId contactId, MutableIncomingKeys inKeys,
+				long streamNumber) {
+			this.contactId = contactId;
+			this.inKeys = inKeys;
+			this.streamNumber = streamNumber;
+		}
+	}
+}

briar-core/src/org/briarproject/transport/TransportModule.java

@@ -1,23 +1,20 @@
 package org.briarproject.transport;
 
-import javax.inject.Singleton;
-
-import org.briarproject.api.crypto.KeyManager;
-import org.briarproject.api.lifecycle.LifecycleManager;
-import org.briarproject.api.transport.StreamReaderFactory;
-import org.briarproject.api.transport.StreamWriterFactory;
-import org.briarproject.api.transport.TagRecogniser;
-
 import com.google.inject.AbstractModule;
 import com.google.inject.Provides;
 
+import org.briarproject.api.lifecycle.LifecycleManager;
+import org.briarproject.api.transport.KeyManager;
+import org.briarproject.api.transport.StreamReaderFactory;
+import org.briarproject.api.transport.StreamWriterFactory;
+
+import javax.inject.Singleton;
+
 public class TransportModule extends AbstractModule {
 
 	@Override
 	protected void configure() {
 		bind(StreamReaderFactory.class).to(StreamReaderFactoryImpl.class);
-		bind(TagRecogniser.class).to(
-				TagRecogniserImpl.class).in(Singleton.class);
 		bind(StreamWriterFactory.class).to(StreamWriterFactoryImpl.class);
 	}
 

briar-core/src/org/briarproject/transport/TransportTagRecogniser.java

@@ -1,215 +0,0 @@
-package org.briarproject.transport;
-
-import static org.briarproject.api.transport.TransportConstants.TAG_LENGTH;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.concurrent.locks.Lock;
-import java.util.concurrent.locks.ReentrantLock;
-
-import org.briarproject.api.Bytes;
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.SecretKey;
-import org.briarproject.api.db.DatabaseComponent;
-import org.briarproject.api.db.DbException;
-import org.briarproject.api.transport.StreamContext;
-import org.briarproject.api.transport.TemporarySecret;
-
-// FIXME: Don't make alien calls with a lock held
-/**
- * A {@link org.briarproject.api.transport.TagRecogniser TagRecogniser} for a
- * specific transport.
- */
-class TransportTagRecogniser {
-
-	private final CryptoComponent crypto;
-	private final DatabaseComponent db;
-	private final TransportId transportId;
-	private final Lock lock = new ReentrantLock();
-
-	// The following are locking: lock
-	private final Map<Bytes, TagContext> tagMap;
-	private final Map<RemovalKey, RemovalContext> removalMap;
-
-	TransportTagRecogniser(CryptoComponent crypto, DatabaseComponent db,
-			TransportId transportId) {
-		this.crypto = crypto;
-		this.db = db;
-		this.transportId = transportId;
-		tagMap = new HashMap<Bytes, TagContext>();
-		removalMap = new HashMap<RemovalKey, RemovalContext>();
-	}
-
-	StreamContext recogniseTag(byte[] tag) throws DbException {
-		lock.lock();
-		try {
-			TagContext t = tagMap.remove(new Bytes(tag));
-			if (t == null) return null; // The tag was not expected
-			// Update the reordering window and the expected tags
-			SecretKey key = crypto.deriveTagKey(t.secret, !t.alice);
-			for (long streamNumber : t.window.setSeen(t.streamNumber)) {
-				byte[] tag1 = new byte[TAG_LENGTH];
-				crypto.encodeTag(tag1, key, streamNumber);
-				if (streamNumber < t.streamNumber) {
-					TagContext removed = tagMap.remove(new Bytes(tag1));
-					assert removed != null;
-				} else {
-					TagContext added = new TagContext(t, streamNumber);
-					TagContext duplicate = tagMap.put(new Bytes(tag1), added);
-					assert duplicate == null;
-				}
-			}
-			// Store the updated reordering window in the DB
-			db.setReorderingWindow(t.contactId, transportId, t.period,
-					t.window.getCentre(), t.window.getBitmap());
-			return new StreamContext(t.contactId, transportId, t.secret,
-					t.streamNumber, t.alice);
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	void addSecret(TemporarySecret s) {
-		lock.lock();
-		try {
-			ContactId contactId = s.getContactId();
-			boolean alice = s.getAlice();
-			long period = s.getPeriod();
-			byte[] secret = s.getSecret();
-			long centre = s.getWindowCentre();
-			byte[] bitmap = s.getWindowBitmap();
-			// Create the reordering window and the expected tags
-			SecretKey key = crypto.deriveTagKey(secret, !alice);
-			ReorderingWindow window = new ReorderingWindow(centre, bitmap);
-			for (long streamNumber : window.getUnseen()) {
-				byte[] tag = new byte[TAG_LENGTH];
-				crypto.encodeTag(tag, key, streamNumber);
-				TagContext added = new TagContext(contactId, alice, period,
-						secret, window, streamNumber);
-				TagContext duplicate = tagMap.put(new Bytes(tag), added);
-				assert duplicate == null;
-			}
-			// Create a removal context to remove the window and the tags later
-			RemovalContext r = new RemovalContext(window, secret, alice);
-			removalMap.put(new RemovalKey(contactId, period), r);
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	void removeSecret(ContactId contactId, long period) {
-		lock.lock();
-		try {
-			RemovalKey k = new RemovalKey(contactId, period);
-			RemovalContext removed = removalMap.remove(k);
-			if (removed == null) throw new IllegalArgumentException();
-			removeSecret(removed);
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	// Locking: lock
-	private void removeSecret(RemovalContext r) {
-		// Remove the expected tags
-		SecretKey key = crypto.deriveTagKey(r.secret, !r.alice);
-		byte[] tag = new byte[TAG_LENGTH];
-		for (long streamNumber : r.window.getUnseen()) {
-			crypto.encodeTag(tag, key, streamNumber);
-			TagContext removed = tagMap.remove(new Bytes(tag));
-			assert removed != null;
-		}
-	}
-
-	void removeSecrets(ContactId c) {
-		lock.lock();
-		try {
-			Collection<RemovalKey> keysToRemove = new ArrayList<RemovalKey>();
-			for (RemovalKey k : removalMap.keySet())
-				if (k.contactId.equals(c)) keysToRemove.add(k);
-			for (RemovalKey k : keysToRemove)
-				removeSecret(k.contactId, k.period);
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	void removeSecrets() {
-		lock.lock();
-		try {
-			for (RemovalContext r : removalMap.values()) removeSecret(r);
-			assert tagMap.isEmpty();
-			removalMap.clear();
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	private static class TagContext {
-
-		private final ContactId contactId;
-		private final boolean alice;
-		private final long period;
-		private final byte[] secret;
-		private final ReorderingWindow window;
-		private final long streamNumber;
-
-		private TagContext(ContactId contactId, boolean alice, long period,
-				byte[] secret, ReorderingWindow window, long streamNumber) {
-			this.contactId = contactId;
-			this.alice = alice;
-			this.period = period;
-			this.secret = secret;
-			this.window = window;
-			this.streamNumber = streamNumber;
-		}
-
-		private TagContext(TagContext t, long streamNumber) {
-			this(t.contactId, t.alice, t.period, t.secret, t.window,
-					streamNumber);
-		}
-	}
-
-	private static class RemovalKey {
-
-		private final ContactId contactId;
-		private final long period;
-
-		private RemovalKey(ContactId contactId, long period) {
-			this.contactId = contactId;
-			this.period = period;
-		}
-
-		@Override
-		public int hashCode() {
-			return contactId.hashCode() ^ (int) (period ^ (period >>> 32));
-		}
-
-		@Override
-		public boolean equals(Object o) {
-			if (o instanceof RemovalKey) {
-				RemovalKey k = (RemovalKey) o;
-				return contactId.equals(k.contactId) && period == k.period;
-			}
-			return false;
-		}
-	}
-
-	private static class RemovalContext {
-
-		private final ReorderingWindow window;
-		private final byte[] secret;
-		private final boolean alice;
-
-		private RemovalContext(ReorderingWindow window, byte[] secret,
-				boolean alice) {
-			this.window = window;
-			this.secret = secret;
-			this.alice = alice;
-		}
-	}
-}

briar-desktop/src/org/briarproject/plugins/DesktopPluginsModule.java

@@ -1,6 +1,10 @@
 package org.briarproject.plugins;
 
 import com.google.inject.Provides;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.concurrent.Executor;
 
 import org.briarproject.api.crypto.CryptoComponent;
 import org.briarproject.api.lifecycle.IoExecutor;

briar-tests/src/org/briarproject/ProtocolIntegrationTest.java

@@ -10,6 +10,7 @@ import org.briarproject.api.TransportId;
 import org.briarproject.api.TransportProperties;
 import org.briarproject.api.crypto.CryptoComponent;
 import org.briarproject.api.crypto.KeyPair;
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.messaging.Ack;
 import org.briarproject.api.messaging.Group;
 import org.briarproject.api.messaging.GroupFactory;
@@ -44,7 +45,6 @@ import java.io.OutputStream;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
-import java.util.Random;
 
 import static org.briarproject.api.transport.TransportConstants.TAG_LENGTH;
 import static org.junit.Assert.assertArrayEquals;
@@ -61,14 +61,9 @@ public class ProtocolIntegrationTest extends BriarTestCase {
 	private final MessageVerifier messageVerifier;
 
 	private final ContactId contactId;
-	private final byte[] secret;
+	private final SecretKey tagKey, headerKey;
-	private final Author author;
 	private final Group group;
 	private final Message message, message1;
-	private final String authorName = "Alice";
-	private final String contentType = "text/plain";
-	private final long timestamp = System.currentTimeMillis();
-	private final String messageBody = "Hello world";
 	private final Collection<MessageId> messageIds;
 	private final TransportId transportId;
 	private final TransportProperties transportProperties;
@@ -85,9 +80,9 @@ public class ProtocolIntegrationTest extends BriarTestCase {
 		packetWriterFactory = i.getInstance(PacketWriterFactory.class);
 		messageVerifier = i.getInstance(MessageVerifier.class);
 		contactId = new ContactId(234);
-		// Create a shared secret
+		// Create the transport keys
-		secret = new byte[32];
+		tagKey = TestUtils.createSecretKey();
-		new Random().nextBytes(secret);
+		headerKey = TestUtils.createSecretKey();
 		// Create a group
 		GroupFactory groupFactory = i.getInstance(GroupFactory.class);
 		group = groupFactory.createGroup("Group");
@@ -95,12 +90,15 @@ public class ProtocolIntegrationTest extends BriarTestCase {
 		AuthorFactory authorFactory = i.getInstance(AuthorFactory.class);
 		CryptoComponent crypto = i.getInstance(CryptoComponent.class);
 		KeyPair authorKeyPair = crypto.generateSignatureKeyPair();
-		author = authorFactory.createAuthor(authorName,
+		Author author = authorFactory.createAuthor("Alice",
 				authorKeyPair.getPublic().getEncoded());
 		// Create two messages to the group: one anonymous, one pseudonymous
 		MessageFactory messageFactory = i.getInstance(MessageFactory.class);
+		String contentType = "text/plain";
+		long timestamp = System.currentTimeMillis();
+		String messageBody = "Hello world";
 		message = messageFactory.createAnonymousMessage(null, group,
-				contentType, timestamp, messageBody.getBytes("UTF-8"));
+				"text/plain", timestamp, messageBody.getBytes("UTF-8"));
 		message1 = messageFactory.createPseudonymousMessage(null, group,
 				author, authorKeyPair.getPrivate(), contentType, timestamp,
 				messageBody.getBytes("UTF-8"));
@@ -118,8 +116,8 @@ public class ProtocolIntegrationTest extends BriarTestCase {
 
 	private byte[] write() throws Exception {
 		ByteArrayOutputStream out = new ByteArrayOutputStream();
-		StreamContext ctx = new StreamContext(contactId, transportId, secret,
+		StreamContext ctx = new StreamContext(contactId, transportId, tagKey,
-				0, true);
+				headerKey, 0);
 		OutputStream streamWriter =
 				streamWriterFactory.createStreamWriter(out, ctx);
 		PacketWriter packetWriter = packetWriterFactory.createPacketWriter(
@@ -134,7 +132,8 @@ public class ProtocolIntegrationTest extends BriarTestCase {
 
 		packetWriter.writeRequest(new Request(messageIds));
 
-		SubscriptionUpdate su = new SubscriptionUpdate(Arrays.asList(group), 1);
+		SubscriptionUpdate su = new SubscriptionUpdate(
+				Collections.singletonList(group), 1);
 		packetWriter.writeSubscriptionUpdate(su);
 
 		TransportUpdate tu = new TransportUpdate(transportId,
@@ -150,8 +149,8 @@ public class ProtocolIntegrationTest extends BriarTestCase {
 		byte[] tag = new byte[TAG_LENGTH];
 		assertEquals(TAG_LENGTH, in.read(tag, 0, TAG_LENGTH));
 		// FIXME: Check that the expected tag was received
-		StreamContext ctx = new StreamContext(contactId, transportId, secret,
+		StreamContext ctx = new StreamContext(contactId, transportId, tagKey,
-				0, false);
+				headerKey, 0);
 		InputStream streamReader =
 				streamReaderFactory.createStreamReader(in, ctx);
 		PacketReader packetReader = packetReaderFactory.createPacketReader(
@@ -184,7 +183,7 @@ public class ProtocolIntegrationTest extends BriarTestCase {
 		// Read the subscription update
 		assertTrue(packetReader.hasSubscriptionUpdate());
 		SubscriptionUpdate su = packetReader.readSubscriptionUpdate();
-		assertEquals(Arrays.asList(group), su.getGroups());
+		assertEquals(Collections.singletonList(group), su.getGroups());
 		assertEquals(1, su.getVersion());
 
 		// Read the transport update

briar-tests/src/org/briarproject/TestUtils.java

@@ -7,6 +7,9 @@ import java.io.File;
 import java.util.Random;
 import java.util.concurrent.atomic.AtomicInteger;
 
+import org.briarproject.api.UniqueId;
+import org.briarproject.api.crypto.SecretKey;
+
 public class TestUtils {
 
 	private static final AtomicInteger nextTestDir =
@@ -35,4 +38,10 @@ public class TestUtils {
 			c[i] = (char) ('a' + random.nextInt(26));
 		return new String(c);
 	}
+
+	public static SecretKey createSecretKey() {
+		byte[] b = new byte[SecretKey.LENGTH];
+		random.nextBytes(b);
+		return new SecretKey(b);
+	}
 }

briar-tests/src/org/briarproject/crypto/KeyAgreementTest.java

@@ -4,6 +4,7 @@ import org.briarproject.BriarTestCase;
 import org.briarproject.TestSeedProvider;
 import org.briarproject.api.crypto.CryptoComponent;
 import org.briarproject.api.crypto.KeyPair;
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.system.SeedProvider;
 import org.junit.Test;
 
@@ -19,8 +20,8 @@ public class KeyAgreementTest extends BriarTestCase {
 		byte[] aPub = aPair.getPublic().getEncoded();
 		KeyPair bPair = crypto.generateAgreementKeyPair();
 		byte[] bPub = bPair.getPublic().getEncoded();
-		byte[] aSecret = crypto.deriveMasterSecret(aPub, bPair, true);
+		SecretKey aMaster = crypto.deriveMasterSecret(aPub, bPair, true);
-		byte[] bSecret = crypto.deriveMasterSecret(bPub, aPair, false);
+		SecretKey bMaster = crypto.deriveMasterSecret(bPub, aPair, false);
-		assertArrayEquals(aSecret, bSecret);
+		assertArrayEquals(aMaster.getBytes(), bMaster.getBytes());
 	}
 }

briar-tests/src/org/briarproject/crypto/KeyDerivationTest.java

@@ -2,72 +2,164 @@ package org.briarproject.crypto;
 
 import org.briarproject.BriarTestCase;
 import org.briarproject.TestSeedProvider;
+import org.briarproject.TestUtils;
+import org.briarproject.api.TransportId;
 import org.briarproject.api.crypto.CryptoComponent;
 import org.briarproject.api.crypto.SecretKey;
+import org.briarproject.api.transport.TransportKeys;
 import org.junit.Test;
 
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
-import java.util.Random;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertFalse;
 
 public class KeyDerivationTest extends BriarTestCase {
 
+	private final TransportId transportId = new TransportId("id");
 	private final CryptoComponent crypto;
-	private final byte[] secret;
+	private final SecretKey master;
 
 	public KeyDerivationTest() {
 		crypto = new CryptoComponentImpl(new TestSeedProvider());
-		secret = new byte[32];
+		master = TestUtils.createSecretKey();
-		new Random().nextBytes(secret);
 	}
 
 	@Test
 	public void testKeysAreDistinct() {
-		List<SecretKey> keys = new ArrayList<SecretKey>();
+		TransportKeys k = crypto.deriveTransportKeys(transportId, master,
-		keys.add(crypto.deriveFrameKey(secret, 0, true));
+				123, true);
-		keys.add(crypto.deriveFrameKey(secret, 0, false));
+		assertAllDifferent(k);
-		keys.add(crypto.deriveTagKey(secret, true));
-		keys.add(crypto.deriveTagKey(secret, false));
-		for (int i = 0; i < 4; i++) {
-			byte[] keyI = keys.get(i).getBytes();
-			for (int j = 0; j < 4; j++) {
-				byte[] keyJ = keys.get(j).getBytes();
-				assertEquals(i == j, Arrays.equals(keyI, keyJ));
-			}
-		}
 	}
 
 	@Test
-	public void testSecretAffectsDerivation() {
+	public void testCurrentKeysMatchCurrentKeysOfContact() {
-		Random r = new Random();
+		// Start in rotation period 123
-		List<byte[]> secrets = new ArrayList<byte[]>();
+		TransportKeys kA = crypto.deriveTransportKeys(transportId, master,
-		for (int i = 0; i < 20; i++) {
+				123, true);
-			byte[] b = new byte[32];
+		TransportKeys kB = crypto.deriveTransportKeys(transportId, master,
-			r.nextBytes(b);
+				123, false);
-			secrets.add(crypto.deriveNextSecret(b, 0));
+		// Alice's incoming keys should equal Bob's outgoing keys
-		}
+		assertArrayEquals(kA.getCurrentIncomingKeys().getTagKey().getBytes(),
-		for (int i = 0; i < 20; i++) {
+				kB.getCurrentOutgoingKeys().getTagKey().getBytes());
-			byte[] secretI = secrets.get(i);
+		assertArrayEquals(kA.getCurrentIncomingKeys().getHeaderKey().getBytes(),
-			for (int j = 0; j < 20; j++) {
+				kB.getCurrentOutgoingKeys().getHeaderKey().getBytes());
-				byte[] secretJ = secrets.get(j);
+		// Alice's outgoing keys should equal Bob's incoming keys
-				assertEquals(i == j, Arrays.equals(secretI, secretJ));
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getTagKey().getBytes(),
-			}
+				kB.getCurrentIncomingKeys().getTagKey().getBytes());
-		}
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getHeaderKey().getBytes(),
+				kB.getCurrentIncomingKeys().getHeaderKey().getBytes());
+		// Rotate into the future
+		kA = crypto.rotateTransportKeys(kA, 456);
+		kB = crypto.rotateTransportKeys(kB, 456);
+		// Alice's incoming keys should equal Bob's outgoing keys
+		assertArrayEquals(kA.getCurrentIncomingKeys().getTagKey().getBytes(),
+				kB.getCurrentOutgoingKeys().getTagKey().getBytes());
+		assertArrayEquals(kA.getCurrentIncomingKeys().getHeaderKey().getBytes(),
+				kB.getCurrentOutgoingKeys().getHeaderKey().getBytes());
+		// Alice's outgoing keys should equal Bob's incoming keys
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getTagKey().getBytes(),
+				kB.getCurrentIncomingKeys().getTagKey().getBytes());
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getHeaderKey().getBytes(),
+				kB.getCurrentIncomingKeys().getHeaderKey().getBytes());
 	}
 
 	@Test
-	public void testStreamNumberAffectsDerivation() {
+	public void testPreviousKeysMatchPreviousKeysOfContact() {
-		List<byte[]> secrets = new ArrayList<byte[]>();
+		// Start in rotation period 123
-		for (int i = 0; i < 20; i++)
+		TransportKeys kA = crypto.deriveTransportKeys(transportId, master,
-			secrets.add(crypto.deriveNextSecret(secret, i));
+				123, true);
-		for (int i = 0; i < 20; i++) {
+		TransportKeys kB = crypto.deriveTransportKeys(transportId, master,
-			byte[] secretI = secrets.get(i);
+				123, false);
-			for (int j = 0; j < 20; j++) {
+		// Compare Alice's previous keys in period 456 with Bob's current keys
-				byte[] secretJ = secrets.get(j);
+		// in period 455
-				assertEquals(i == j, Arrays.equals(secretI, secretJ));
+		kA = crypto.rotateTransportKeys(kA, 456);
+		kB = crypto.rotateTransportKeys(kB, 455);
+		// Alice's previous incoming keys should equal Bob's outgoing keys
+		assertArrayEquals(kA.getPreviousIncomingKeys().getTagKey().getBytes(),
+				kB.getCurrentOutgoingKeys().getTagKey().getBytes());
+		assertArrayEquals(kA.getPreviousIncomingKeys().getHeaderKey().getBytes(),
+				kB.getCurrentOutgoingKeys().getHeaderKey().getBytes());
+		// Compare Alice's current keys in period 456 with Bob's previous keys
+		// in period 457
+		kB = crypto.rotateTransportKeys(kB, 457);
+		// Alice's outgoing keys should equal Bob's previous incoming keys
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getTagKey().getBytes(),
+				kB.getPreviousIncomingKeys().getTagKey().getBytes());
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getHeaderKey().getBytes(),
+				kB.getPreviousIncomingKeys().getHeaderKey().getBytes());
+	}
+
+	@Test
+	public void testNextKeysMatchNextKeysOfContact() {
+		// Start in rotation period 123
+		TransportKeys kA = crypto.deriveTransportKeys(transportId, master,
+				123, true);
+		TransportKeys kB = crypto.deriveTransportKeys(transportId, master,
+				123, false);
+		// Compare Alice's current keys in period 456 with Bob's next keys in
+		// period 455
+		kA = crypto.rotateTransportKeys(kA, 456);
+		kB = crypto.rotateTransportKeys(kB, 455);
+		// Alice's outgoing keys should equal Bob's next incoming keys
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getTagKey().getBytes(),
+				kB.getNextIncomingKeys().getTagKey().getBytes());
+		assertArrayEquals(kA.getCurrentOutgoingKeys().getHeaderKey().getBytes(),
+				kB.getNextIncomingKeys().getHeaderKey().getBytes());
+		// Compare Alice's next keys in period 456 with Bob's current keys
+		// in period 457
+		kB = crypto.rotateTransportKeys(kB, 457);
+		// Alice's next incoming keys should equal Bob's outgoing keys
+		assertArrayEquals(kA.getNextIncomingKeys().getTagKey().getBytes(),
+				kB.getCurrentOutgoingKeys().getTagKey().getBytes());
+		assertArrayEquals(kA.getNextIncomingKeys().getHeaderKey().getBytes(),
+				kB.getCurrentOutgoingKeys().getHeaderKey().getBytes());
+	}
+
+	@Test
+	public void testMasterKeyAffectsOutput() {
+		SecretKey master1 = TestUtils.createSecretKey();
+		assertFalse(Arrays.equals(master.getBytes(), master1.getBytes()));
+		TransportKeys k = crypto.deriveTransportKeys(transportId, master,
+				123, true);
+		TransportKeys k1 = crypto.deriveTransportKeys(transportId, master1,
+				123, true);
+		assertAllDifferent(k, k1);
+	}
+
+	@Test
+	public void testTransportIdAffectsOutput() {
+		TransportId transportId1 = new TransportId("id1");
+		assertFalse(transportId.getString().equals(transportId1.getString()));
+		TransportKeys k = crypto.deriveTransportKeys(transportId, master,
+				123, true);
+		TransportKeys k1 = crypto.deriveTransportKeys(transportId1, master,
+				123, true);
+		assertAllDifferent(k, k1);
+	}
+
+	private void assertAllDifferent(TransportKeys... transportKeys) {
+		List<SecretKey> secretKeys = new ArrayList<SecretKey>();
+		for (TransportKeys k : transportKeys) {
+			secretKeys.add(k.getPreviousIncomingKeys().getTagKey());
+			secretKeys.add(k.getPreviousIncomingKeys().getHeaderKey());
+			secretKeys.add(k.getCurrentIncomingKeys().getTagKey());
+			secretKeys.add(k.getCurrentIncomingKeys().getHeaderKey());
+			secretKeys.add(k.getNextIncomingKeys().getTagKey());
+			secretKeys.add(k.getNextIncomingKeys().getHeaderKey());
+			secretKeys.add(k.getCurrentOutgoingKeys().getTagKey());
+			secretKeys.add(k.getCurrentOutgoingKeys().getHeaderKey());
+		}
+		assertAllDifferent(secretKeys);
+	}
+
+	private void assertAllDifferent(List<SecretKey> keys) {
+		for (SecretKey ki : keys) {
+			for (SecretKey kj : keys) {
+				if (ki == kj) assertArrayEquals(ki.getBytes(), kj.getBytes());
+				else assertFalse(Arrays.equals(ki.getBytes(), kj.getBytes()));
 			}
 		}
 	}

briar-tests/src/org/briarproject/db/DatabaseComponentTest.java

@@ -11,6 +11,7 @@ import org.briarproject.api.LocalAuthor;
 import org.briarproject.api.TransportConfig;
 import org.briarproject.api.TransportId;
 import org.briarproject.api.TransportProperties;
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.db.DatabaseComponent;
 import org.briarproject.api.db.NoSuchContactException;
 import org.briarproject.api.db.NoSuchLocalAuthorException;
@@ -45,8 +46,9 @@ import org.briarproject.api.messaging.SubscriptionAck;
 import org.briarproject.api.messaging.SubscriptionUpdate;
 import org.briarproject.api.messaging.TransportAck;
 import org.briarproject.api.messaging.TransportUpdate;
-import org.briarproject.api.transport.Endpoint;
+import org.briarproject.api.transport.IncomingKeys;
-import org.briarproject.api.transport.TemporarySecret;
+import org.briarproject.api.transport.OutgoingKeys;
+import org.briarproject.api.transport.TransportKeys;
 import org.jmock.Expectations;
 import org.jmock.Mockery;
 import org.junit.Test;
@@ -84,8 +86,6 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 	protected final int maxLatency;
 	protected final ContactId contactId;
 	protected final Contact contact;
-	protected final Endpoint endpoint;
-	protected final TemporarySecret temporarySecret;
 
 	public DatabaseComponentTest() {
 		groupId = new GroupId(TestUtils.getRandomId());
@@ -112,9 +112,6 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		maxLatency = Integer.MAX_VALUE;
 		contactId = new ContactId(234);
 		contact = new Contact(contactId, author, localAuthorId);
-		endpoint = new Endpoint(contactId, transportId, 123, true);
-		temporarySecret = new TemporarySecret(contactId, transportId, 123,
-				false, 234, new byte[32], 345, 456, new byte[4]);
 	}
 
 	protected abstract <T> DatabaseComponent createDatabaseComponent(
@@ -157,7 +154,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			oneOf(eventBus).broadcast(with(any(ContactAddedEvent.class)));
 			// getContacts()
 			oneOf(database).getContacts(txn);
-			will(returnValue(Arrays.asList(contact)));
+			will(returnValue(Collections.singletonList(contact)));
 			// getRemoteProperties()
 			oneOf(database).getRemoteProperties(txn, transportId);
 			will(returnValue(Collections.emptyMap()));
@@ -177,7 +174,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			will(returnValue(Collections.emptyList()));
 			// getGroups()
 			oneOf(database).getGroups(txn);
-			will(returnValue(Arrays.asList(groupId)));
+			will(returnValue(Collections.singletonList(group)));
 			// removeGroup()
 			oneOf(database).containsGroup(txn, groupId);
 			will(returnValue(true));
@@ -213,13 +210,13 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		assertFalse(db.open());
 		db.addLocalAuthor(localAuthor);
 		assertEquals(contactId, db.addContact(author, localAuthorId));
-		assertEquals(Arrays.asList(contact), db.getContacts());
+		assertEquals(Collections.singletonList(contact), db.getContacts());
 		assertEquals(Collections.emptyMap(),
 				db.getRemoteProperties(transportId));
 		db.addGroup(group); // First time - listeners called
 		db.addGroup(group); // Second time - not called
 		assertEquals(Collections.emptyList(), db.getMessageHeaders(groupId));
-		assertEquals(Arrays.asList(groupId), db.getGroups());
+		assertEquals(Collections.singletonList(group), db.getGroups());
 		db.removeGroup(group);
 		db.removeContact(contactId);
 		db.removeLocalAuthor(localAuthorId);
@@ -297,9 +294,9 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			oneOf(database).addMessage(txn, message, true);
 			oneOf(database).setReadFlag(txn, messageId, true);
 			oneOf(database).getVisibility(txn, groupId);
-			will(returnValue(Arrays.asList(contactId)));
+			will(returnValue(Collections.singletonList(contactId)));
 			oneOf(database).getContactIds(txn);
-			will(returnValue(Arrays.asList(contactId)));
+			will(returnValue(Collections.singletonList(contactId)));
 			oneOf(database).removeOfferedMessage(txn, contactId, messageId);
 			will(returnValue(false));
 			oneOf(database).addStatus(txn, contactId, messageId, false, false);
@@ -336,7 +333,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 				eventBus, shutdown);
 
 		try {
-			db.addEndpoint(endpoint);
+			db.addTransportKeys(contactId, createTransportKeys());
 			fail();
 		} catch (NoSuchContactException expected) {}
 
@@ -401,7 +398,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		} catch (NoSuchContactException expected) {}
 
 		try {
-			Ack a = new Ack(Arrays.asList(messageId));
+			Ack a = new Ack(Collections.singletonList(messageId));
 			db.receiveAck(contactId, a);
 			fail();
 		} catch (NoSuchContactException expected) {}
@@ -412,7 +409,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		} catch (NoSuchContactException expected) {}
 
 		try {
-			Offer o = new Offer(Arrays.asList(messageId));
+			Offer o = new Offer(Collections.singletonList(messageId));
 			db.receiveOffer(contactId, o);
 			fail();
 		} catch (NoSuchContactException expected) {}
@@ -594,7 +591,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			// Check whether the transport is in the DB (which it's not)
 			exactly(8).of(database).startTransaction();
 			will(returnValue(txn));
-			exactly(3).of(database).containsContact(txn, contactId);
+			exactly(2).of(database).containsContact(txn, contactId);
 			will(returnValue(true));
 			exactly(8).of(database).containsTransport(txn, transportId);
 			will(returnValue(false));
@@ -606,11 +603,6 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		db.addLocalAuthor(localAuthor);
 		assertEquals(contactId, db.addContact(author, localAuthorId));
 
-		try {
-			db.addEndpoint(endpoint);
-			fail();
-		} catch (NoSuchTransportException expected) {}
-
 		try {
 			db.getConfig(transportId);
 			fail();
@@ -621,6 +613,11 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			fail();
 		} catch (NoSuchTransportException expected) {}
 
+		try {
+			db.getTransportKeys(transportId);
+			fail();
+		} catch (NoSuchTransportException expected) {}
+
 		try {
 			db.mergeConfig(transportId, new TransportConfig());
 			fail();
@@ -909,7 +906,8 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			oneOf(database).containsContact(txn, contactId);
 			will(returnValue(true));
 			oneOf(database).getSubscriptionUpdate(txn, contactId, maxLatency);
-			will(returnValue(new SubscriptionUpdate(Arrays.asList(group), 1)));
+			will(returnValue(new SubscriptionUpdate(
+					Collections.singletonList(group), 1)));
 			oneOf(database).commitTransaction(txn);
 		}});
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
@@ -917,7 +915,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 
 		SubscriptionUpdate u = db.generateSubscriptionUpdate(contactId,
 				maxLatency);
-		assertEquals(Arrays.asList(group), u.getGroups());
+		assertEquals(Collections.singletonList(group), u.getGroups());
 		assertEquals(1, u.getVersion());
 
 		context.assertIsSatisfied();
@@ -962,8 +960,8 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			oneOf(database).containsContact(txn, contactId);
 			will(returnValue(true));
 			oneOf(database).getTransportUpdates(txn, contactId, maxLatency);
-			will(returnValue(Arrays.asList(new TransportUpdate(transportId,
+			will(returnValue(Collections.singletonList(new TransportUpdate(
-					transportProperties, 1))));
+					transportId, transportProperties, 1))));
 			oneOf(database).commitTransaction(txn);
 		}});
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
@@ -1003,7 +1001,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
 				eventBus, shutdown);
 
-		db.receiveAck(contactId, new Ack(Arrays.asList(messageId)));
+		db.receiveAck(contactId, new Ack(Collections.singletonList(messageId)));
 
 		context.assertIsSatisfied();
 	}
@@ -1027,9 +1025,9 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			will(returnValue(true));
 			oneOf(database).addMessage(txn, message, false);
 			oneOf(database).getVisibility(txn, groupId);
-			will(returnValue(Arrays.asList(contactId)));
+			will(returnValue(Collections.singletonList(contactId)));
 			oneOf(database).getContactIds(txn);
-			will(returnValue(Arrays.asList(contactId)));
+			will(returnValue(Collections.singletonList(contactId)));
 			oneOf(database).removeOfferedMessage(txn, contactId, messageId);
 			will(returnValue(false));
 			oneOf(database).addStatus(txn, contactId, messageId, false, true);
@@ -1176,7 +1174,8 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
 				eventBus, shutdown);
 
-		db.receiveRequest(contactId, new Request(Arrays.asList(messageId)));
+		db.receiveRequest(contactId, new Request(Collections.singletonList(
+				messageId)));
 
 		context.assertIsSatisfied();
 	}
@@ -1244,13 +1243,15 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			will(returnValue(txn));
 			oneOf(database).containsContact(txn, contactId);
 			will(returnValue(true));
-			oneOf(database).setGroups(txn, contactId, Arrays.asList(group), 1);
+			oneOf(database).setGroups(txn, contactId,
+					Collections.singletonList(group), 1);
 			oneOf(database).commitTransaction(txn);
 		}});
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
 				eventBus, shutdown);
 
-		SubscriptionUpdate u = new SubscriptionUpdate(Arrays.asList(group), 1);
+		SubscriptionUpdate u = new SubscriptionUpdate(
+				Collections.singletonList(group), 1);
 		db.receiveSubscriptionUpdate(contactId, u);
 
 		context.assertIsSatisfied();
@@ -1398,7 +1399,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
 				eventBus, shutdown);
 
-		db.setVisibility(groupId, Arrays.asList(contactId));
+		db.setVisibility(groupId, Collections.singletonList(contactId));
 
 		context.assertIsSatisfied();
 	}
@@ -1467,7 +1468,7 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 			will(returnValue(true));
 			oneOf(database).setVisibleToAll(txn, groupId, true);
 			oneOf(database).getVisibility(txn, groupId);
-			will(returnValue(Arrays.asList(contactId)));
+			will(returnValue(Collections.singletonList(contactId)));
 			oneOf(database).getContactIds(txn);
 			will(returnValue(both));
 			oneOf(database).addVisibility(txn, contactId1, groupId);
@@ -1478,14 +1479,15 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
 				eventBus, shutdown);
 
-		db.setVisibility(groupId, Arrays.asList(contactId));
+		db.setVisibility(groupId, Collections.singletonList(contactId));
 		db.setVisibleToAll(groupId, true);
 
 		context.assertIsSatisfied();
 	}
 
 	@Test
-	public void testTemporarySecrets() throws Exception {
+	public void testTransportKeys() throws Exception {
+		final TransportKeys keys = createTransportKeys();
 		Mockery context = new Mockery();
 		@SuppressWarnings("unchecked")
 		final Database<Object> database = context.mock(Database.class);
@@ -1493,28 +1495,52 @@ public abstract class DatabaseComponentTest extends BriarTestCase {
 		final ShutdownManager shutdown = context.mock(ShutdownManager.class);
 		final EventBus eventBus = context.mock(EventBus.class);
 		context.checking(new Expectations() {{
-			// addSecrets()
+			// updateTransportKeys()
 			oneOf(database).startTransaction();
 			will(returnValue(txn));
 			oneOf(database).containsContact(txn, contactId);
 			will(returnValue(true));
 			oneOf(database).containsTransport(txn, transportId);
 			will(returnValue(true));
-			oneOf(database).addSecrets(txn, Arrays.asList(temporarySecret));
+			oneOf(database).updateTransportKeys(txn,
+					Collections.singletonMap(contactId, keys));
 			oneOf(database).commitTransaction(txn);
-			// getSecrets()
+			// getTransportKeys()
 			oneOf(database).startTransaction();
 			will(returnValue(txn));
-			oneOf(database).getSecrets(txn);
+			oneOf(database).containsTransport(txn, transportId);
-			will(returnValue(Arrays.asList(temporarySecret)));
+			will(returnValue(true));
+			oneOf(database).getTransportKeys(txn, transportId);
+			will(returnValue(Collections.singletonMap(contactId, keys)));
 			oneOf(database).commitTransaction(txn);
 		}});
 		DatabaseComponent db = createDatabaseComponent(database, cleaner,
 				eventBus, shutdown);
 
-		db.addSecrets(Arrays.asList(temporarySecret));
+		db.updateTransportKeys(Collections.singletonMap(contactId, keys));
-		assertEquals(Arrays.asList(temporarySecret), db.getSecrets());
+		assertEquals(Collections.singletonMap(contactId, keys),
+				db.getTransportKeys(transportId));
 
 		context.assertIsSatisfied();
 	}
+
+	private TransportKeys createTransportKeys() {
+		SecretKey inPrevTagKey = TestUtils.createSecretKey();
+		SecretKey inPrevHeaderKey = TestUtils.createSecretKey();
+		IncomingKeys inPrev = new IncomingKeys(inPrevTagKey, inPrevHeaderKey,
+				1, 123, new byte[4]);
+		SecretKey inCurrTagKey = TestUtils.createSecretKey();
+		SecretKey inCurrHeaderKey = TestUtils.createSecretKey();
+		IncomingKeys inCurr = new IncomingKeys(inCurrTagKey, inCurrHeaderKey,
+				2, 234, new byte[4]);
+		SecretKey inNextTagKey = TestUtils.createSecretKey();
+		SecretKey inNextHeaderKey = TestUtils.createSecretKey();
+		IncomingKeys inNext = new IncomingKeys(inNextTagKey, inNextHeaderKey,
+				3, 345, new byte[4]);
+		SecretKey outCurrTagKey = TestUtils.createSecretKey();
+		SecretKey outCurrHeaderKey = TestUtils.createSecretKey();
+		OutgoingKeys outCurr = new OutgoingKeys(outCurrTagKey, outCurrHeaderKey,
+				2, 456);
+		return new TransportKeys(transportId, inPrev, inCurr, inNext, outCurr);
+	}
 }

briar-tests/src/org/briarproject/db/H2DatabaseTest.java

@@ -11,14 +11,17 @@ import org.briarproject.api.LocalAuthor;
 import org.briarproject.api.TransportConfig;
 import org.briarproject.api.TransportId;
 import org.briarproject.api.TransportProperties;
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.db.DbException;
 import org.briarproject.api.db.MessageHeader;
 import org.briarproject.api.messaging.Group;
 import org.briarproject.api.messaging.GroupId;
 import org.briarproject.api.messaging.Message;
 import org.briarproject.api.messaging.MessageId;
-import org.briarproject.api.transport.Endpoint;
+import org.briarproject.api.transport.IncomingKeys;
-import org.briarproject.api.transport.TemporarySecret;
+import org.briarproject.api.transport.OutgoingKeys;
+import org.briarproject.api.transport.TransportKeys;
+import org.briarproject.system.FileUtilsImpl;
 import org.briarproject.system.SystemClock;
 import org.junit.After;
 import org.junit.Before;
@@ -34,6 +37,7 @@ import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
+import java.util.Map.Entry;
 import java.util.Random;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -59,7 +63,6 @@ public class H2DatabaseTest extends BriarTestCase {
 	private final Random random = new Random();
 	private final GroupId groupId;
 	private final Group group;
-	private final AuthorId authorId;
 	private final Author author;
 	private final AuthorId localAuthorId;
 	private final LocalAuthor localAuthor;
@@ -75,7 +78,7 @@ public class H2DatabaseTest extends BriarTestCase {
 	public H2DatabaseTest() throws Exception {
 		groupId = new GroupId(TestUtils.getRandomId());
 		group = new Group(groupId, "Group", new byte[GROUP_SALT_LENGTH]);
-		authorId = new AuthorId(TestUtils.getRandomId());
+		AuthorId authorId = new AuthorId(TestUtils.getRandomId());
 		author = new Author(authorId, "Alice", new byte[MAX_PUBLIC_KEY_LENGTH]);
 		localAuthorId = new AuthorId(TestUtils.getRandomId());
 		localAuthor = new LocalAuthor(localAuthorId, "Bob",
@@ -171,7 +174,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
 		db.addVisibility(txn, contactId, groupId);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 		db.addMessage(txn, message, true);
 
 		// The message has no status yet, so it should not be sendable
@@ -216,7 +219,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		assertTrue(ids.isEmpty());
 
 		// The contact subscribing should make the message sendable
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 		ids = db.getMessagesToSend(txn, contactId, ONE_MEGABYTE);
 		assertFalse(ids.isEmpty());
 		Iterator<MessageId> it = ids.iterator();
@@ -243,7 +246,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
 		db.addVisibility(txn, contactId, groupId);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 		db.addMessage(txn, message, true);
 		db.addStatus(txn, contactId, messageId, false, false);
 
@@ -273,7 +276,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 		db.addMessage(txn, message, true);
 		db.addStatus(txn, contactId, messageId, false, false);
 
@@ -305,7 +308,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 
 		// Add some messages to ack
 		MessageId messageId1 = new MessageId(TestUtils.getRandomId());
@@ -342,7 +345,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 
 		// Receive the same message twice
 		db.addMessage(txn, message, true);
@@ -352,10 +355,10 @@ public class H2DatabaseTest extends BriarTestCase {
 
 		// The message ID should only be returned once
 		Collection<MessageId> ids = db.getMessagesToAck(txn, contactId, 1234);
-		assertEquals(Arrays.asList(messageId), ids);
+		assertEquals(Collections.singletonList(messageId), ids);
 
 		// Remove the message ID
-		db.lowerAckFlag(txn, contactId, Arrays.asList(messageId));
+		db.lowerAckFlag(txn, contactId, Collections.singletonList(messageId));
 
 		// The message ID should have been removed
 		assertEquals(Collections.emptyList(), db.getMessagesToAck(txn,
@@ -375,7 +378,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
 		db.addVisibility(txn, contactId, groupId);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 		db.addMessage(txn, message, true);
 		db.addStatus(txn, contactId, messageId, false, false);
 
@@ -674,7 +677,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
 		db.addVisibility(txn, contactId, groupId);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 
 		// The message is not in the database
 		assertFalse(db.containsVisibleMessage(txn, contactId, messageId));
@@ -692,7 +695,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		// Add a contact with a subscription
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 
 		// There's no local subscription for the group
 		assertFalse(db.containsVisibleMessage(txn, contactId, messageId));
@@ -711,7 +714,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		db.addGroup(txn, group);
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 		db.addMessage(txn, message, true);
 		db.addStatus(txn, contactId, messageId, false, false);
 
@@ -737,7 +740,8 @@ public class H2DatabaseTest extends BriarTestCase {
 
 		// Make the group visible to the contact
 		db.addVisibility(txn, contactId, groupId);
-		assertEquals(Arrays.asList(contactId), db.getVisibility(txn, groupId));
+		assertEquals(Collections.singletonList(contactId),
+				db.getVisibility(txn, groupId));
 
 		// Make the group invisible again
 		db.removeVisibility(txn, contactId, groupId);
@@ -1111,183 +1115,97 @@ public class H2DatabaseTest extends BriarTestCase {
 	}
 
 	@Test
-	public void testTemporarySecrets() throws Exception {
+	public void testTransportKeys() throws Exception {
-		// Create an endpoint and four consecutive temporary secrets
+		TransportKeys keys = createTransportKeys();
-		long epoch = 123;
-		int latency = 234;
-		boolean alice = false;
-		long outgoing1 = 345, centre1 = 456;
-		long outgoing2 = 567, centre2 = 678;
-		long outgoing3 = 789, centre3 = 890;
-		long outgoing4 = 901, centre4 = 123;
-		Endpoint ep = new Endpoint(contactId, transportId, epoch, alice);
-		Random random = new Random();
-		byte[] secret1 = new byte[32], bitmap1 = new byte[4];
-		random.nextBytes(secret1);
-		random.nextBytes(bitmap1);
-		TemporarySecret s1 = new TemporarySecret(contactId, transportId, epoch,
-				alice, 0, secret1, outgoing1, centre1, bitmap1);
-		byte[] secret2 = new byte[32], bitmap2 = new byte[4];
-		random.nextBytes(secret2);
-		random.nextBytes(bitmap2);
-		TemporarySecret s2 = new TemporarySecret(contactId, transportId, epoch,
-				alice, 1, secret2, outgoing2, centre2, bitmap2);
-		byte[] secret3 = new byte[32], bitmap3 = new byte[4];
-		random.nextBytes(secret3);
-		random.nextBytes(bitmap3);
-		TemporarySecret s3 = new TemporarySecret(contactId, transportId, epoch,
-				alice, 2, secret3, outgoing3, centre3, bitmap3);
-		byte[] secret4 = new byte[32], bitmap4 = new byte[4];
-		random.nextBytes(secret4);
-		random.nextBytes(bitmap4);
-		TemporarySecret s4 = new TemporarySecret(contactId, transportId, epoch,
-				alice, 3, secret4, outgoing4, centre4, bitmap4);
 
 		Database<Connection> db = open(false);
 		Connection txn = db.startTransaction();
 
-		// Initially there should be no secrets in the database
+		// Initially there should be no transport keys in the database
-		assertEquals(Collections.emptyList(), db.getSecrets(txn));
+		assertEquals(Collections.emptyMap(),
+				db.getTransportKeys(txn, transportId));
 
-		// Add the contact, the transport, the endpoint and the first three
+		// Add the contact, the transport and the transport keys
-		// secrets (periods 0, 1 and 2)
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
-		db.addTransport(txn, transportId, latency);
+		db.addTransport(txn, transportId, 123);
-		db.addEndpoint(txn, ep);
+		db.addTransportKeys(txn, contactId, keys);
-		db.addSecrets(txn, Arrays.asList(s1, s2, s3));
 
-		// Retrieve the first three secrets
+		// Retrieve the transport keys
-		Collection<TemporarySecret> secrets = db.getSecrets(txn);
+		Map<ContactId, TransportKeys> newKeys =
-		assertEquals(3, secrets.size());
+				db.getTransportKeys(txn, transportId);
-		boolean foundFirst = false, foundSecond = false, foundThird = false;
+		assertEquals(1, newKeys.size());
-		for (TemporarySecret s : secrets) {
+		Entry<ContactId, TransportKeys> e =
-			assertEquals(contactId, s.getContactId());
+				newKeys.entrySet().iterator().next();
-			assertEquals(transportId, s.getTransportId());
+		assertEquals(contactId, e.getKey());
-			assertEquals(epoch, s.getEpoch());
+		TransportKeys k = e.getValue();
-			assertEquals(alice, s.getAlice());
+		assertEquals(transportId, k.getTransportId());
-			if (s.getPeriod() == 0) {
+		assertKeysEquals(keys.getPreviousIncomingKeys(),
-				assertArrayEquals(secret1, s.getSecret());
+				k.getPreviousIncomingKeys());
-				assertEquals(outgoing1, s.getOutgoingStreamCounter());
+		assertKeysEquals(keys.getCurrentIncomingKeys(),
-				assertEquals(centre1, s.getWindowCentre());
+				k.getCurrentIncomingKeys());
-				assertArrayEquals(bitmap1, s.getWindowBitmap());
+		assertKeysEquals(keys.getNextIncomingKeys(),
-				foundFirst = true;
+				k.getNextIncomingKeys());
-			} else if (s.getPeriod() == 1) {
+		assertKeysEquals(keys.getCurrentOutgoingKeys(),
-				assertArrayEquals(secret2, s.getSecret());
+				k.getCurrentOutgoingKeys());
-				assertEquals(outgoing2, s.getOutgoingStreamCounter());
-				assertEquals(centre2, s.getWindowCentre());
-				assertArrayEquals(bitmap2, s.getWindowBitmap());
-				foundSecond = true;
-			} else if (s.getPeriod() == 2) {
-				assertArrayEquals(secret3, s.getSecret());
-				assertEquals(outgoing3, s.getOutgoingStreamCounter());
-				assertEquals(centre3, s.getWindowCentre());
-				assertArrayEquals(bitmap3, s.getWindowBitmap());
-				foundThird = true;
-			} else {
-				fail();
-			}
-		}
-		assertTrue(foundFirst);
-		assertTrue(foundSecond);
-		assertTrue(foundThird);
 
-		// Adding the fourth secret (period 3) should delete the first
+		// Removing the contact should remove the transport keys
-		db.addSecrets(txn, Arrays.asList(s4));
-		secrets = db.getSecrets(txn);
-		assertEquals(3, secrets.size());
-		foundSecond = foundThird = false;
-		boolean foundFourth = false;
-		for (TemporarySecret s : secrets) {
-			assertEquals(contactId, s.getContactId());
-			assertEquals(transportId, s.getTransportId());
-			assertEquals(epoch, s.getEpoch());
-			assertEquals(alice, s.getAlice());
-			if (s.getPeriod() == 1) {
-				assertArrayEquals(secret2, s.getSecret());
-				assertEquals(outgoing2, s.getOutgoingStreamCounter());
-				assertEquals(centre2, s.getWindowCentre());
-				assertArrayEquals(bitmap2, s.getWindowBitmap());
-				foundSecond = true;
-			} else if (s.getPeriod() == 2) {
-				assertArrayEquals(secret3, s.getSecret());
-				assertEquals(outgoing3, s.getOutgoingStreamCounter());
-				assertEquals(centre3, s.getWindowCentre());
-				assertArrayEquals(bitmap3, s.getWindowBitmap());
-				foundThird = true;
-			} else if (s.getPeriod() == 3) {
-				assertArrayEquals(secret4, s.getSecret());
-				assertEquals(outgoing4, s.getOutgoingStreamCounter());
-				assertEquals(centre4, s.getWindowCentre());
-				assertArrayEquals(bitmap4, s.getWindowBitmap());
-				foundFourth = true;
-			} else {
-				fail();
-			}
-		}
-		assertTrue(foundSecond);
-		assertTrue(foundThird);
-		assertTrue(foundFourth);
-
-		// Removing the contact should remove the secrets
 		db.removeContact(txn, contactId);
-		assertEquals(Collections.emptyList(), db.getSecrets(txn));
+		assertEquals(Collections.emptyMap(),
+				db.getTransportKeys(txn, transportId));
 
 		db.commitTransaction(txn);
 		db.close();
 	}
 
+	private void assertKeysEquals(IncomingKeys expected, IncomingKeys actual) {
+		assertArrayEquals(expected.getTagKey().getBytes(),
+				actual.getTagKey().getBytes());
+		assertArrayEquals(expected.getHeaderKey().getBytes(),
+				actual.getHeaderKey().getBytes());
+		assertEquals(expected.getRotationPeriod(), actual.getRotationPeriod());
+		assertEquals(expected.getWindowBase(), actual.getWindowBase());
+		assertArrayEquals(expected.getWindowBitmap(), actual.getWindowBitmap());
+	}
+
+	private void assertKeysEquals(OutgoingKeys expected, OutgoingKeys actual) {
+		assertArrayEquals(expected.getTagKey().getBytes(),
+				actual.getTagKey().getBytes());
+		assertArrayEquals(expected.getHeaderKey().getBytes(),
+				actual.getHeaderKey().getBytes());
+		assertEquals(expected.getRotationPeriod(), actual.getRotationPeriod());
+		assertEquals(expected.getStreamCounter(), actual.getStreamCounter());
+	}
+
 	@Test
 	public void testIncrementStreamCounter() throws Exception {
-		// Create an endpoint and a temporary secret
+		TransportKeys keys = createTransportKeys();
-		long epoch = 123;
+		long rotationPeriod = keys.getCurrentOutgoingKeys().getRotationPeriod();
-		int latency = 234;
+		long streamCounter = keys.getCurrentOutgoingKeys().getStreamCounter();
-		boolean alice = false;
-		long period = 345, outgoing = 456, centre = 567;
-		Endpoint ep = new Endpoint(contactId, transportId, epoch, alice);
-		Random random = new Random();
-		byte[] secret = new byte[32], bitmap = new byte[4];
-		random.nextBytes(secret);
-		TemporarySecret s = new TemporarySecret(contactId, transportId, epoch,
-				alice, period, secret, outgoing, centre, bitmap);
 
 		Database<Connection> db = open(false);
 		Connection txn = db.startTransaction();
 
-		// Add the contact, transport, endpoint and temporary secret
+		// Add the contact, transport and transport keys
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
-		db.addTransport(txn, transportId, latency);
+		db.addTransport(txn, transportId, 123);
-		db.addEndpoint(txn, ep);
+		db.updateTransportKeys(txn, Collections.singletonMap(contactId, keys));
-		db.addSecrets(txn, Arrays.asList(s));
 
-		// Retrieve the secret
+		// Increment the stream counter twice and retrieve the transport keys
-		Collection<TemporarySecret> secrets = db.getSecrets(txn);
+		db.incrementStreamCounter(txn, contactId, transportId, rotationPeriod);
-		assertEquals(1, secrets.size());
+		db.incrementStreamCounter(txn, contactId, transportId, rotationPeriod);
-		s = secrets.iterator().next();
+		Map<ContactId, TransportKeys> newKeys =
-		assertEquals(contactId, s.getContactId());
+				db.getTransportKeys(txn, transportId);
-		assertEquals(transportId, s.getTransportId());
+		assertEquals(1, newKeys.size());
-		assertEquals(period, s.getPeriod());
+		Entry<ContactId, TransportKeys> e =
-		assertArrayEquals(secret, s.getSecret());
+				newKeys.entrySet().iterator().next();
-		assertEquals(outgoing, s.getOutgoingStreamCounter());
+		assertEquals(contactId, e.getKey());
-		assertEquals(centre, s.getWindowCentre());
+		TransportKeys k = e.getValue();
-		assertArrayEquals(bitmap, s.getWindowBitmap());
+		assertEquals(transportId, k.getTransportId());
-
+		OutgoingKeys outCurr = k.getCurrentOutgoingKeys();
-		// Increment the stream counter twice and retrieve the secret again
+		assertEquals(rotationPeriod, outCurr.getRotationPeriod());
-		assertEquals(outgoing, db.incrementStreamCounter(txn,
+		assertEquals(streamCounter + 2, outCurr.getStreamCounter());
-				s.getContactId(), s.getTransportId(), s.getPeriod()));
-		assertEquals(outgoing + 1, db.incrementStreamCounter(txn,
-				s.getContactId(), s.getTransportId(), s.getPeriod()));
-		secrets = db.getSecrets(txn);
-		assertEquals(1, secrets.size());
-		s = secrets.iterator().next();
-		assertEquals(contactId, s.getContactId());
-		assertEquals(transportId, s.getTransportId());
-		assertEquals(period, s.getPeriod());
-		assertArrayEquals(secret, s.getSecret());
-		assertEquals(outgoing + 2, s.getOutgoingStreamCounter());
-		assertEquals(centre, s.getWindowCentre());
-		assertArrayEquals(bitmap, s.getWindowBitmap());
 
 		db.commitTransaction(txn);
 		db.close();
@@ -1295,123 +1213,36 @@ public class H2DatabaseTest extends BriarTestCase {
 
 	@Test
 	public void testSetReorderingWindow() throws Exception {
-		// Create an endpoint and a temporary secret
+		TransportKeys keys = createTransportKeys();
-		long epoch = 123;
+		long rotationPeriod = keys.getCurrentIncomingKeys().getRotationPeriod();
-		int latency = 234;
+		long base = keys.getCurrentIncomingKeys().getWindowBase();
-		boolean alice = false;
+		byte[] bitmap = keys.getCurrentIncomingKeys().getWindowBitmap();
-		long period = 345, outgoing = 456, centre = 567;
-		Endpoint ep = new Endpoint(contactId, transportId, epoch, alice);
-		Random random = new Random();
-		byte[] secret = new byte[32], bitmap = new byte[4];
-		random.nextBytes(secret);
-		TemporarySecret s = new TemporarySecret(contactId, transportId, epoch,
-				alice, period, secret, outgoing, centre, bitmap);
 
 		Database<Connection> db = open(false);
 		Connection txn = db.startTransaction();
 
-		// Add the contact, transport, endpoint and temporary secret
+		// Add the contact, transport and transport keys
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
-		db.addTransport(txn, transportId, latency);
+		db.addTransport(txn, transportId, 123);
-		db.addEndpoint(txn, ep);
+		db.updateTransportKeys(txn, Collections.singletonMap(contactId, keys));
-		db.addSecrets(txn, Arrays.asList(s));
 
-		// Retrieve the secret
+		// Update the reordering window and retrieve the transport keys
-		Collection<TemporarySecret> secrets = db.getSecrets(txn);
-		assertEquals(1, secrets.size());
-		s = secrets.iterator().next();
-		assertEquals(contactId, s.getContactId());
-		assertEquals(transportId, s.getTransportId());
-		assertEquals(period, s.getPeriod());
-		assertArrayEquals(secret, s.getSecret());
-		assertEquals(outgoing, s.getOutgoingStreamCounter());
-		assertEquals(centre, s.getWindowCentre());
-		assertArrayEquals(bitmap, s.getWindowBitmap());
-
-		// Update the reordering window and retrieve the secret again
 		random.nextBytes(bitmap);
-		db.setReorderingWindow(txn, contactId, transportId, period, centre,
+		db.setReorderingWindow(txn, contactId, transportId, rotationPeriod,
-				bitmap);
+				base + 1, bitmap);
-		secrets = db.getSecrets(txn);
+		Map<ContactId, TransportKeys> newKeys =
-		assertEquals(1, secrets.size());
+				db.getTransportKeys(txn, transportId);
-		s = secrets.iterator().next();
+		assertEquals(1, newKeys.size());
-		assertEquals(contactId, s.getContactId());
+		Entry<ContactId, TransportKeys> e =
-		assertEquals(transportId, s.getTransportId());
+				newKeys.entrySet().iterator().next();
-		assertEquals(period, s.getPeriod());
+		assertEquals(contactId, e.getKey());
-		assertArrayEquals(secret, s.getSecret());
+		TransportKeys k = e.getValue();
-		assertEquals(outgoing, s.getOutgoingStreamCounter());
+		assertEquals(transportId, k.getTransportId());
-		assertEquals(centre, s.getWindowCentre());
+		IncomingKeys inCurr = k.getCurrentIncomingKeys();
-		assertArrayEquals(bitmap, s.getWindowBitmap());
+		assertEquals(rotationPeriod, inCurr.getRotationPeriod());
-
+		assertEquals(base + 1, inCurr.getWindowBase());
-		// Updating a nonexistent window should not throw an exception
+		assertArrayEquals(bitmap, inCurr.getWindowBitmap());
-		db.setReorderingWindow(txn, contactId, transportId, period + 1, 1,
-				bitmap);
-		// The nonexistent window should not have been created
-		secrets = db.getSecrets(txn);
-		assertEquals(1, secrets.size());
-		s = secrets.iterator().next();
-		assertEquals(contactId, s.getContactId());
-		assertEquals(transportId, s.getTransportId());
-		assertEquals(period, s.getPeriod());
-		assertArrayEquals(secret, s.getSecret());
-		assertEquals(outgoing, s.getOutgoingStreamCounter());
-		assertEquals(centre, s.getWindowCentre());
-		assertArrayEquals(bitmap, s.getWindowBitmap());
-
-		db.commitTransaction(txn);
-		db.close();
-	}
-
-	@Test
-	public void testEndpoints() throws Exception {
-		// Create some endpoints
-		long epoch1 = 123, epoch2 = 234;
-		int latency1 = 345, latency2 = 456;
-		boolean alice1 = true, alice2 = false;
-		TransportId transportId1 = new TransportId("bar");
-		TransportId transportId2 = new TransportId("baz");
-		Endpoint ep1 = new Endpoint(contactId, transportId1, epoch1, alice1);
-		Endpoint ep2 = new Endpoint(contactId, transportId2, epoch2, alice2);
-
-		Database<Connection> db = open(false);
-		Connection txn = db.startTransaction();
-
-		// Initially there should be no endpoints in the database
-		assertEquals(Collections.emptyList(), db.getEndpoints(txn));
-
-		// Add the contact, the transports and the endpoints
-		db.addLocalAuthor(txn, localAuthor);
-		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
-		db.addTransport(txn, transportId1, latency1);
-		db.addTransport(txn, transportId2, latency2);
-		db.addEndpoint(txn, ep1);
-		db.addEndpoint(txn, ep2);
-
-		// Retrieve the endpoints
-		Collection<Endpoint> endpoints = db.getEndpoints(txn);
-		assertEquals(2, endpoints.size());
-		boolean foundFirst = false, foundSecond = false;
-		for (Endpoint ep : endpoints) {
-			assertEquals(contactId, ep.getContactId());
-			if (ep.getTransportId().equals(transportId1)) {
-				assertEquals(epoch1, ep.getEpoch());
-				assertEquals(alice1, ep.getAlice());
-				foundFirst = true;
-			} else if (ep.getTransportId().equals(transportId2)) {
-				assertEquals(epoch2, ep.getEpoch());
-				assertEquals(alice2, ep.getAlice());
-				foundSecond = true;
-			} else {
-				fail();
-			}
-		}
-		assertTrue(foundFirst);
-		assertTrue(foundSecond);
-
-		// Removing the contact should remove the endpoints
-		db.removeContact(txn, contactId);
-		assertEquals(Collections.emptyList(), db.getEndpoints(txn));
 
 		db.commitTransaction(txn);
 		db.close();
@@ -1431,27 +1262,30 @@ public class H2DatabaseTest extends BriarTestCase {
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
 		assertEquals(contactId1, db.addContact(txn, author1, localAuthorId));
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
-		db.setGroups(txn, contactId1, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId1, Collections.singletonList(group), 1);
 
 		// The group should be available
 		assertEquals(Collections.emptyList(), db.getGroups(txn));
-		assertEquals(Arrays.asList(group), db.getAvailableGroups(txn));
+		assertEquals(Collections.singletonList(group),
+				db.getAvailableGroups(txn));
 
 		// Subscribe to the group - it should no longer be available
 		db.addGroup(txn, group);
-		assertEquals(Arrays.asList(group), db.getGroups(txn));
+		assertEquals(Collections.singletonList(group), db.getGroups(txn));
 		assertEquals(Collections.emptyList(), db.getAvailableGroups(txn));
 
 		// Unsubscribe from the group - it should be available again
 		db.removeGroup(txn, groupId);
 		assertEquals(Collections.emptyList(), db.getGroups(txn));
-		assertEquals(Arrays.asList(group), db.getAvailableGroups(txn));
+		assertEquals(Collections.singletonList(group),
+				db.getAvailableGroups(txn));
 
 		// The first contact unsubscribes - it should still be available
 		db.setGroups(txn, contactId, Collections.<Group>emptyList(), 2);
 		assertEquals(Collections.emptyList(), db.getGroups(txn));
-		assertEquals(Arrays.asList(group), db.getAvailableGroups(txn));
+		assertEquals(Collections.singletonList(group),
+				db.getAvailableGroups(txn));
 
 		// The second contact unsubscribes - it should no longer be available
 		db.setGroups(txn, contactId1, Collections.<Group>emptyList(), 2);
@@ -1501,9 +1335,8 @@ public class H2DatabaseTest extends BriarTestCase {
 				db.getInboxMessageHeaders(txn, contactId));
 
 		// Add a message to the inbox group - the header should be returned
-		boolean local = true, seen = false;
+		db.addMessage(txn, message, true);
-		db.addMessage(txn, message, local);
+		db.addStatus(txn, contactId, messageId, false, false);
-		db.addStatus(txn, contactId, messageId, false, seen);
 		Collection<MessageHeader> headers =
 				db.getInboxMessageHeaders(txn, contactId);
 		assertEquals(1, headers.size());
@@ -1514,7 +1347,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		assertEquals(localAuthor, header.getAuthor());
 		assertEquals(contentType, header.getContentType());
 		assertEquals(timestamp, header.getTimestamp());
-		assertEquals(local, header.isLocal());
+		assertEquals(true, header.isLocal());
 		assertEquals(false, header.isRead());
 		assertEquals(STORED, header.getStatus());
 		assertFalse(header.isRead());
@@ -1560,7 +1393,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		// Add a contact who subscribes to a group
 		db.addLocalAuthor(txn, localAuthor);
 		assertEquals(contactId, db.addContact(txn, author, localAuthorId));
-		db.setGroups(txn, contactId, Arrays.asList(group), 1);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 1);
 
 		// Subscribe to the group and make it visible to the contact
 		db.addGroup(txn, group);
@@ -1571,7 +1404,7 @@ public class H2DatabaseTest extends BriarTestCase {
 		db.addStatus(txn, contactId, messageId, false, false);
 		Collection<MessageId> sendable = db.getMessagesToSend(txn, contactId,
 				ONE_MEGABYTE);
-		assertEquals(Arrays.asList(messageId), sendable);
+		assertEquals(Collections.singletonList(messageId), sendable);
 
 		// Mark the message as seen - it should no longer be sendable
 		db.raiseSeenFlag(txn, contactId, messageId);
@@ -1584,9 +1417,9 @@ public class H2DatabaseTest extends BriarTestCase {
 		assertEquals(Collections.emptyList(), sendable);
 
 		// The contact resubscribes - the message should be sendable again
-		db.setGroups(txn, contactId, Arrays.asList(group), 3);
+		db.setGroups(txn, contactId, Collections.singletonList(group), 3);
 		sendable = db.getMessagesToSend(txn, contactId, ONE_MEGABYTE);
-		assertEquals(Arrays.asList(messageId), sendable);
+		assertEquals(Collections.singletonList(messageId), sendable);
 
 		db.commitTransaction(txn);
 		db.close();
@@ -1616,6 +1449,26 @@ public class H2DatabaseTest extends BriarTestCase {
 		return db;
 	}
 
+	private TransportKeys createTransportKeys() {
+		SecretKey inPrevTagKey = TestUtils.createSecretKey();
+		SecretKey inPrevHeaderKey = TestUtils.createSecretKey();
+		IncomingKeys inPrev = new IncomingKeys(inPrevTagKey, inPrevHeaderKey,
+				1, 123, new byte[4]);
+		SecretKey inCurrTagKey = TestUtils.createSecretKey();
+		SecretKey inCurrHeaderKey = TestUtils.createSecretKey();
+		IncomingKeys inCurr = new IncomingKeys(inCurrTagKey, inCurrHeaderKey,
+				2, 234, new byte[4]);
+		SecretKey inNextTagKey = TestUtils.createSecretKey();
+		SecretKey inNextHeaderKey = TestUtils.createSecretKey();
+		IncomingKeys inNext = new IncomingKeys(inNextTagKey, inNextHeaderKey,
+				3, 345, new byte[4]);
+		SecretKey outCurrTagKey = TestUtils.createSecretKey();
+		SecretKey outCurrHeaderKey = TestUtils.createSecretKey();
+		OutgoingKeys outCurr = new OutgoingKeys(outCurrTagKey, outCurrHeaderKey,
+				2, 456);
+		return new TransportKeys(transportId, inPrev, inCurr, inNext, outCurr);
+	}
+
 	@After
 	public void tearDown() {
 		TestUtils.deleteTestDirectory(testDir);

briar-tests/src/org/briarproject/messaging/SimplexMessagingIntegrationTest.java

@@ -13,7 +13,8 @@ import org.briarproject.api.AuthorId;
 import org.briarproject.api.ContactId;
 import org.briarproject.api.LocalAuthor;
 import org.briarproject.api.TransportId;
-import org.briarproject.api.crypto.KeyManager;
+import org.briarproject.api.crypto.CryptoComponent;
+import org.briarproject.api.crypto.SecretKey;
 import org.briarproject.api.db.DatabaseComponent;
 import org.briarproject.api.event.Event;
 import org.briarproject.api.event.EventBus;
@@ -29,11 +30,11 @@ import org.briarproject.api.messaging.PacketReader;
 import org.briarproject.api.messaging.PacketReaderFactory;
 import org.briarproject.api.messaging.PacketWriter;
 import org.briarproject.api.messaging.PacketWriterFactory;
-import org.briarproject.api.transport.Endpoint;
+import org.briarproject.api.transport.KeyManager;
 import org.briarproject.api.transport.StreamContext;
 import org.briarproject.api.transport.StreamReaderFactory;
 import org.briarproject.api.transport.StreamWriterFactory;
-import org.briarproject.api.transport.TagRecogniser;
+import org.briarproject.api.transport.TransportKeys;
 import org.briarproject.crypto.CryptoModule;
 import org.briarproject.data.DataModule;
 import org.briarproject.db.DatabaseModule;
@@ -49,7 +50,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.InputStream;
 import java.io.OutputStream;
-import java.util.Random;
+import java.util.Collections;
 
 import static org.briarproject.api.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
 import static org.briarproject.api.messaging.MessagingConstants.GROUP_SALT_LENGTH;
@@ -63,26 +64,18 @@ import static org.junit.Assert.assertTrue;
 public class SimplexMessagingIntegrationTest extends BriarTestCase {
 
 	private static final int MAX_LATENCY = 2 * 60 * 1000; // 2 minutes
-	private static final int ROTATION_PERIOD =
+	private static final long ROTATION_PERIOD_LENGTH =
-			MAX_CLOCK_DIFFERENCE + MAX_LATENCY;
+			MAX_LATENCY + MAX_CLOCK_DIFFERENCE;
 
 	private final File testDir = TestUtils.getTestDirectory();
 	private final File aliceDir = new File(testDir, "alice");
 	private final File bobDir = new File(testDir, "bob");
-	private final TransportId transportId;
+	private final TransportId transportId = new TransportId("id");
-	private final byte[] initialSecret;
+	private final SecretKey master = TestUtils.createSecretKey();
-	private final long epoch;
+	private final long timestamp = System.currentTimeMillis();
 
 	private Injector alice, bob;
 
-	public SimplexMessagingIntegrationTest() throws Exception {
-		transportId = new TransportId("id");
-		// Create matching secrets for Alice and Bob
-		initialSecret = new byte[32];
-		new Random().nextBytes(initialSecret);
-		epoch = System.currentTimeMillis() - 2 * ROTATION_PERIOD;
-	}
-
 	@Before
 	public void setUp() {
 		testDir.mkdirs();
@@ -125,14 +118,17 @@ public class SimplexMessagingIntegrationTest extends BriarTestCase {
 		Group group = gf.createGroup("Group", new byte[GROUP_SALT_LENGTH]);
 		db.addGroup(group);
 		db.setInboxGroup(contactId, group);
-		// Add the transport and the endpoint
+		// Add the transport
 		db.addTransport(transportId, MAX_LATENCY);
-		Endpoint ep = new Endpoint(contactId, transportId, epoch, true);
+		// Derive and store the transport keys
-		db.addEndpoint(ep);
+		long rotationPeriod = timestamp / ROTATION_PERIOD_LENGTH;
-		keyManager.endpointAdded(ep, MAX_LATENCY, initialSecret);
+		CryptoComponent crypto = alice.getInstance(CryptoComponent.class);
+		TransportKeys keys = crypto.deriveTransportKeys(transportId, master,
+				rotationPeriod, true);
+		db.addTransportKeys(contactId, keys);
+		keyManager.contactAdded(contactId, Collections.singletonList(keys));
 		// Send Bob a message
 		String contentType = "text/plain";
-		long timestamp = System.currentTimeMillis();
 		byte[] body = "Hi Bob!".getBytes("UTF-8");
 		MessageFactory messageFactory = alice.getInstance(MessageFactory.class);
 		Message message = messageFactory.createAnonymousMessage(null, group,
@@ -166,7 +162,7 @@ public class SimplexMessagingIntegrationTest extends BriarTestCase {
 		return out.toByteArray();
 	}
 
-	private void read(byte[] b) throws Exception {
+	private void read(byte[] stream) throws Exception {
 		// Open Bob's database
 		DatabaseComponent db = bob.getInstance(DatabaseComponent.class);
 		assertFalse(db.open());
@@ -188,21 +184,24 @@ public class SimplexMessagingIntegrationTest extends BriarTestCase {
 		Group group = gf.createGroup("Group", new byte[GROUP_SALT_LENGTH]);
 		db.addGroup(group);
 		db.setInboxGroup(contactId, group);
-		// Add the transport and the endpoint
+		// Add the transport
 		db.addTransport(transportId, MAX_LATENCY);
-		Endpoint ep = new Endpoint(contactId, transportId, epoch, false);
+		// Derive and store the transport keys
-		db.addEndpoint(ep);
+		long rotationPeriod = timestamp / ROTATION_PERIOD_LENGTH;
-		keyManager.endpointAdded(ep, MAX_LATENCY, initialSecret);
+		CryptoComponent crypto = bob.getInstance(CryptoComponent.class);
+		TransportKeys keys = crypto.deriveTransportKeys(transportId, master,
+				rotationPeriod, false);
+		db.addTransportKeys(contactId, keys);
+		keyManager.contactAdded(contactId, Collections.singletonList(keys));
 		// Set up an event listener
 		MessageListener listener = new MessageListener();
 		bob.getInstance(EventBus.class).addListener(listener);
-		// Create a tag recogniser and recognise the tag
+		// Read and recognise the tag
-		ByteArrayInputStream in = new ByteArrayInputStream(b);
+		ByteArrayInputStream in = new ByteArrayInputStream(stream);
-		TagRecogniser rec = bob.getInstance(TagRecogniser.class);
 		byte[] tag = new byte[TAG_LENGTH];
 		int read = in.read(tag);
 		assertEquals(tag.length, read);
-		StreamContext ctx = rec.recogniseTag(transportId, tag);
+		StreamContext ctx = keyManager.recogniseTag(transportId, tag);
 		assertNotNull(ctx);
 		// Create a stream reader
 		StreamReaderFactory streamReaderFactory =

briar-tests/src/org/briarproject/transport/KeyManagerImplTest.java

@@ -1,600 +1,14 @@
 package org.briarproject.transport;
 
 import org.briarproject.BriarTestCase;
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.db.DatabaseComponent;
-import org.briarproject.api.event.EventBus;
-import org.briarproject.api.event.EventListener;
-import org.briarproject.api.system.Clock;
-import org.briarproject.api.system.Timer;
-import org.briarproject.api.transport.Endpoint;
-import org.briarproject.api.transport.StreamContext;
-import org.briarproject.api.transport.TagRecogniser;
-import org.briarproject.api.transport.TemporarySecret;
-import org.jmock.Expectations;
-import org.jmock.Mockery;
 import org.junit.Test;
 
-import java.util.Arrays;
+import static org.junit.Assert.fail;
-import java.util.Collections;
-
-import static org.briarproject.api.transport.TransportConstants.MAX_CLOCK_DIFFERENCE;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
 
 public class KeyManagerImplTest extends BriarTestCase {
 
-	private static final long EPOCH = 1000L * 1000L * 1000L * 1000L;
-	private static final int MAX_LATENCY = 2 * 60 * 1000; // 2 minutes
-	private static final int ROTATION_PERIOD =
-			MAX_CLOCK_DIFFERENCE + MAX_LATENCY;
-
-	private final ContactId contactId;
-	private final TransportId transportId;
-	private final byte[] secret0, secret1, secret2, secret3, secret4;
-	private final byte[] initialSecret;
-
-	public KeyManagerImplTest() {
-		contactId = new ContactId(234);
-		transportId = new TransportId("id");
-		secret0 = new byte[32];
-		secret1 = new byte[32];
-		secret2 = new byte[32];
-		secret3 = new byte[32];
-		secret4 = new byte[32];
-		for (int i = 0; i < secret0.length; i++) secret0[i] = 1;
-		for (int i = 0; i < secret1.length; i++) secret1[i] = 2;
-		for (int i = 0; i < secret2.length; i++) secret2[i] = 3;
-		for (int i = 0; i < secret3.length; i++) secret3[i] = 4;
-		for (int i = 0; i < secret4.length; i++) secret4[i] = 5;
-		initialSecret = new byte[32];
-		for (int i = 0; i < initialSecret.length; i++) initialSecret[i] = 123;
-	}
-
 	@Test
-	public void testStartAndStop() throws Exception {
+	public void testUnitTestsExist() {
-		Mockery context = new Mockery();
+		fail(); // FIXME: Write tests
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Collections.emptyList()));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.emptyMap()));
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testEndpointAdded() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The secrets for periods 0 - 2 should be derived
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Collections.emptyList()));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// endpointAdded() during rotation period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(crypto).deriveNextSecret(initialSecret, 0);
-			will(returnValue(secret0));
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(db).addSecrets(Arrays.asList(s0, s1, s2));
-			// The secrets for periods 0 - 2 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s0);
-			oneOf(tagRecogniser).addSecret(s1);
-			oneOf(tagRecogniser).addSecret(s2);
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.endpointAdded(ep, MAX_LATENCY, initialSecret);
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testEndpointAddedAndGetConnectionContext() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The secrets for periods 0 - 2 should be derived
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Collections.emptyList()));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// endpointAdded() during rotation period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(crypto).deriveNextSecret(initialSecret, 0);
-			will(returnValue(secret0));
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(db).addSecrets(Arrays.asList(s0, s1, s2));
-			// The secrets for periods 0 - 2 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s0);
-			oneOf(tagRecogniser).addSecret(s1);
-			oneOf(tagRecogniser).addSecret(s2);
-			// getConnectionContext()
-			oneOf(db).incrementStreamCounter(contactId, transportId, 1);
-			will(returnValue(0L));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.endpointAdded(ep, MAX_LATENCY, initialSecret);
-		StreamContext ctx =
-				keyManager.getStreamContext(contactId, transportId);
-		assertNotNull(ctx);
-		assertEquals(contactId, ctx.getContactId());
-		assertEquals(transportId, ctx.getTransportId());
-		assertArrayEquals(secret1, ctx.getSecret());
-		assertEquals(0, ctx.getStreamNumber());
-		assertEquals(true, ctx.getAlice());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAtEpoch() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the epoch, the start of period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			// The secrets for periods 0 - 2 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s0);
-			oneOf(tagRecogniser).addSecret(s1);
-			oneOf(tagRecogniser).addSecret(s2);
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAtStartOfPeriod2() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-		// The secret for period 3 should be derived and stored
-		final TemporarySecret s3 = new TemporarySecret(ep, 3, secret3);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the start of period 2
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH + ROTATION_PERIOD));
-			// The secret for period 3 should be derived and stored
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(crypto).deriveNextSecret(secret2, 3);
-			will(returnValue(secret3));
-			oneOf(db).addSecrets(Arrays.asList(s3));
-			// The secrets for periods 1 - 3 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s1);
-			oneOf(tagRecogniser).addSecret(s2);
-			oneOf(tagRecogniser).addSecret(s3);
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAtEndOfPeriod3() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-		// The secrets for periods 3 and 4 should be derived and stored
-		final TemporarySecret s3 = new TemporarySecret(ep, 3, secret3);
-		final TemporarySecret s4 = new TemporarySecret(ep, 4, secret4);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the end of period 3
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH + 3 * ROTATION_PERIOD - 1));
-			// The secrets for periods 3 and 4 should be derived from secret 1
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(crypto).deriveNextSecret(secret2, 3);
-			will(returnValue(secret3));
-			oneOf(crypto).deriveNextSecret(secret3, 4);
-			will(returnValue(secret4));
-			// The new secrets should be stored
-			oneOf(db).addSecrets(Arrays.asList(s3, s4));
-			// The secrets for periods 2 - 4 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s2);
-			oneOf(tagRecogniser).addSecret(s3);
-			oneOf(tagRecogniser).addSecret(s4);
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAndRotateInSamePeriod() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the epoch, the start of period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			// The secrets for periods 0 - 2 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s0);
-			oneOf(tagRecogniser).addSecret(s1);
-			oneOf(tagRecogniser).addSecret(s2);
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// run() during period 1: the secrets should not be affected
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH + 1));
-			// getConnectionContext()
-			oneOf(db).incrementStreamCounter(contactId, transportId, 1);
-			will(returnValue(0L));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.run();
-		StreamContext ctx =
-				keyManager.getStreamContext(contactId, transportId);
-		assertNotNull(ctx);
-		assertEquals(contactId, ctx.getContactId());
-		assertEquals(transportId, ctx.getTransportId());
-		assertArrayEquals(secret1, ctx.getSecret());
-		assertEquals(0, ctx.getStreamNumber());
-		assertEquals(true, ctx.getAlice());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAndRotateInNextPeriod() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-		// The secret for period 3 should be derived and stored
-		final TemporarySecret s3 = new TemporarySecret(ep, 3, secret3);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the epoch, the start of period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			// The secrets for periods 0 - 2 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s0);
-			oneOf(tagRecogniser).addSecret(s1);
-			oneOf(tagRecogniser).addSecret(s2);
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// run() during period 2: the secrets should be rotated
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH + ROTATION_PERIOD + 1));
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(crypto).deriveNextSecret(secret2, 3);
-			will(returnValue(secret3));
-			oneOf(tagRecogniser).removeSecret(contactId, transportId, 0);
-			oneOf(db).addSecrets(Arrays.asList(s3));
-			oneOf(tagRecogniser).addSecret(s3);
-			// getConnectionContext()
-			oneOf(db).incrementStreamCounter(contactId, transportId, 2);
-			will(returnValue(0L));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.run();
-		StreamContext ctx =
-				keyManager.getStreamContext(contactId, transportId);
-		assertNotNull(ctx);
-		assertEquals(contactId, ctx.getContactId());
-		assertEquals(transportId, ctx.getTransportId());
-		assertArrayEquals(secret2, ctx.getSecret());
-		assertEquals(0, ctx.getStreamNumber());
-		assertEquals(true, ctx.getAlice());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAndRotateAWholePeriodLate() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final TagRecogniser tagRecogniser = context.mock(TagRecogniser.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-		// The secrets for periods 3 and 4 should be derived and stored
-		final TemporarySecret s3 = new TemporarySecret(ep, 3, secret3);
-		final TemporarySecret s4 = new TemporarySecret(ep, 4, secret4);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the epoch, the start of period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			// The secrets for periods 0 - 2 should be added to the recogniser
-			oneOf(tagRecogniser).addSecret(s0);
-			oneOf(tagRecogniser).addSecret(s1);
-			oneOf(tagRecogniser).addSecret(s2);
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// run() during period 3 (late): the secrets should be rotated
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH + 2 * ROTATION_PERIOD + 1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(crypto).deriveNextSecret(secret2, 3);
-			will(returnValue(secret3));
-			oneOf(crypto).deriveNextSecret(secret3, 4);
-			will(returnValue(secret4));
-			oneOf(tagRecogniser).removeSecret(contactId, transportId, 0);
-			oneOf(tagRecogniser).removeSecret(contactId, transportId, 1);
-			oneOf(db).addSecrets(Arrays.asList(s3, s4));
-			oneOf(tagRecogniser).addSecret(s3);
-			oneOf(tagRecogniser).addSecret(s4);
-			// getConnectionContext()
-			oneOf(db).incrementStreamCounter(contactId, transportId, 3);
-			will(returnValue(0L));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-			oneOf(tagRecogniser).removeSecrets();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.run();
-		StreamContext ctx =
-				keyManager.getStreamContext(contactId, transportId);
-		assertNotNull(ctx);
-		assertEquals(contactId, ctx.getContactId());
-		assertEquals(transportId, ctx.getTransportId());
-		assertArrayEquals(secret3, ctx.getSecret());
-		assertEquals(0, ctx.getStreamNumber());
-		assertEquals(true, ctx.getAlice());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
 	}
 }

briar-tests/src/org/briarproject/transport/KeyRotationIntegrationTest.java

@@ -1,772 +0,0 @@
-package org.briarproject.transport;
-
-import org.briarproject.BriarTestCase;
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.SecretKey;
-import org.briarproject.api.db.DatabaseComponent;
-import org.briarproject.api.event.EventBus;
-import org.briarproject.api.event.EventListener;
-import org.briarproject.api.system.Clock;
-import org.briarproject.api.system.Timer;
-import org.briarproject.api.transport.Endpoint;
-import org.briarproject.api.transport.StreamContext;
-import org.briarproject.api.transport.TagRecogniser;
-import org.briarproject.api.transport.TemporarySecret;
-import org.briarproject.util.ByteUtils;
-import org.hamcrest.Description;
-import org.jmock.Expectations;
-import org.jmock.Mockery;
-import org.jmock.api.Action;
-import org.jmock.api.Invocation;
-import org.junit.Test;
-
-import java.util.Arrays;
-import java.util.Collections;
-
-import static org.briarproject.api.transport.TransportConstants.MAX_CLOCK_DIFFERENCE;
-import static org.briarproject.api.transport.TransportConstants.TAG_LENGTH;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-
-public class KeyRotationIntegrationTest extends BriarTestCase {
-
-	private static final long EPOCH = 1000L * 1000L * 1000L * 1000L;
-	private static final int MAX_LATENCY = 2 * 60 * 1000; // 2 minutes
-	private static final int ROTATION_PERIOD =
-			MAX_CLOCK_DIFFERENCE + MAX_LATENCY;
-
-	private final ContactId contactId;
-	private final TransportId transportId;
-	private final byte[] secret0, secret1, secret2, secret3, secret4;
-	private final byte[] key0, key1, key2, key3, key4;
-	private final SecretKey k0, k1, k2, k3, k4;
-	private final byte[] initialSecret;
-
-	public KeyRotationIntegrationTest() {
-		contactId = new ContactId(234);
-		transportId = new TransportId("id");
-		secret0 = new byte[32];
-		secret1 = new byte[32];
-		secret2 = new byte[32];
-		secret3 = new byte[32];
-		secret4 = new byte[32];
-		for (int i = 0; i < secret0.length; i++) secret0[i] = 1;
-		for (int i = 0; i < secret1.length; i++) secret1[i] = 2;
-		for (int i = 0; i < secret2.length; i++) secret2[i] = 3;
-		for (int i = 0; i < secret3.length; i++) secret3[i] = 4;
-		for (int i = 0; i < secret4.length; i++) secret4[i] = 5;
-		key0 = new byte[32];
-		key1 = new byte[32];
-		key2 = new byte[32];
-		key3 = new byte[32];
-		key4 = new byte[32];
-		k0 = new SecretKey(key0);
-		k1 = new SecretKey(key1);
-		k2 = new SecretKey(key2);
-		k3 = new SecretKey(key3);
-		k4 = new SecretKey(key4);
-		for (int i = 0; i < key0.length; i++) key0[i] = 1;
-		for (int i = 0; i < key1.length; i++) key1[i] = 2;
-		for (int i = 0; i < key2.length; i++) key2[i] = 3;
-		for (int i = 0; i < key3.length; i++) key3[i] = 4;
-		for (int i = 0; i < key4.length; i++) key4[i] = 5;
-		initialSecret = new byte[32];
-		for (int i = 0; i < initialSecret.length; i++) initialSecret[i] = 123;
-	}
-
-	@Test
-	public void testStartAndStop() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final TagRecogniser tagRecogniser = new TagRecogniserImpl(crypto, db);
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Collections.emptyList()));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.emptyMap()));
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testEndpointAdded() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final TagRecogniser tagRecogniser = new TagRecogniserImpl(crypto, db);
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The secrets for periods 0 - 2 should be derived
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Collections.emptyList()));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// endpointAdded() during rotation period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(crypto).deriveNextSecret(initialSecret, 0);
-			will(returnValue(secret0));
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(db).addSecrets(Arrays.asList(s0, s1, s2));
-			// The recogniser should derive the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// stop()
-			// The recogniser should derive the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Remove the listener and stop the timer
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.endpointAdded(ep, MAX_LATENCY, initialSecret);
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testEndpointAddedAndGetConnectionContext() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final TagRecogniser tagRecogniser = new TagRecogniserImpl(crypto, db);
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The secrets for periods 0 - 2 should be derived
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Collections.emptyList()));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// endpointAdded() during rotation period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(crypto).deriveNextSecret(initialSecret, 0);
-			will(returnValue(secret0));
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(db).addSecrets(Arrays.asList(s0, s1, s2));
-			// The recogniser should derive the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// getConnectionContext()
-			oneOf(db).incrementStreamCounter(contactId, transportId, 1);
-			will(returnValue(0L));
-			// stop()
-			// The recogniser should derive the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Remove the listener and stop the timer
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.endpointAdded(ep, MAX_LATENCY, initialSecret);
-		StreamContext ctx =
-				keyManager.getStreamContext(contactId, transportId);
-		assertNotNull(ctx);
-		assertEquals(contactId, ctx.getContactId());
-		assertEquals(transportId, ctx.getTransportId());
-		assertArrayEquals(secret1, ctx.getSecret());
-		assertEquals(0, ctx.getStreamNumber());
-		assertEquals(true, ctx.getAlice());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testEndpointAddedAndAcceptConnection() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final TagRecogniser tagRecogniser = new TagRecogniserImpl(crypto, db);
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The secrets for periods 0 - 2 should be derived
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Collections.emptyList()));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// endpointAdded() during rotation period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			oneOf(crypto).deriveNextSecret(initialSecret, 0);
-			will(returnValue(secret0));
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(db).addSecrets(Arrays.asList(s0, s1, s2));
-			// The recogniser should derive the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// acceptConnection()
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-					with(16L));
-			will(new EncodeTagAction());
-			oneOf(db).setReorderingWindow(contactId, transportId, 2, 1,
-					new byte[] {0, 1, 0, 0});
-			// stop()
-			// The recogniser should derive the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the updated tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 1; i < 17; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Remove the listener and stop the timer
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.endpointAdded(ep, MAX_LATENCY, initialSecret);
-		// Recognise the tag for connection 0 in period 2
-		byte[] tag = new byte[TAG_LENGTH];
-		encodeTag(tag, key2, 0);
-		StreamContext ctx = tagRecogniser.recogniseTag(transportId, tag);
-		assertNotNull(ctx);
-		assertEquals(contactId, ctx.getContactId());
-		assertEquals(transportId, ctx.getTransportId());
-		assertArrayEquals(secret2, ctx.getSecret());
-		assertEquals(0, ctx.getStreamNumber());
-		assertEquals(true, ctx.getAlice());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAtEpoch() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final TagRecogniser tagRecogniser = new TagRecogniserImpl(crypto, db);
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the epoch, the start of period 1
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH));
-			// The recogniser should derive the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Start the timer
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			// The recogniser should remove the tags for period 0
-			oneOf(crypto).deriveTagKey(secret0, false);
-			will(returnValue(k0));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k0),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Remove the listener and stop the timer
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAtStartOfPeriod2() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final TagRecogniser tagRecogniser = new TagRecogniserImpl(crypto, db);
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-		// The secret for period 3 should be derived and stored
-		final TemporarySecret s3 = new TemporarySecret(ep, 3, secret3);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the start of period 2
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH + ROTATION_PERIOD));
-			// The secret for period 3 should be derived and stored
-			oneOf(crypto).deriveNextSecret(secret0, 1);
-			will(returnValue(secret1));
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(crypto).deriveNextSecret(secret2, 3);
-			will(returnValue(secret3));
-			oneOf(db).addSecrets(Arrays.asList(s3));
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 3
-			oneOf(crypto).deriveTagKey(secret3, false);
-			will(returnValue(k3));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k3),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Start the timer
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			// The recogniser should derive the tags for period 1
-			oneOf(crypto).deriveTagKey(secret1, false);
-			will(returnValue(k1));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k1),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should remove the tags for period 3
-			oneOf(crypto).deriveTagKey(secret3, false);
-			will(returnValue(k3));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k3),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Remove the listener and stop the timer
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testLoadSecretsAtEndOfPeriod3() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		final EventBus eventBus = context.mock(EventBus.class);
-		final Clock clock = context.mock(Clock.class);
-		final Timer timer = context.mock(Timer.class);
-
-		final TagRecogniser tagRecogniser = new TagRecogniserImpl(crypto, db);
-		final KeyManagerImpl keyManager = new KeyManagerImpl(crypto, db,
-				eventBus, tagRecogniser, clock, timer);
-
-		// The DB contains the secrets for periods 0 - 2
-		Endpoint ep = new Endpoint(contactId, transportId, EPOCH, true);
-		final TemporarySecret s0 = new TemporarySecret(ep, 0, secret0);
-		final TemporarySecret s1 = new TemporarySecret(ep, 1, secret1);
-		final TemporarySecret s2 = new TemporarySecret(ep, 2, secret2);
-		// The secrets for periods 3 and 4 should be derived and stored
-		final TemporarySecret s3 = new TemporarySecret(ep, 3, secret3);
-		final TemporarySecret s4 = new TemporarySecret(ep, 4, secret4);
-
-		context.checking(new Expectations() {{
-			// start()
-			oneOf(eventBus).addListener(with(any(EventListener.class)));
-			oneOf(db).getSecrets();
-			will(returnValue(Arrays.asList(s0, s1, s2)));
-			oneOf(db).getTransportLatencies();
-			will(returnValue(Collections.singletonMap(transportId,
-					MAX_LATENCY)));
-			// The current time is the end of period 3
-			oneOf(clock).currentTimeMillis();
-			will(returnValue(EPOCH + 3 * ROTATION_PERIOD - 1));
-			// The secrets for periods 3 and 4 should be derived from secret 1
-			oneOf(crypto).deriveNextSecret(secret1, 2);
-			will(returnValue(secret2));
-			oneOf(crypto).deriveNextSecret(secret2, 3);
-			will(returnValue(secret3));
-			oneOf(crypto).deriveNextSecret(secret3, 4);
-			will(returnValue(secret4));
-			// The new secrets should be stored
-			oneOf(db).addSecrets(Arrays.asList(s3, s4));
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 3
-			oneOf(crypto).deriveTagKey(secret3, false);
-			will(returnValue(k3));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k3),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 4
-			oneOf(crypto).deriveTagKey(secret4, false);
-			will(returnValue(k4));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k4),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Start the timer
-			oneOf(timer).scheduleAtFixedRate(with(keyManager),
-					with(any(long.class)), with(any(long.class)));
-			// stop()
-			// The recogniser should derive the tags for period 2
-			oneOf(crypto).deriveTagKey(secret2, false);
-			will(returnValue(k2));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k2),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should remove the tags for period 3
-			oneOf(crypto).deriveTagKey(secret3, false);
-			will(returnValue(k3));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k3),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// The recogniser should derive the tags for period 4
-			oneOf(crypto).deriveTagKey(secret4, false);
-			will(returnValue(k4));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(k4),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Remove the listener and stop the timer
-			oneOf(eventBus).removeListener(with(any(EventListener.class)));
-			oneOf(timer).cancel();
-		}});
-
-		assertTrue(keyManager.start());
-		keyManager.stop();
-
-		context.assertIsSatisfied();
-	}
-
-	private void encodeTag(byte[] tag, byte[] rawKey, long streamNumber) {
-		// Encode a fake tag based on the key and stream number
-		System.arraycopy(rawKey, 0, tag, 0, tag.length);
-		ByteUtils.writeUint32(streamNumber, tag, 0);
-	}
-
-	private class EncodeTagAction implements Action {
-
-		public void describeTo(Description description) {
-			description.appendText("Encodes a tag");
-		}
-
-		public Object invoke(Invocation invocation) throws Throwable {
-			byte[] tag = (byte[]) invocation.getParameter(0);
-			SecretKey key = (SecretKey) invocation.getParameter(1);
-			long streamNumber = (Long) invocation.getParameter(2);
-			encodeTag(tag, key.getBytes(), streamNumber);
-			return null;
-		}
-	}
-}

briar-tests/src/org/briarproject/transport/ReorderingWindowTest.java

@@ -1,5 +1,10 @@
 package org.briarproject.transport;
 
+import org.briarproject.BriarTestCase;
+import org.briarproject.api.transport.TransportConstants;
+import org.briarproject.transport.ReorderingWindow.Change;
+import org.junit.Assert;
+import org.junit.Test;
 import org.briarproject.BriarTestCase;
 import org.junit.Test;
 
@@ -13,148 +18,102 @@ import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Random;
+
+import static org.briarproject.api.transport.TransportConstants.REORDERING_WINDOW_SIZE;
+import static org.junit.Assert.assertArrayEquals;
+
 public class ReorderingWindowTest extends BriarTestCase {
 
 	@Test
-	public void testWindowSliding() {
+	public void testBitmapConversion() {
-		ReorderingWindow w = new ReorderingWindow();
+		Random random = new Random();
-		for (int i = 0; i < 100; i++) {
-			assertFalse(w.isSeen(i));
-			w.setSeen(i);
-			assertTrue(w.isSeen(i));
-		}
-	}
-
-	@Test
-	public void testWindowJumping() {
-		ReorderingWindow w = new ReorderingWindow();
-		for (int i = 0; i < 100; i += 13) {
-			assertFalse(w.isSeen(i));
-			w.setSeen(i);
-			assertTrue(w.isSeen(i));
-		}
-	}
-
-	@Test
-	public void testWindowUpperLimit() {
-		ReorderingWindow w = new ReorderingWindow();
-		// Centre is 0, highest value in window is 15
-		w.setSeen(15);
-		// Centre is 16, highest value in window is 31
-		w.setSeen(31);
-		try {
-			// Centre is 32, highest value in window is 47
-			w.setSeen(48);
-			fail();
-		} catch (IllegalArgumentException expected) {}
-		// Centre is max - 1, highest value in window is max
 		byte[] bitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-		w = new ReorderingWindow(MAX_32_BIT_UNSIGNED - 1, bitmap);
+		for (int i = 0; i < 1000; i++) {
-		assertFalse(w.isSeen(MAX_32_BIT_UNSIGNED - 1));
+			random.nextBytes(bitmap);
-		assertFalse(w.isSeen(MAX_32_BIT_UNSIGNED));
+			ReorderingWindow window = new ReorderingWindow(0L, bitmap);
-		// Values greater than max should never be allowed
+			assertArrayEquals(bitmap, window.getBitmap());
-		try {
+		}
-			w.setSeen(MAX_32_BIT_UNSIGNED + 1);
-			fail();
-		} catch (IllegalArgumentException expected) {}
-		w.setSeen(MAX_32_BIT_UNSIGNED);
-		assertTrue(w.isSeen(MAX_32_BIT_UNSIGNED));
-		// Centre should have moved to max + 1
-		assertEquals(MAX_32_BIT_UNSIGNED + 1, w.getCentre());
-		// The bit corresponding to max should be set
-		byte[] expectedBitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-		expectedBitmap[expectedBitmap.length / 2 - 1] = 1; // 00000001
-		assertArrayEquals(expectedBitmap, w.getBitmap());
-		// Values greater than max should never be allowed even if centre > max
-		try {
-			w.setSeen(MAX_32_BIT_UNSIGNED + 1);
-			fail();
-		} catch (IllegalArgumentException expected) {}
 	}
 
 	@Test
-	public void testWindowLowerLimit() {
+	public void testWindowSlidesWhenFirstElementIsSeen() {
-		ReorderingWindow w = new ReorderingWindow();
+		byte[] bitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-		// Centre is 0, negative values should never be allowed
+		ReorderingWindow window = new ReorderingWindow(0L, bitmap);
-		try {
+		// Set the first element seen
-			w.setSeen(-1);
+		Change change = window.setSeen(0L);
-			fail();
+		// The window should slide by one element
-		} catch (IllegalArgumentException expected) {}
+		assertEquals(1L, window.getBase());
-		// Slide the window
+		assertEquals(Collections.singletonList((long) REORDERING_WINDOW_SIZE), change.getAdded());
-		w.setSeen(15);
+		assertEquals(Collections.singletonList(0L), change.getRemoved());
-		// Centre is 16, lowest value in window is 0
+		// All elements in the window should be unseen
-		w.setSeen(0);
+		assertArrayEquals(bitmap, window.getBitmap());
-		// Slide the window
-		w.setSeen(16);
-		// Centre is 17, lowest value in window is 1
-		w.setSeen(1);
-		try {
-			w.setSeen(0);
-			fail();
-		} catch (IllegalArgumentException expected) {}
-		// Slide the window
-		w.setSeen(25);
-		// Centre is 26, lowest value in window is 10
-		w.setSeen(10);
-		try {
-			w.setSeen(9);
-			fail();
-		} catch (IllegalArgumentException expected) {}
-		// Centre should still be 26
-		assertEquals(26, w.getCentre());
-		// The bits corresponding to 10, 15, 16 and 25 should be set
-		byte[] expectedBitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-		expectedBitmap[0] = (byte) 134; // 10000110
-		expectedBitmap[1] = 1; // 00000001
-		assertArrayEquals(expectedBitmap, w.getBitmap());
 	}
 
 	@Test
-	public void testCannotSetSeenTwice() {
+	public void testWindowDoesNotSlideWhenElementBelowMidpointIsSeen() {
-		ReorderingWindow w = new ReorderingWindow();
+		byte[] bitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-		w.setSeen(15);
+		ReorderingWindow window = new ReorderingWindow(0L, bitmap);
-		try {
+		// Set an element below the midpoint seen
-			w.setSeen(15);
+		Change change = window.setSeen(1L);
-			fail();
+		// The window should not slide
-		} catch (IllegalArgumentException expected) {}
+		assertEquals(0L, window.getBase());
+		assertEquals(Collections.emptyList(), change.getAdded());
+		assertEquals(Collections.singletonList(1L), change.getRemoved());
+		// The second element in the window should be seen
+		bitmap[0] = 0x40; // 0100 0000
+		assertArrayEquals(bitmap, window.getBitmap());
 	}
 
 	@Test
-	public void testGetUnseenStreamNumbers() {
+	public void testWindowSlidesWhenElementAboveMidpointIsSeen() {
-		ReorderingWindow w = new ReorderingWindow();
+		byte[] bitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-		// Centre is 0; window should cover 0 to 15, inclusive, with none seen
+		ReorderingWindow window = new ReorderingWindow(0, bitmap);
-		Collection<Long> unseen = w.getUnseen();
+		long aboveMidpoint = REORDERING_WINDOW_SIZE / 2;
-		assertEquals(16, unseen.size());
+		// Set an element above the midpoint seen
-		for (int i = 0; i < 16; i++) {
+		Change change = window.setSeen(aboveMidpoint);
-			assertTrue(unseen.contains(Long.valueOf(i)));
+		// The window should slide by one element
-			assertFalse(w.isSeen(i));
+		assertEquals(1L, window.getBase());
-		}
+		assertEquals(Collections.singletonList((long) REORDERING_WINDOW_SIZE), change.getAdded());
-		w.setSeen(3);
+		assertEquals(Arrays.asList(0L, aboveMidpoint), change.getRemoved());
-		w.setSeen(4);
+		// The highest element below the midpoint should be seen
-		// Centre is 5; window should cover 0 to 20, inclusive, with two seen
+		bitmap[bitmap.length / 2 - 1] = (byte) 0x01; // 0000 0001
-		unseen = w.getUnseen();
+		assertArrayEquals(bitmap, window.getBitmap());
-		assertEquals(19, unseen.size());
+	}
-		for (int i = 0; i < 21; i++) {
+
-			if (i == 3 || i == 4) {
+	@Test
-				assertFalse(unseen.contains(Long.valueOf(i)));
+	public void testWindowSlidesUntilLowestElementIsUnseenWhenFirstElementIsSeen() {
-				assertTrue(w.isSeen(i));
+		byte[] bitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-			} else {
+		ReorderingWindow window = new ReorderingWindow(0L, bitmap);
-				assertTrue(unseen.contains(Long.valueOf(i)));
+		window.setSeen(1L);
-				assertFalse(w.isSeen(i));
+		// Set the first element seen
-			}
+		Change change = window.setSeen(0L);
-		}
+		// The window should slide by two elements
-		w.setSeen(19);
+		assertEquals(2L, window.getBase());
-		// Centre is 20; window should cover 4 to 35, inclusive, with two seen
+		assertEquals(Arrays.asList((long) REORDERING_WINDOW_SIZE,
-		unseen = w.getUnseen();
+				(long) (REORDERING_WINDOW_SIZE + 1)), change.getAdded());
-		assertEquals(30, unseen.size());
+		assertEquals(Collections.singletonList(0L), change.getRemoved());
-		for (int i = 4; i < 36; i++) {
+		// All elements in the window should be unseen
-			if (i == 4 || i == 19) {
+		assertArrayEquals(bitmap, window.getBitmap());
-				assertFalse(unseen.contains(Long.valueOf(i)));
+	}
-				assertTrue(w.isSeen(i));
+
-			} else {
+	@Test
-				assertTrue(unseen.contains(Long.valueOf(i)));
+	public void testWindowSlidesUntilLowestElementIsUnseenWhenElementAboveMidpointIsSeen() {
-				assertFalse(w.isSeen(i));
+		byte[] bitmap = new byte[REORDERING_WINDOW_SIZE / 8];
-			}
+		ReorderingWindow window = new ReorderingWindow(0L, bitmap);
-		}
+		window.setSeen(1L);
+		long aboveMidpoint = REORDERING_WINDOW_SIZE / 2;
+		// Set an element above the midpoint seen
+		Change change = window.setSeen(aboveMidpoint);
+		// The window should slide by two elements
+		assertEquals(2L, window.getBase());
+		assertEquals(Arrays.asList((long) REORDERING_WINDOW_SIZE,
+				(long) (REORDERING_WINDOW_SIZE + 1)), change.getAdded());
+		assertEquals(Arrays.asList(0L, aboveMidpoint), change.getRemoved());
+		// The second-highest element below the midpoint should be seen
+		bitmap[bitmap.length / 2 - 1] = (byte) 0x02; // 0000 0010
+		assertArrayEquals(bitmap, window.getBitmap());
 	}
 }

briar-tests/src/org/briarproject/transport/TransportKeyManagerTest.java

@@ -0,0 +1,14 @@
+package org.briarproject.transport;
+
+import org.briarproject.BriarTestCase;
+import org.junit.Test;
+
+import static org.junit.Assert.fail;
+
+public class TransportKeyManagerTest extends BriarTestCase {
+
+	@Test
+	public void testUnitTestsExist() {
+		fail(); // FIXME: Write tests
+	}
+}

briar-tests/src/org/briarproject/transport/TransportTagRecogniserTest.java

@@ -1,130 +0,0 @@
-package org.briarproject.transport;
-
-import org.briarproject.BriarTestCase;
-import org.briarproject.api.ContactId;
-import org.briarproject.api.TransportId;
-import org.briarproject.api.crypto.CryptoComponent;
-import org.briarproject.api.crypto.SecretKey;
-import org.briarproject.api.db.DatabaseComponent;
-import org.briarproject.api.transport.StreamContext;
-import org.briarproject.api.transport.TemporarySecret;
-import org.briarproject.util.ByteUtils;
-import org.hamcrest.Description;
-import org.jmock.Expectations;
-import org.jmock.Mockery;
-import org.jmock.api.Action;
-import org.jmock.api.Invocation;
-import org.junit.Test;
-
-import java.util.Random;
-
-import static org.briarproject.api.transport.TransportConstants.TAG_LENGTH;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-
-public class TransportTagRecogniserTest extends BriarTestCase {
-
-	private final ContactId contactId = new ContactId(234);
-	private final TransportId transportId = new TransportId("id");
-	private final SecretKey tagKey = new SecretKey(new byte[32]);
-
-	@Test
-	public void testAddAndRemoveSecret() {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final byte[] secret = new byte[32];
-		new Random().nextBytes(secret);
-		final boolean alice = false;
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		context.checking(new Expectations() {{
-			// Add secret
-			oneOf(crypto).deriveTagKey(secret, !alice);
-			will(returnValue(tagKey));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(tagKey),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Remove secret
-			oneOf(crypto).deriveTagKey(secret, !alice);
-			will(returnValue(tagKey));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(tagKey),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-		}});
-		TemporarySecret s = new TemporarySecret(contactId, transportId, 123,
-				alice, 0, secret, 0, 0, new byte[4]);
-		TransportTagRecogniser recogniser =
-				new TransportTagRecogniser(crypto, db, transportId);
-		recogniser.addSecret(s);
-		recogniser.removeSecret(contactId, 0);
-		context.assertIsSatisfied();
-	}
-
-	@Test
-	public void testRecogniseTag() throws Exception {
-		Mockery context = new Mockery();
-		final CryptoComponent crypto = context.mock(CryptoComponent.class);
-		final byte[] secret = new byte[32];
-		new Random().nextBytes(secret);
-		final boolean alice = false;
-		final DatabaseComponent db = context.mock(DatabaseComponent.class);
-		context.checking(new Expectations() {{
-			// Add secret
-			oneOf(crypto).deriveTagKey(secret, !alice);
-			will(returnValue(tagKey));
-			for (int i = 0; i < 16; i++) {
-				oneOf(crypto).encodeTag(with(any(byte[].class)), with(tagKey),
-						with((long) i));
-				will(new EncodeTagAction());
-			}
-			// Recognise tag 0
-			oneOf(crypto).deriveTagKey(secret, !alice);
-			will(returnValue(tagKey));
-			// The window should slide to include tag 16
-			oneOf(crypto).encodeTag(with(any(byte[].class)), with(tagKey),
-					with(16L));
-			will(new EncodeTagAction());
-			// The updated window should be stored
-			oneOf(db).setReorderingWindow(contactId, transportId, 0, 1,
-					new byte[] {0, 1, 0, 0});
-			// Recognise tag again - no expectations
-		}});
-		TemporarySecret s = new TemporarySecret(contactId, transportId, 123,
-				alice, 0, secret, 0, 0, new byte[4]);
-		TransportTagRecogniser recogniser =
-				new TransportTagRecogniser(crypto, db, transportId);
-		recogniser.addSecret(s);
-		// Tag 0 should be expected
-		byte[] tag = new byte[TAG_LENGTH];
-		StreamContext ctx = recogniser.recogniseTag(tag);
-		assertNotNull(ctx);
-		assertEquals(contactId, ctx.getContactId());
-		assertEquals(transportId, ctx.getTransportId());
-		assertArrayEquals(secret, ctx.getSecret());
-		assertEquals(0, ctx.getStreamNumber());
-		assertEquals(alice, ctx.getAlice());
-		// Tag 0 should not be expected again
-		assertNull(recogniser.recogniseTag(tag));
-		context.assertIsSatisfied();
-	}
-
-	private static class EncodeTagAction implements Action {
-
-		public void describeTo(Description description) {
-			description.appendText("Encodes a tag");
-		}
-
-		public Object invoke(Invocation invocation) throws Throwable {
-			byte[] tag = (byte[]) invocation.getParameter(0);
-			long streamNumber = (Long) invocation.getParameter(2);
-			// Encode a fake tag based on the stream number
-			ByteUtils.writeUint32(streamNumber, tag, 0);
-			return null;
-		}
-	}
-}