Refactor key agreement connection choosing.

Improve QR code scanning on phones with high res cameras and slow CPUs

Closes #1068

See merge request akwizgran/briar!699

.idea/runConfigurations/H2_Performance_Test.xml

@@ -0,0 +1,23 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="H2 Performance Test" type="AndroidJUnit" factoryName="Android JUnit">
+    <extension name="coverage" enabled="false" merge="false" sample_coverage="true" runner="idea" />
+    <module name="bramble-core" />
+    <option name="ALTERNATIVE_JRE_PATH_ENABLED" value="false" />
+    <option name="ALTERNATIVE_JRE_PATH" />
+    <option name="PACKAGE_NAME" value="org.briarproject.bramble.db" />
+    <option name="MAIN_CLASS_NAME" value="org.briarproject.bramble.db.H2DatabasePerformanceTest" />
+    <option name="METHOD_NAME" value="" />
+    <option name="TEST_OBJECT" value="class" />
+    <option name="VM_PARAMETERS" value="-ea" />
+    <option name="PARAMETERS" value="" />
+    <option name="WORKING_DIRECTORY" value="" />
+    <option name="ENV_VARIABLES" />
+    <option name="PASS_PARENT_ENVS" value="true" />
+    <option name="TEST_SEARCH_SCOPE">
+      <value defaultName="singleModule" />
+    </option>
+    <envs />
+    <patterns />
+    <method />
+  </configuration>
+</component>

.idea/runConfigurations/HyperSQL_Performance_Test.xml

@@ -0,0 +1,23 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="HyperSQL Performance Test" type="AndroidJUnit" factoryName="Android JUnit">
+    <extension name="coverage" enabled="false" merge="false" sample_coverage="true" runner="idea" />
+    <module name="bramble-core" />
+    <option name="ALTERNATIVE_JRE_PATH_ENABLED" value="false" />
+    <option name="ALTERNATIVE_JRE_PATH" />
+    <option name="PACKAGE_NAME" value="org.briarproject.bramble.db" />
+    <option name="MAIN_CLASS_NAME" value="org.briarproject.bramble.db.HyperSqlDatabasePerformanceTest" />
+    <option name="METHOD_NAME" value="" />
+    <option name="TEST_OBJECT" value="class" />
+    <option name="VM_PARAMETERS" value="-ea" />
+    <option name="PARAMETERS" value="" />
+    <option name="WORKING_DIRECTORY" value="" />
+    <option name="ENV_VARIABLES" />
+    <option name="PASS_PARENT_ENVS" value="true" />
+    <option name="TEST_SEARCH_SCOPE">
+      <value defaultName="singleModule" />
+    </option>
+    <envs />
+    <patterns />
+    <method />
+  </configuration>
+</component>

bramble-android/build.gradle

@@ -12,8 +12,8 @@ android {
 	defaultConfig {
 		minSdkVersion 14
 		targetSdkVersion 26
-		versionCode 1620
+		versionCode 1700
-		versionName "0.16.20"
+		versionName "0.17.0"
 		consumerProguardFiles 'proguard-rules.txt'
 	}
 
@@ -43,6 +43,7 @@ dependencyVerification {
 			'com.madgag.spongycastle:core:1.58.0.0:core-1.58.0.0.jar:199617dd5698c5a9312b898c0a4cec7ce9dd8649d07f65d91629f58229d72728',
 			'javax.annotation:jsr250-api:1.0:jsr250-api-1.0.jar:a1a922d0d9b6d183ed3800dfac01d1e1eb159f0e8c6f94736931c1def54a941f',
 			'javax.inject:javax.inject:1:javax.inject-1.jar:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff',
+			'net.i2p.crypto:eddsa:0.2.0:eddsa-0.2.0.jar:a7cb1b85c16e2f0730b9204106929a1d9aaae1df728adc7041a8b8b605692140',
 			'org.bitlet:weupnp:0.1.4:weupnp-0.1.4.jar:88df7e6504929d00bdb832863761385c68ab92af945b04f0770b126270a444fb',
 			'org.jacoco:org.jacoco.agent:0.7.4.201502262128:org.jacoco.agent-0.7.4.201502262128-runtime.jar:e357a0f1d573c2f702a273992b1b6cb661734f66311854efb3778a888515c5b5',
 			'org.jacoco:org.jacoco.agent:0.7.4.201502262128:org.jacoco.agent-0.7.4.201502262128.jar:47b4bec6df11a1118da3953da8b9fa1e7079d6fec857faa1a3cf912e53a6fd4e',

bramble-android/proguard-rules.txt

@@ -8,6 +8,10 @@
 -dontwarn dagger.**
 -dontnote dagger.**
 
+-keep class net.i2p.crypto.eddsa.** { *; }
+
+-keep class org.whispersystems.curve25519.** { *; }
+
 -dontwarn sun.misc.Unsafe
 -dontnote com.google.common.**
 

bramble-android/src/main/java/org/briarproject/bramble/plugin/AndroidPluginModule.java

@@ -48,7 +48,7 @@ public class AndroidPluginModule {
 				appContext, locationUtils, reporter, eventBus,
 				torSocketFactory, backoffFactory);
 		DuplexPluginFactory lan = new AndroidLanTcpPluginFactory(ioExecutor,
-				scheduler, backoffFactory, appContext);
+				backoffFactory, appContext);
 		Collection<DuplexPluginFactory> duplex =
 				Arrays.asList(bluetooth, tor, lan);
 		@NotNullByDefault

bramble-android/src/main/java/org/briarproject/bramble/plugin/bluetooth/AndroidBluetoothPlugin.java

@@ -21,6 +21,8 @@ import org.briarproject.bramble.util.AndroidUtils;
 import java.io.Closeable;
 import java.io.IOException;
 import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.UUID;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Executor;
@@ -37,7 +39,16 @@ import static android.bluetooth.BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERA
 import static android.bluetooth.BluetoothAdapter.SCAN_MODE_NONE;
 import static android.bluetooth.BluetoothAdapter.STATE_OFF;
 import static android.bluetooth.BluetoothAdapter.STATE_ON;
+import static android.bluetooth.BluetoothDevice.ACTION_BOND_STATE_CHANGED;
+import static android.bluetooth.BluetoothDevice.BOND_BONDED;
+import static android.bluetooth.BluetoothDevice.BOND_BONDING;
+import static android.bluetooth.BluetoothDevice.BOND_NONE;
+import static android.bluetooth.BluetoothDevice.EXTRA_BOND_STATE;
+import static android.bluetooth.BluetoothDevice.EXTRA_DEVICE;
+import static android.bluetooth.BluetoothDevice.EXTRA_PREVIOUS_BOND_STATE;
+import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
+import static org.briarproject.bramble.util.PrivacyUtils.scrubMacAddress;
 
 @MethodsNotNullByDefault
 @ParametersNotNullByDefault
@@ -55,10 +66,12 @@ class AndroidBluetoothPlugin extends BluetoothPlugin<BluetoothServerSocket> {
 	// Non-null if the plugin started successfully
 	private volatile BluetoothAdapter adapter = null;
 
-	AndroidBluetoothPlugin(Executor ioExecutor, AndroidExecutor androidExecutor,
+	AndroidBluetoothPlugin(BluetoothConnectionManager connectionManager,
+			Executor ioExecutor, AndroidExecutor androidExecutor,
 			Context appContext, SecureRandom secureRandom, Backoff backoff,
 			DuplexPluginCallback callback, int maxLatency) {
-		super(ioExecutor, secureRandom, backoff, callback, maxLatency);
+		super(connectionManager, ioExecutor, secureRandom, backoff, callback,
+				maxLatency);
 		this.androidExecutor = androidExecutor;
 		this.appContext = appContext;
 	}
@@ -70,6 +83,7 @@ class AndroidBluetoothPlugin extends BluetoothPlugin<BluetoothServerSocket> {
 		IntentFilter filter = new IntentFilter();
 		filter.addAction(ACTION_STATE_CHANGED);
 		filter.addAction(ACTION_SCAN_MODE_CHANGED);
+		filter.addAction(ACTION_BOND_STATE_CHANGED);
 		receiver = new BluetoothStateReceiver();
 		appContext.registerReceiver(receiver, filter);
 	}
@@ -154,7 +168,8 @@ class AndroidBluetoothPlugin extends BluetoothPlugin<BluetoothServerSocket> {
 	}
 
 	private DuplexTransportConnection wrapSocket(BluetoothSocket s) {
-		return new AndroidBluetoothTransportConnection(this, s);
+		return new AndroidBluetoothTransportConnection(this,
+				connectionManager, s);
 	}
 
 	@Override
@@ -165,6 +180,17 @@ class AndroidBluetoothPlugin extends BluetoothPlugin<BluetoothServerSocket> {
 	@Override
 	DuplexTransportConnection connectTo(String address, String uuid)
 			throws IOException {
+		if (LOG.isLoggable(INFO)) {
+			boolean found = false;
+			List<String> addresses = new ArrayList<>();
+			for (BluetoothDevice d : adapter.getBondedDevices()) {
+				addresses.add(scrubMacAddress(d.getAddress()));
+				if (d.getAddress().equals(address)) found = true;
+			}
+			LOG.info("Bonded devices: " + addresses);
+			if (found) LOG.info("Connecting to bonded device");
+			else LOG.info("Connecting to unbonded device");
+		}
 		BluetoothDevice d = adapter.getRemoteDevice(address);
 		UUID u = UUID.fromString(uuid);
 		BluetoothSocket s = null;
@@ -190,16 +216,42 @@ class AndroidBluetoothPlugin extends BluetoothPlugin<BluetoothServerSocket> {
 
 		@Override
 		public void onReceive(Context ctx, Intent intent) {
-			int state = intent.getIntExtra(EXTRA_STATE, 0);
+			String action = intent.getAction();
-			if (state == STATE_ON) onAdapterEnabled();
+			if (ACTION_STATE_CHANGED.equals(action)) {
-			else if (state == STATE_OFF) onAdapterDisabled();
+				int state = intent.getIntExtra(EXTRA_STATE, 0);
-			int scanMode = intent.getIntExtra(EXTRA_SCAN_MODE, 0);
+				if (state == STATE_ON) onAdapterEnabled();
-			if (scanMode == SCAN_MODE_NONE) {
+				else if (state == STATE_OFF) onAdapterDisabled();
-				LOG.info("Scan mode: None");
+			} else if (ACTION_SCAN_MODE_CHANGED.equals(action)) {
-			} else if (scanMode == SCAN_MODE_CONNECTABLE) {
+				int scanMode = intent.getIntExtra(EXTRA_SCAN_MODE, 0);
-				LOG.info("Scan mode: Connectable");
+				if (scanMode == SCAN_MODE_NONE) {
-			} else if (scanMode == SCAN_MODE_CONNECTABLE_DISCOVERABLE) {
+					LOG.info("Scan mode: None");
-				LOG.info("Scan mode: Discoverable");
+				} else if (scanMode == SCAN_MODE_CONNECTABLE) {
+					LOG.info("Scan mode: Connectable");
+				} else if (scanMode == SCAN_MODE_CONNECTABLE_DISCOVERABLE) {
+					LOG.info("Scan mode: Discoverable");
+				}
+			} else if (ACTION_BOND_STATE_CHANGED.equals(action)) {
+				BluetoothDevice d = intent.getParcelableExtra(EXTRA_DEVICE);
+				if (LOG.isLoggable(INFO)) {
+					LOG.info("Bond state changed for "
+							+ scrubMacAddress(d.getAddress()));
+				}
+				int oldState = intent.getIntExtra(EXTRA_PREVIOUS_BOND_STATE, 0);
+				if (oldState == BOND_NONE) {
+					LOG.info("Old state: none");
+				} else if (oldState == BOND_BONDING) {
+					LOG.info("Old state: bonding");
+				} else if (oldState == BOND_BONDED) {
+					LOG.info("Old state: bonded");
+				}
+				int state = intent.getIntExtra(EXTRA_BOND_STATE, 0);
+				if (state == BOND_NONE) {
+					LOG.info("New state: none");
+				} else if (state == BOND_BONDING) {
+					LOG.info("New state: bonding");
+				} else if (state == BOND_BONDED) {
+					LOG.info("New state: bonded");
+				}
 			}
 		}
 	}

bramble-android/src/main/java/org/briarproject/bramble/plugin/bluetooth/AndroidBluetoothPluginFactory.java

@@ -59,11 +59,13 @@ public class AndroidBluetoothPluginFactory implements DuplexPluginFactory {
 
 	@Override
 	public DuplexPlugin createPlugin(DuplexPluginCallback callback) {
+		BluetoothConnectionManager connectionManager =
+				new BluetoothConnectionManagerImpl();
 		Backoff backoff = backoffFactory.createBackoff(MIN_POLLING_INTERVAL,
 				MAX_POLLING_INTERVAL, BACKOFF_BASE);
-		AndroidBluetoothPlugin plugin = new AndroidBluetoothPlugin(ioExecutor,
+		AndroidBluetoothPlugin plugin = new AndroidBluetoothPlugin(
-				androidExecutor, appContext, secureRandom, backoff, callback,
+				connectionManager, ioExecutor, androidExecutor, appContext,
-				MAX_LATENCY);
+				secureRandom, backoff, callback, MAX_LATENCY);
 		eventBus.addListener(plugin);
 		return plugin;
 	}

bramble-android/src/main/java/org/briarproject/bramble/plugin/bluetooth/AndroidBluetoothTransportConnection.java

@@ -14,10 +14,14 @@ import java.io.OutputStream;
 class AndroidBluetoothTransportConnection
 		extends AbstractDuplexTransportConnection {
 
+	private final BluetoothConnectionManager connectionManager;
 	private final BluetoothSocket socket;
 
-	AndroidBluetoothTransportConnection(Plugin plugin, BluetoothSocket socket) {
+	AndroidBluetoothTransportConnection(Plugin plugin,
+			BluetoothConnectionManager connectionManager,
+			BluetoothSocket socket) {
 		super(plugin);
+		this.connectionManager = connectionManager;
 		this.socket = socket;
 	}
 
@@ -33,6 +37,10 @@ class AndroidBluetoothTransportConnection
 
 	@Override
 	protected void closeConnection(boolean exception) throws IOException {
-		socket.close();
+		try {
+			socket.close();
+		} finally {
+			connectionManager.connectionClosed(this);
+		}
 	}
 }

bramble-android/src/main/java/org/briarproject/bramble/plugin/tcp/AndroidLanTcpPlugin.java

@@ -5,84 +5,37 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.net.ConnectivityManager;
-import android.net.Network;
 import android.net.NetworkInfo;
-import android.net.wifi.WifiInfo;
-import android.net.wifi.WifiManager;
 
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.Backoff;
 import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
 
-import java.io.IOException;
-import java.net.InetAddress;
-import java.net.Socket;
-import java.net.UnknownHostException;
-import java.util.Collection;
 import java.util.concurrent.Executor;
-import java.util.concurrent.ScheduledExecutorService;
 import java.util.logging.Logger;
 
 import javax.annotation.Nullable;
-import javax.net.SocketFactory;
 
 import static android.content.Context.CONNECTIVITY_SERVICE;
-import static android.content.Context.WIFI_SERVICE;
 import static android.net.ConnectivityManager.CONNECTIVITY_ACTION;
 import static android.net.ConnectivityManager.TYPE_WIFI;
-import static android.net.wifi.WifiManager.EXTRA_WIFI_STATE;
-import static android.os.Build.VERSION.SDK_INT;
-import static java.util.Collections.emptyList;
-import static java.util.Collections.singletonList;
-import static java.util.concurrent.TimeUnit.SECONDS;
 
 @NotNullByDefault
 class AndroidLanTcpPlugin extends LanTcpPlugin {
 
-	// See android.net.wifi.WifiManager
-	private static final String WIFI_AP_STATE_CHANGED_ACTION =
-			"android.net.wifi.WIFI_AP_STATE_CHANGED";
-	private static final int WIFI_AP_STATE_ENABLED = 13;
-
-	private static final byte[] WIFI_AP_ADDRESS_BYTES =
-			{(byte) 192, (byte) 168, 43, 1};
-	private static final InetAddress WIFI_AP_ADDRESS;
-
 	private static final Logger LOG =
 			Logger.getLogger(AndroidLanTcpPlugin.class.getName());
 
-	static {
-		try {
-			WIFI_AP_ADDRESS = InetAddress.getByAddress(WIFI_AP_ADDRESS_BYTES);
-		} catch (UnknownHostException e) {
-			// Should only be thrown if the address has an illegal length
-			throw new AssertionError(e);
-		}
-	}
-
-	private final ScheduledExecutorService scheduler;
 	private final Context appContext;
-	private final ConnectivityManager connectivityManager;
-	@Nullable
-	private final WifiManager wifiManager;
 
 	@Nullable
 	private volatile BroadcastReceiver networkStateReceiver = null;
-	private volatile SocketFactory socketFactory;
 
-	AndroidLanTcpPlugin(Executor ioExecutor, ScheduledExecutorService scheduler,
+	AndroidLanTcpPlugin(Executor ioExecutor, Backoff backoff,
-			Backoff backoff, Context appContext, DuplexPluginCallback callback,
+			Context appContext, DuplexPluginCallback callback, int maxLatency,
-			int maxLatency, int maxIdleTime) {
+			int maxIdleTime) {
 		super(ioExecutor, backoff, callback, maxLatency, maxIdleTime);
-		this.scheduler = scheduler;
 		this.appContext = appContext;
-		ConnectivityManager connectivityManager = (ConnectivityManager)
-				appContext.getSystemService(CONNECTIVITY_SERVICE);
-		if (connectivityManager == null) throw new AssertionError();
-		this.connectivityManager = connectivityManager;
-		wifiManager = (WifiManager) appContext.getApplicationContext()
-				.getSystemService(WIFI_SERVICE);
-		socketFactory = SocketFactory.getDefault();
 	}
 
 	@Override
@@ -91,9 +44,7 @@ class AndroidLanTcpPlugin extends LanTcpPlugin {
 		running = true;
 		// Register to receive network status events
 		networkStateReceiver = new NetworkStateReceiver();
-		IntentFilter filter = new IntentFilter();
+		IntentFilter filter = new IntentFilter(CONNECTIVITY_ACTION);
-		filter.addAction(CONNECTIVITY_ACTION);
-		filter.addAction(WIFI_AP_STATE_CHANGED_ACTION);
 		appContext.registerReceiver(networkStateReceiver, filter);
 	}
 
@@ -105,92 +56,21 @@ class AndroidLanTcpPlugin extends LanTcpPlugin {
 		tryToClose(socket);
 	}
 
-	@Override
-	protected Socket createSocket() throws IOException {
-		return socketFactory.createSocket();
-	}
-
-	@Override
-	protected Collection<InetAddress> getLocalIpAddresses() {
-		// If the device doesn't have wifi, don't open any sockets
-		if (wifiManager == null) return emptyList();
-		// If we're connected to a wifi network, use that network
-		WifiInfo info = wifiManager.getConnectionInfo();
-		if (info != null && info.getIpAddress() != 0)
-			return singletonList(intToInetAddress(info.getIpAddress()));
-		// If we're running an access point, return its address
-		if (super.getLocalIpAddresses().contains(WIFI_AP_ADDRESS))
-				return singletonList(WIFI_AP_ADDRESS);
-		// No suitable addresses
-		return emptyList();
-	}
-
-	private InetAddress intToInetAddress(int ip) {
-		byte[] ipBytes = new byte[4];
-		ipBytes[0] = (byte) (ip & 0xFF);
-		ipBytes[1] = (byte) ((ip >> 8) & 0xFF);
-		ipBytes[2] = (byte) ((ip >> 16) & 0xFF);
-		ipBytes[3] = (byte) ((ip >> 24) & 0xFF);
-		try {
-			return InetAddress.getByAddress(ipBytes);
-		} catch (UnknownHostException e) {
-			// Should only be thrown if address has illegal length
-			throw new AssertionError(e);
-		}
-	}
-
-	// On API 21 and later, a socket that is not created with the wifi
-	// network's socket factory may try to connect via another network
-	private SocketFactory getSocketFactory() {
-		if (SDK_INT < 21) return SocketFactory.getDefault();
-		for (Network net : connectivityManager.getAllNetworks()) {
-			NetworkInfo info = connectivityManager.getNetworkInfo(net);
-			if (info != null && info.getType() == TYPE_WIFI)
-				return net.getSocketFactory();
-		}
-		LOG.warning("Could not find suitable socket factory");
-		return SocketFactory.getDefault();
-	}
-
 	private class NetworkStateReceiver extends BroadcastReceiver {
 
 		@Override
 		public void onReceive(Context ctx, Intent i) {
 			if (!running) return;
-			if (isApEnabledEvent(i)) {
+			Object o = ctx.getSystemService(CONNECTIVITY_SERVICE);
-				// The state change may be broadcast before the AP address is
+			ConnectivityManager cm = (ConnectivityManager) o;
-				// visible, so delay handling the event
+			NetworkInfo net = cm.getActiveNetworkInfo();
-				scheduler.schedule(this::handleConnectivityChange, 1, SECONDS);
+			if (net != null && net.getType() == TYPE_WIFI && net.isConnected()) {
-			} else {
+				LOG.info("Connected to Wi-Fi");
-				handleConnectivityChange();
-			}
-		}
-
-		private void handleConnectivityChange() {
-			if (!running) return;
-			Collection<InetAddress> addrs = getLocalIpAddresses();
-			if (addrs.contains(WIFI_AP_ADDRESS)) {
-				LOG.info("Providing wifi hotspot");
-				// There's no corresponding Network object and thus no way
-				// to get a suitable socket factory, so we won't be able to
-				// make outgoing connections on API 21+ if another network
-				// has internet access
-				socketFactory = SocketFactory.getDefault();
 				if (socket == null || socket.isClosed()) bind();
-			} else if (addrs.isEmpty()) {
+			} else {
-				LOG.info("Not connected to wifi");
+				LOG.info("Not connected to Wi-Fi");
-				socketFactory = SocketFactory.getDefault();
 				tryToClose(socket);
-			} else {
-				LOG.info("Connected to wifi");
-				socketFactory = getSocketFactory();
-				if (socket == null || socket.isClosed()) bind();
 			}
 		}
-
-		private boolean isApEnabledEvent(Intent i) {
-			return WIFI_AP_STATE_CHANGED_ACTION.equals(i.getAction()) &&
-					i.getIntExtra(EXTRA_WIFI_STATE, 0) == WIFI_AP_STATE_ENABLED;
-		}
 	}
 }

bramble-android/src/main/java/org/briarproject/bramble/plugin/tcp/AndroidLanTcpPluginFactory.java

@@ -11,7 +11,6 @@ import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
 import org.briarproject.bramble.api.plugin.duplex.DuplexPluginFactory;
 
 import java.util.concurrent.Executor;
-import java.util.concurrent.ScheduledExecutorService;
 
 import javax.annotation.concurrent.Immutable;
 
@@ -28,15 +27,12 @@ public class AndroidLanTcpPluginFactory implements DuplexPluginFactory {
 	private static final double BACKOFF_BASE = 1.2;
 
 	private final Executor ioExecutor;
-	private final ScheduledExecutorService scheduler;
 	private final BackoffFactory backoffFactory;
 	private final Context appContext;
 
 	public AndroidLanTcpPluginFactory(Executor ioExecutor,
-			ScheduledExecutorService scheduler, BackoffFactory backoffFactory,
+			BackoffFactory backoffFactory, Context appContext) {
-			Context appContext) {
 		this.ioExecutor = ioExecutor;
-		this.scheduler = scheduler;
 		this.backoffFactory = backoffFactory;
 		this.appContext = appContext;
 	}
@@ -55,7 +51,7 @@ public class AndroidLanTcpPluginFactory implements DuplexPluginFactory {
 	public DuplexPlugin createPlugin(DuplexPluginCallback callback) {
 		Backoff backoff = backoffFactory.createBackoff(MIN_POLLING_INTERVAL,
 				MAX_POLLING_INTERVAL, BACKOFF_BASE);
-		return new AndroidLanTcpPlugin(ioExecutor, scheduler, backoff,
+		return new AndroidLanTcpPlugin(ioExecutor, backoff, appContext,
-				appContext, callback, MAX_LATENCY, MAX_IDLE_TIME);
+				callback, MAX_LATENCY, MAX_IDLE_TIME);
 	}
 }

bramble-android/src/main/java/org/briarproject/bramble/plugin/tor/TorPlugin.java

@@ -16,7 +16,6 @@ import android.os.PowerManager;
 import net.freehaven.tor.control.EventHandler;
 import net.freehaven.tor.control.TorControlConnection;
 
-import org.briarproject.bramble.PoliteExecutor;
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.data.BdfList;
 import org.briarproject.bramble.api.event.Event;
@@ -64,6 +63,8 @@ import java.util.concurrent.Future;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
 import java.util.logging.Logger;
 import java.util.regex.Pattern;
 import java.util.zip.ZipInputStream;
@@ -110,7 +111,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 	private static final Logger LOG =
 			Logger.getLogger(TorPlugin.class.getName());
 
-	private final Executor ioExecutor, connectionStatusExecutor;
+	private final Executor ioExecutor;
 	private final ScheduledExecutorService scheduler;
 	private final Context appContext;
 	private final LocationUtils locationUtils;
@@ -124,6 +125,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 	private final File torDirectory, torFile, geoIpFile, configFile;
 	private final File doneFile, cookieFile;
 	private final PowerManager.WakeLock wakeLock;
+	private final Lock connectionStatusLock;
 	private final AtomicReference<Future<?>> connectivityCheck =
 			new AtomicReference<>();
 	private final AtomicBoolean used = new AtomicBoolean(false);
@@ -165,9 +167,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 		// This tag will prevent Huawei's powermanager from killing us.
 		wakeLock = pm.newWakeLock(PARTIAL_WAKE_LOCK, "LocationManagerService");
 		wakeLock.setReferenceCounted(false);
-		// Don't execute more than one connection status check at a time
+		connectionStatusLock = new ReentrantLock();
-		connectionStatusExecutor = new PoliteExecutor("TorPlugin",
-				ioExecutor, 1);
 	}
 
 	@Override
@@ -697,46 +697,56 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 	}
 
 	private void updateConnectionStatus() {
-		connectionStatusExecutor.execute(() -> {
+		ioExecutor.execute(() -> {
 			if (!running) return;
-			Object o = appContext.getSystemService(CONNECTIVITY_SERVICE);
-			ConnectivityManager cm = (ConnectivityManager) o;
-			NetworkInfo net = cm.getActiveNetworkInfo();
-			boolean online = net != null && net.isConnected();
-			boolean wifi = online && net.getType() == TYPE_WIFI;
-			String country = locationUtils.getCurrentCountry();
-			boolean blocked = TorNetworkMetadata.isTorProbablyBlocked(
-					country);
-			Settings s = callback.getSettings();
-			int network = s.getInt(PREF_TOR_NETWORK, PREF_TOR_NETWORK_ALWAYS);
-
-			if (LOG.isLoggable(INFO)) {
-				LOG.info("Online: " + online + ", wifi: " + wifi);
-				if ("".equals(country)) LOG.info("Country code unknown");
-				else LOG.info("Country code: " + country);
-			}
-
 			try {
-				if (!online) {
+				connectionStatusLock.lock();
-					LOG.info("Disabling network, device is offline");
+				updateConnectionStatusLocked();
-					enableNetwork(false);
+			} finally {
-				} else if (blocked) {
+				connectionStatusLock.unlock();
-					LOG.info("Disabling network, country is blocked");
-					enableNetwork(false);
-				} else if (network == PREF_TOR_NETWORK_NEVER
-						|| (network == PREF_TOR_NETWORK_WIFI && !wifi)) {
-					LOG.info("Disabling network due to data setting");
-					enableNetwork(false);
-				} else {
-					LOG.info("Enabling network");
-					enableNetwork(true);
-				}
-			} catch (IOException e) {
-				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			}
 		});
 	}
 
+	// Locking: connectionStatusLock
+	private void updateConnectionStatusLocked() {
+		Object o = appContext.getSystemService(CONNECTIVITY_SERVICE);
+		ConnectivityManager cm = (ConnectivityManager) o;
+		NetworkInfo net = cm.getActiveNetworkInfo();
+		boolean online = net != null && net.isConnected();
+		boolean wifi = online && net.getType() == TYPE_WIFI;
+		String country = locationUtils.getCurrentCountry();
+		boolean blocked = TorNetworkMetadata.isTorProbablyBlocked(
+				country);
+		Settings s = callback.getSettings();
+		int network = s.getInt(PREF_TOR_NETWORK, PREF_TOR_NETWORK_ALWAYS);
+
+		if (LOG.isLoggable(INFO)) {
+			LOG.info("Online: " + online + ", wifi: " + wifi);
+			if ("".equals(country)) LOG.info("Country code unknown");
+			else LOG.info("Country code: " + country);
+		}
+
+		try {
+			if (!online) {
+				LOG.info("Disabling network, device is offline");
+				enableNetwork(false);
+			} else if (blocked) {
+				LOG.info("Disabling network, country is blocked");
+				enableNetwork(false);
+			} else if (network == PREF_TOR_NETWORK_NEVER
+					|| (network == PREF_TOR_NETWORK_WIFI && !wifi)) {
+				LOG.info("Disabling network due to data setting");
+				enableNetwork(false);
+			} else {
+				LOG.info("Enabling network");
+				enableNetwork(true);
+			}
+		} catch (IOException e) {
+			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
+		}
+	}
+
 	private void scheduleConnectionStatusUpdate() {
 		Future<?> newConnectivityCheck =
 				scheduler.schedule(this::updateConnectionStatus, 1, MINUTES);

bramble-api/src/main/java/org/briarproject/bramble/api/Multiset.java

@@ -0,0 +1,101 @@
+package org.briarproject.bramble.api;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.NoSuchElementException;
+import java.util.Set;
+
+import javax.annotation.concurrent.NotThreadSafe;
+
+@NotThreadSafe
+@NotNullByDefault
+public class Multiset<T> {
+
+	private final Map<T, Integer> map = new HashMap<>();
+
+	private int total = 0;
+
+	/**
+	 * Returns how many items the multiset contains in total.
+	 */
+	public int getTotal() {
+		return total;
+	}
+
+	/**
+	 * Returns how many unique items the multiset contains.
+	 */
+	public int getUnique() {
+		return map.size();
+	}
+
+	/**
+	 * Returns how many of the given item the multiset contains.
+	 */
+	public int getCount(T t) {
+		Integer count = map.get(t);
+		return count == null ? 0 : count;
+	}
+
+	/**
+	 * Adds the given item to the multiset and returns how many of the item
+	 * the multiset now contains.
+	 */
+	public int add(T t) {
+		Integer count = map.get(t);
+		if (count == null) count = 0;
+		map.put(t, count + 1);
+		total++;
+		return count + 1;
+	}
+
+	/**
+	 * Removes the given item from the multiset and returns how many of the
+	 * item the multiset now contains.
+	 * @throws NoSuchElementException if the item is not in the multiset.
+	 */
+	public int remove(T t) {
+		Integer count = map.get(t);
+		if (count == null) throw new NoSuchElementException();
+		if (count == 1) map.remove(t);
+		else map.put(t, count - 1);
+		total--;
+		return count - 1;
+	}
+
+	/**
+	 * Removes all occurrences of the given item from the multiset.
+	 */
+	public int removeAll(T t) {
+		Integer count = map.remove(t);
+		if (count == null) return 0;
+		total -= count;
+		return count;
+	}
+
+	/**
+	 * Returns true if the multiset contains any occurrences of the given item.
+	 */
+	public boolean contains(T t) {
+		return map.containsKey(t);
+	}
+
+	/**
+	 * Removes all items from the multiset.
+	 */
+	public void clear() {
+		map.clear();
+		total = 0;
+	}
+
+	/**
+	 * Returns the set of unique items the multiset contains. The returned set
+	 * is unmodifiable.
+	 */
+	public Set<T> keySet() {
+		return Collections.unmodifiableSet(map.keySet());
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/UnsupportedVersionException.java

@@ -0,0 +1,9 @@
+package org.briarproject.bramble.api;
+
+import java.io.IOException;
+
+/**
+ * An exception that indicates an unrecoverable version mismatch.
+ */
+public class UnsupportedVersionException extends IOException {
+}

bramble-api/src/main/java/org/briarproject/bramble/api/client/ClientHelper.java

@@ -5,6 +5,7 @@ import org.briarproject.bramble.api.data.BdfDictionary;
 import org.briarproject.bramble.api.data.BdfList;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Transaction;
+import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.GroupId;
 import org.briarproject.bramble.api.sync.Message;
@@ -93,10 +94,13 @@ public interface ClientHelper {
 
 	BdfList toList(Message m) throws FormatException;
 
+	BdfList toList(Author a);
+
 	byte[] sign(String label, BdfList toSign, byte[] privateKey)
 			throws FormatException, GeneralSecurityException;
 
 	void verifySignature(String label, byte[] sig, byte[] publicKey,
 			BdfList signed) throws FormatException, GeneralSecurityException;
 
+	Author parseAndValidateAuthor(BdfList author) throws FormatException;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/client/ContactGroupFactory.java

@@ -12,18 +12,19 @@ public interface ContactGroupFactory {
 	/**
 	 * Creates a group that is not shared with any contacts.
 	 */
-	Group createLocalGroup(ClientId clientId);
+	Group createLocalGroup(ClientId clientId, int clientVersion);
 
 	/**
 	 * Creates a group for the given client to share with the given contact.
 	 */
-	Group createContactGroup(ClientId clientId, Contact contact);
+	Group createContactGroup(ClientId clientId, int clientVersion,
+			Contact contact);
 
 	/**
 	 * Creates a group for the given client to share between the given authors
 	 * identified by their AuthorIds.
 	 */
-	Group createContactGroup(ClientId clientId, AuthorId authorId1,
+	Group createContactGroup(ClientId clientId, int clientVersion,
-			AuthorId authorId2);
+			AuthorId authorId1, AuthorId authorId2);
 
 }

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactExchangeTask.java

@@ -12,6 +12,32 @@ import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
 @NotNullByDefault
 public interface ContactExchangeTask {
 
+	/**
+	 * The current version of the contact exchange protocol
+	 */
+	int PROTOCOL_VERSION = 0;
+
+	/**
+	 * Label for deriving Alice's header key from the master secret.
+	 */
+	String ALICE_KEY_LABEL =
+			"org.briarproject.bramble.contact/ALICE_HEADER_KEY";
+
+	/**
+	 * Label for deriving Bob's header key from the master secret.
+	 */
+	String BOB_KEY_LABEL = "org.briarproject.bramble.contact/BOB_HEADER_KEY";
+
+	/**
+	 * Label for deriving Alice's key binding nonce from the master secret.
+	 */
+	String ALICE_NONCE_LABEL = "org.briarproject.bramble.contact/ALICE_NONCE";
+
+	/**
+	 * Label for deriving Bob's key binding nonce from the master secret.
+	 */
+	String BOB_NONCE_LABEL = "org.briarproject.bramble.contact/BOB_NONCE";
+
 	/**
 	 * Exchanges contact information with a remote peer.
 	 */

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/CryptoComponent.java

@@ -1,11 +1,13 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.plugin.TransportId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.bramble.api.transport.TransportKeys;
 
 import java.security.GeneralSecurityException;
 import java.security.SecureRandom;
 
+import javax.annotation.Nullable;
+
+@NotNullByDefault
 public interface CryptoComponent {
 
 	SecretKey generateSecretKey();
@@ -23,127 +25,46 @@ public interface CryptoComponent {
 	KeyParser getMessageKeyParser();
 
 	/**
-	 * Derives a stream header key from the given master secret.
+	 * Derives another secret key from the given secret key.
-	 * @param alice whether the key is for use by Alice or Bob.
-	 */
-	SecretKey deriveHeaderKey(SecretKey master, boolean alice);
-
-	/**
-	 * Derives a message authentication code key from the given master secret.
-	 * @param alice whether the key is for use by Alice or Bob.
-	 */
-	SecretKey deriveMacKey(SecretKey master, boolean alice);
-
-	/**
-	 * Derives a nonce from the given master secret for one of the parties to
-	 * sign.
-	 * @param alice whether the nonce is for use by Alice or Bob.
-	 */
-	byte[] deriveSignatureNonce(SecretKey master, boolean alice);
-
-	/**
-	 * Derives a commitment to the provided public key.
-	 * <p/>
-	 * Part of BQP.
 	 *
-	 * @param publicKey the public key
+	 * @param label a namespaced label indicating the purpose of the derived
-	 * @return the commitment to the provided public key.
+	 * key, to prevent it from being repurposed or colliding with a key derived
+	 * for another purpose
 	 */
-	byte[] deriveKeyCommitment(byte[] publicKey);
+	SecretKey deriveKey(String label, SecretKey k, byte[]... inputs);
 
 	/**
 	 * Derives a common shared secret from two public keys and one of the
 	 * corresponding private keys.
-	 * <p/>
-	 * Part of BQP.
 	 *
-	 * @param theirPublicKey the ephemeral public key of the remote party
+	 * @param label a namespaced label indicating the purpose of this shared
-	 * @param ourKeyPair our ephemeral keypair
+	 * secret, to prevent it from being repurposed or colliding with a shared
-	 * @param alice true if ourKeyPair belongs to Alice
+	 * secret derived for another purpose
+	 * @param theirPublicKey the public key of the remote party
+	 * @param ourKeyPair the key pair of the local party
 	 * @return the shared secret
-	 * @throws GeneralSecurityException
 	 */
-	SecretKey deriveSharedSecret(byte[] theirPublicKey, KeyPair ourKeyPair,
+	SecretKey deriveSharedSecret(String label, PublicKey theirPublicKey,
-			boolean alice) throws GeneralSecurityException;
+			KeyPair ourKeyPair, byte[]... inputs)
+			throws GeneralSecurityException;
 
 	/**
-	 * Derives the content of a confirmation record.
+	 * Signs the given byte[] with the given private key.
-	 * <p/>
-	 * Part of BQP.
 	 *
-	 * @param sharedSecret the common shared secret
+	 * @param label a namespaced label indicating the purpose of this
-	 * @param theirPayload the commit payload from the remote party
+	 * signature, to prevent it from being repurposed or colliding with a
-	 * @param ourPayload the commit payload we sent
+	 * signature created for another purpose
-	 * @param theirPublicKey the ephemeral public key of the remote party
-	 * @param ourKeyPair our ephemeral keypair
-	 * @param alice true if ourKeyPair belongs to Alice
-	 * @param aliceRecord true if the confirmation record is for use by Alice
-	 * @return the confirmation record
-	 */
-	byte[] deriveConfirmationRecord(SecretKey sharedSecret,
-			byte[] theirPayload, byte[] ourPayload,
-			byte[] theirPublicKey, KeyPair ourKeyPair,
-			boolean alice, boolean aliceRecord);
-
-	/**
-	 * Derives a master secret from the given shared secret.
-	 * <p/>
-	 * Part of BQP.
-	 *
-	 * @param sharedSecret the common shared secret
-	 * @return the master secret
-	 */
-	SecretKey deriveMasterSecret(SecretKey sharedSecret);
-
-	/**
-	 * Derives a master secret from two public keys and one of the corresponding
-	 * private keys.
-	 * <p/>
-	 * This is a helper method that calls
-	 * deriveMasterSecret(deriveSharedSecret(theirPublicKey, ourKeyPair, alice))
-	 *
-	 * @param theirPublicKey the ephemeral public key of the remote party
-	 * @param ourKeyPair our ephemeral keypair
-	 * @param alice true if ourKeyPair belongs to Alice
-	 * @return the shared secret
-	 * @throws GeneralSecurityException
-	 */
-	SecretKey deriveMasterSecret(byte[] theirPublicKey, KeyPair ourKeyPair,
-			boolean alice) throws GeneralSecurityException;
-
-	/**
-	 * Derives initial transport keys for the given transport in the given
-	 * rotation period from the given master secret.
-	 * @param alice whether the keys are for use by Alice or Bob.
-	 */
-	TransportKeys deriveTransportKeys(TransportId t, SecretKey master,
-			long rotationPeriod, boolean alice);
-
-	/**
-	 * Rotates the given transport keys to the given rotation period. If the
-	 * keys are for a future rotation period they are not rotated.
-	 */
-	TransportKeys rotateTransportKeys(TransportKeys k, long rotationPeriod);
-
-	/** Encodes the pseudo-random tag that is used to recognise a stream. */
-	void encodeTag(byte[] tag, SecretKey tagKey, int protocolVersion,
-			long streamNumber);
-
-	/**
-	 * Signs the given byte[] with the given PrivateKey.
-	 *
-	 * @param label A label specific to this signature
-	 *              to ensure that the signature cannot be repurposed
 	 */
 	byte[] sign(String label, byte[] toSign, byte[] privateKey)
 			throws GeneralSecurityException;
 
 	/**
-	 * Verifies that the given signature is valid for the signedData
+	 * Verifies that the given signature is valid for the signed data
-	 * and the given publicKey.
+	 * and the given public key.
 	 *
-	 * @param label A label that was specific to this signature
+	 * @param label a namespaced label indicating the purpose of this
-	 *              to ensure that the signature cannot be repurposed
+	 * signature, to prevent it from being repurposed or colliding with a
+	 * signature created for another purpose
 	 * @return true if the signature was valid, false otherwise.
 	 */
 	boolean verify(String label, byte[] signedData, byte[] publicKey,
@@ -153,23 +74,22 @@ public interface CryptoComponent {
 	 * Returns the hash of the given inputs. The inputs are unambiguously
 	 * combined by prefixing each input with its length.
 	 *
-	 * @param label A label specific to this hash to ensure that hashes
+	 * @param label a namespaced label indicating the purpose of this hash, to
-	 *              calculated for distinct purposes don't collide.
+	 * prevent it from being repurposed or colliding with a hash created for
+	 * another purpose
 	 */
 	byte[] hash(String label, byte[]... inputs);
 
-	/**
-	 * Returns the length of hashes produced by
-	 * the {@link CryptoComponent#hash(String, byte[]...)} method.
-	 */
-	int getHashLength();
-
 	/**
 	 * Returns a message authentication code with the given key over the
 	 * given inputs. The inputs are unambiguously combined by prefixing each
 	 * input with its length.
+	 *
+	 * @param label a namespaced label indicating the purpose of this MAC, to
+	 * prevent it from being repurposed or colliding with a MAC created for
+	 * another purpose
 	 */
-	byte[] mac(SecretKey macKey, byte[]... inputs);
+	byte[] mac(String label, SecretKey macKey, byte[]... inputs);
 
 	/**
 	 * Encrypts and authenticates the given plaintext so it can be written to
@@ -185,6 +105,7 @@ public interface CryptoComponent {
 	 * given password. Returns null if the ciphertext cannot be decrypted and
 	 * authenticated (for example, if the password is wrong).
 	 */
+	@Nullable
 	byte[] decryptWithPassword(byte[] ciphertext, String password);
 
 	/**

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/CryptoConstants.java

@@ -0,0 +1,19 @@
+package org.briarproject.bramble.api.crypto;
+
+public interface CryptoConstants {
+
+	/**
+	 * The maximum length of an agreement public key in bytes.
+	 */
+	int MAX_AGREEMENT_PUBLIC_KEY_BYTES = 32;
+
+	/**
+	 * The maximum length of a signature public key in bytes.
+	 */
+	int MAX_SIGNATURE_PUBLIC_KEY_BYTES = 32;
+
+	/**
+	 * The maximum length of a signature in bytes.
+	 */
+	int MAX_SIGNATURE_BYTES = 64;
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/KeyAgreementCrypto.java

@@ -0,0 +1,50 @@
+package org.briarproject.bramble.api.crypto;
+
+/**
+ * Crypto operations for the key agreement protocol - see
+ * https://code.briarproject.org/akwizgran/briar-spec/blob/master/protocols/BQP.md
+ */
+public interface KeyAgreementCrypto {
+
+	/**
+	 * Hash label for public key commitment.
+	 */
+	String COMMIT_LABEL = "org.briarproject.bramble.keyagreement/COMMIT";
+
+	/**
+	 * Key derivation label for confirmation record.
+	 */
+	String CONFIRMATION_KEY_LABEL =
+			"org.briarproject.bramble.keyagreement/CONFIRMATION_KEY";
+
+	/**
+	 * MAC label for confirmation record.
+	 */
+	String CONFIRMATION_MAC_LABEL =
+			"org.briarproject.bramble.keyagreement/CONFIRMATION_MAC";
+
+	/**
+	 * Derives a commitment to the provided public key.
+	 *
+	 * @param publicKey the public key
+	 * @return the commitment to the provided public key.
+	 */
+	byte[] deriveKeyCommitment(PublicKey publicKey);
+
+	/**
+	 * Derives the content of a confirmation record.
+	 *
+	 * @param sharedSecret the common shared secret
+	 * @param theirPayload the key exchange payload of the remote party
+	 * @param ourPayload the key exchange payload of the local party
+	 * @param theirPublicKey the ephemeral public key of the remote party
+	 * @param ourKeyPair our ephemeral key pair of the local party
+	 * @param alice true if the local party is Alice
+	 * @param aliceRecord true if the confirmation record is for use by Alice
+	 * @return the confirmation record
+	 */
+	byte[] deriveConfirmationRecord(SecretKey sharedSecret,
+			byte[] theirPayload, byte[] ourPayload,
+			PublicKey theirPublicKey, KeyPair ourKeyPair,
+			boolean alice, boolean aliceRecord);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/TransportCrypto.java

@@ -0,0 +1,32 @@
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.plugin.TransportId;
+import org.briarproject.bramble.api.transport.TransportKeys;
+
+/**
+ * Crypto operations for the transport security protocol - see
+ * https://code.briarproject.org/akwizgran/briar-spec/blob/master/protocols/BTP.md
+ */
+public interface TransportCrypto {
+
+	/**
+	 * Derives initial transport keys for the given transport in the given
+	 * rotation period from the given master secret.
+	 *
+	 * @param alice whether the keys are for use by Alice or Bob.
+	 */
+	TransportKeys deriveTransportKeys(TransportId t, SecretKey master,
+			long rotationPeriod, boolean alice);
+
+	/**
+	 * Rotates the given transport keys to the given rotation period. If the
+	 * keys are for the given period or any later period they are not rotated.
+	 */
+	TransportKeys rotateTransportKeys(TransportKeys k, long rotationPeriod);
+
+	/**
+	 * Encodes the pseudo-random tag that is used to recognise a stream.
+	 */
+	void encodeTag(byte[] tag, SecretKey tagKey, int protocolVersion,
+			long streamNumber);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/data/ObjectReader.java

@@ -1,11 +0,0 @@
-package org.briarproject.bramble.api.data;
-
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-
-import java.io.IOException;
-
-@NotNullByDefault
-public interface ObjectReader<T> {
-
-	T readObject(BdfReader r) throws IOException;
-}

bramble-api/src/main/java/org/briarproject/bramble/api/db/DatabaseComponent.java

@@ -43,7 +43,7 @@ public interface DatabaseComponent {
 	 * @throws DataTooOldException if the data uses an older schema than the
 	 * current code and cannot be migrated
 	 */
-	boolean open(@Nullable MigrationListener listener) throws DbException;
+	boolean open() throws DbException;
 
 	/**
 	 * Waits for any open transactions to finish and closes the database.
@@ -259,30 +259,31 @@ public interface DatabaseComponent {
 	Collection<LocalAuthor> getLocalAuthors(Transaction txn) throws DbException;
 
 	/**
-	 * Returns the IDs of any messages that need to be validated.
+	 * Returns the IDs of any messages that need to be validated by the given
+	 * client.
 	 * <p/>
 	 * Read-only.
 	 */
-	Collection<MessageId> getMessagesToValidate(Transaction txn)
+	Collection<MessageId> getMessagesToValidate(Transaction txn, ClientId c)
 			throws DbException;
 
 	/**
-	 * Returns the IDs of any messages that are pending delivery due to
+	 * Returns the IDs of any messages that are valid but pending delivery due
-	 * dependencies on other messages.
+	 * to dependencies on other messages for the given client.
 	 * <p/>
 	 * Read-only.
 	 */
-	Collection<MessageId> getPendingMessages(Transaction txn)
+	Collection<MessageId> getPendingMessages(Transaction txn, ClientId c)
 			throws DbException;
 
 	/**
-	 * Returns the IDs of any messages that have shared dependents but have
+	 * Returns the IDs of any messages from the given client
-	 * not yet been shared themselves.
+	 * that have a shared dependent, but are still not shared themselves.
 	 * <p/>
 	 * Read-only.
 	 */
-	Collection<MessageId> getMessagesToShare(Transaction txn)
+	Collection<MessageId> getMessagesToShare(Transaction txn,
-			throws DbException;
+			ClientId c) throws DbException;
 
 	/**
 	 * Returns the message with the given ID, in serialised form, or null if

bramble-api/src/main/java/org/briarproject/bramble/api/db/MigrationListener.java

@@ -1,11 +0,0 @@
-package org.briarproject.bramble.api.db;
-
-public interface MigrationListener {
-
-	/**
-	 * This is called when a migration is started while opening the database.
-	 * It will be called once for each migration being applied.
-	 */
-	void onMigrationRun();
-
-}

bramble-api/src/main/java/org/briarproject/bramble/api/identity/Author.java

@@ -1,11 +1,13 @@
 package org.briarproject.bramble.api.identity;
 
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-
+import org.briarproject.bramble.util.StringUtils;
-import java.io.UnsupportedEncodingException;
 
 import javax.annotation.concurrent.Immutable;
 
+import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_AUTHOR_NAME_LENGTH;
+import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
+
 /**
  * A pseudonym for a user.
  */
@@ -17,20 +19,25 @@ public class Author {
 		NONE, ANONYMOUS, UNKNOWN, UNVERIFIED, VERIFIED, OURSELVES
 	}
 
+	/**
+	 * The current version of the author structure.
+	 */
+	public static final int FORMAT_VERSION = 1;
+
 	private final AuthorId id;
+	private final int formatVersion;
 	private final String name;
 	private final byte[] publicKey;
 
-	public Author(AuthorId id, String name, byte[] publicKey) {
+	public Author(AuthorId id, int formatVersion, String name,
-		int length;
+			byte[] publicKey) {
-		try {
+		int nameLength = StringUtils.toUtf8(name).length;
-			length = name.getBytes("UTF-8").length;
+		if (nameLength == 0 || nameLength > MAX_AUTHOR_NAME_LENGTH)
-		} catch (UnsupportedEncodingException e) {
+			throw new IllegalArgumentException();
-			throw new RuntimeException(e);
+		if (publicKey.length == 0 || publicKey.length > MAX_PUBLIC_KEY_LENGTH)
-		}
-		if (length == 0 || length > AuthorConstants.MAX_AUTHOR_NAME_LENGTH)
 			throw new IllegalArgumentException();
 		this.id = id;
+		this.formatVersion = formatVersion;
 		this.name = name;
 		this.publicKey = publicKey;
 	}
@@ -42,6 +49,13 @@ public class Author {
 		return id;
 	}
 
+	/**
+	 * Returns the version of the author structure used to create the author.
+	 */
+	public int getFormatVersion() {
+		return formatVersion;
+	}
+
 	/**
 	 * Returns the author's name.
 	 */

bramble-api/src/main/java/org/briarproject/bramble/api/identity/AuthorConstants.java

@@ -1,5 +1,8 @@
 package org.briarproject.bramble.api.identity;
 
+import static org.briarproject.bramble.api.crypto.CryptoConstants.MAX_SIGNATURE_BYTES;
+import static org.briarproject.bramble.api.crypto.CryptoConstants.MAX_SIGNATURE_PUBLIC_KEY_BYTES;
+
 public interface AuthorConstants {
 
 	/**
@@ -8,26 +11,14 @@ public interface AuthorConstants {
 	int MAX_AUTHOR_NAME_LENGTH = 50;
 
 	/**
-	 * The maximum length of a public key in bytes.
+	 * The maximum length of a public key in bytes. This applies to the
-	 * <p>
+	 * signature algorithm used by the current {@link Author format version}.
-	 * Public keys use SEC1 format: 0x04 x y, where x and y are unsigned
-	 * big-endian integers.
-	 * <p>
-	 * For a 256-bit elliptic curve, the maximum length is 2 * 256 / 8 + 1.
 	 */
-	int MAX_PUBLIC_KEY_LENGTH = 65;
+	int MAX_PUBLIC_KEY_LENGTH = MAX_SIGNATURE_PUBLIC_KEY_BYTES;
 
 	/**
-	 * The maximum length of a signature in bytes.
+	 * The maximum length of a signature in bytes. This applies to the
-	 * <p>
+	 * signature algorithm used by the current {@link Author format version}.
-	 * A signature is an ASN.1 DER sequence containing two integers, r and s.
-	 * The format is 0x30 len1 0x02 len2 r 0x02 len3 s, where len1 is
-	 * len(0x02 len2 r 0x02 len3 s) as a DER length, len2 is len(r) as a DER
-	 * length, len3 is len(s) as a DER length, and r and s are signed
-	 * big-endian integers of minimal length.
-	 * <p>
-	 * For a 256-bit elliptic curve, the lengths are one byte each, so the
-	 * maximum length is 2 * 256 / 8 + 8.
 	 */
-	int MAX_SIGNATURE_LENGTH = 72;
+	int MAX_SIGNATURE_LENGTH = MAX_SIGNATURE_BYTES;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/identity/AuthorFactory.java

@@ -5,8 +5,27 @@ import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 @NotNullByDefault
 public interface AuthorFactory {
 
+	/**
+	 * Creates an author with the current format version and the given name and
+	 * public key.
+	 */
 	Author createAuthor(String name, byte[] publicKey);
 
+	/**
+	 * Creates an author with the given format version, name and public key.
+	 */
+	Author createAuthor(int formatVersion, String name, byte[] publicKey);
+
+	/**
+	 * Creates a local author with the current format version and the given
+	 * name and keys.
+	 */
 	LocalAuthor createLocalAuthor(String name, byte[] publicKey,
 			byte[] privateKey);
+
+	/**
+	 * Creates a local author with the given format version, name and keys.
+	 */
+	LocalAuthor createLocalAuthor(int formatVersion, String name,
+			byte[] publicKey, byte[] privateKey);
 }

bramble-api/src/main/java/org/briarproject/bramble/api/identity/AuthorId.java

@@ -16,7 +16,7 @@ public class AuthorId extends UniqueId {
 	/**
 	 * Label for hashing authors to calculate their identities.
 	 */
-	public static final String LABEL = "org.briarproject.bramble.AUTHOR_ID";
+	public static final String LABEL = "org.briarproject.bramble/AUTHOR_ID";
 
 	public AuthorId(byte[] id) {
 		super(id);

bramble-api/src/main/java/org/briarproject/bramble/api/identity/LocalAuthor.java

@@ -14,9 +14,9 @@ public class LocalAuthor extends Author {
 	private final byte[] privateKey;
 	private final long created;
 
-	public LocalAuthor(AuthorId id, String name, byte[] publicKey,
+	public LocalAuthor(AuthorId id, int formatVersion, String name,
-			byte[] privateKey, long created) {
+			byte[] publicKey, byte[] privateKey, long created) {
-		super(id, name, publicKey);
+		super(id, formatVersion, name, publicKey);
 		this.privateKey = privateKey;
 		this.created = created;
 	}

bramble-api/src/main/java/org/briarproject/bramble/api/keyagreement/KeyAgreementConstants.java

@@ -3,9 +3,9 @@ package org.briarproject.bramble.api.keyagreement;
 public interface KeyAgreementConstants {
 
 	/**
-	 * The current version of the BQP protocol.
+	 * The current version of the BQP protocol. Version number 89 is reserved.
 	 */
-	byte PROTOCOL_VERSION = 2;
+	byte PROTOCOL_VERSION = 4;
 
 	/**
 	 * The length of the record header in bytes.
@@ -22,7 +22,10 @@ public interface KeyAgreementConstants {
 	 */
 	int COMMIT_LENGTH = 16;
 
-	long CONNECTION_TIMEOUT = 20 * 1000; // Milliseconds
+	/**
+	 * The connection timeout in milliseconds.
+	 */
+	long CONNECTION_TIMEOUT = 20 * 1000;
 
 	/**
 	 * The transport identifier for Bluetooth.
@@ -33,4 +36,16 @@ public interface KeyAgreementConstants {
 	 * The transport identifier for LAN.
 	 */
 	int TRANSPORT_ID_LAN = 1;
+
+	/**
+	 * Label for deriving the shared secret.
+	 */
+	String SHARED_SECRET_LABEL =
+			"org.briarproject.bramble.keyagreement/SHARED_SECRET";
+
+	/**
+	 * Label for deriving the master secret.
+	 */
+	String MASTER_SECRET_LABEL =
+			"org.briarproject.bramble.keyagreement/MASTER_SECRET";
 }

bramble-api/src/main/java/org/briarproject/bramble/api/keyagreement/KeyAgreementTaskFactory.java

@@ -1,15 +0,0 @@
-package org.briarproject.bramble.api.keyagreement;
-
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-
-/**
- * Manages tasks for conducting key agreements with remote peers.
- */
-@NotNullByDefault
-public interface KeyAgreementTaskFactory {
-
-	/**
-	 * Gets the current key agreement task.
-	 */
-	KeyAgreementTask createTask();
-}

bramble-api/src/main/java/org/briarproject/bramble/api/lifecycle/LifecycleManager.java

@@ -21,25 +21,7 @@ public interface LifecycleManager {
 	 * The result of calling {@link #startServices(String)}.
 	 */
 	enum StartResult {
-		ALREADY_RUNNING,
+		ALREADY_RUNNING, DB_ERROR, SERVICE_ERROR, SUCCESS
-		DB_ERROR,
-		DATA_TOO_OLD_ERROR,
-		DATA_TOO_NEW_ERROR,
-		SERVICE_ERROR,
-		SUCCESS
-	}
-
-	/**
-	 * The state the lifecycle can be in.
-	 * Returned by {@link #getLifecycleState()}
-	 */
-	enum LifecycleState {
-
-		STARTING, MIGRATING_DATABASE, STARTING_SERVICES, RUNNING, STOPPING;
-
-		public boolean isAfter(LifecycleState state) {
-			return ordinal() > state.ordinal();
-		}
 	}
 
 	/**
@@ -89,10 +71,4 @@ public interface LifecycleManager {
 	 * the {@link DatabaseComponent} to be closed before returning.
 	 */
 	void waitForShutdown() throws InterruptedException;
-
-	/**
-	 * Returns the current state of the lifecycle.
-	 */
-	LifecycleState getLifecycleState();
-
 }

bramble-api/src/main/java/org/briarproject/bramble/api/lifecycle/event/LifecycleEvent.java

@@ -1,20 +0,0 @@
-package org.briarproject.bramble.api.lifecycle.event;
-
-import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState;
-
-/**
- * An event that is broadcast when the app enters a new lifecycle state.
- */
-public class LifecycleEvent extends Event {
-
-	private final LifecycleState state;
-
-	public LifecycleEvent(LifecycleState state) {
-		this.state = state;
-	}
-
-	public LifecycleState getLifecycleState() {
-		return state;
-	}
-}

bramble-api/src/main/java/org/briarproject/bramble/api/lifecycle/event/ShutdownEvent.java

@@ -0,0 +1,9 @@
+package org.briarproject.bramble.api.lifecycle.event;
+
+import org.briarproject.bramble.api.event.Event;
+
+/**
+ * An event that is broadcast when the app is shutting down.
+ */
+public class ShutdownEvent extends Event {
+}

bramble-api/src/main/java/org/briarproject/bramble/api/properties/TransportPropertyManager.java

@@ -17,6 +17,11 @@ public interface TransportPropertyManager {
 	 */
 	ClientId CLIENT_ID = new ClientId("org.briarproject.briar.properties");
 
+	/**
+	 * The current version of the transport property client.
+	 */
+	int CLIENT_VERSION = 0;
+
 	/**
 	 * Stores the given properties received while adding a contact - they will
 	 * be superseded by any properties synced from the contact.

bramble-api/src/main/java/org/briarproject/bramble/api/sync/ClientId.java

@@ -36,4 +36,8 @@ public class ClientId implements Comparable<ClientId> {
 		return id.hashCode();
 	}
 
+	@Override
+	public String toString() {
+		return id;
+	}
 }

bramble-api/src/main/java/org/briarproject/bramble/api/sync/GroupFactory.java

@@ -6,7 +6,7 @@ import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 public interface GroupFactory {
 
 	/**
-	 * Creates a group with the given client ID and descriptor.
+	 * Creates a group with the given client ID, client version and descriptor.
 	 */
-	Group createGroup(ClientId c, byte[] descriptor);
+	Group createGroup(ClientId c, int clientVersion, byte[] descriptor);
 }

bramble-api/src/main/java/org/briarproject/bramble/api/sync/GroupId.java

@@ -15,7 +15,7 @@ public class GroupId extends UniqueId {
 	/**
 	 * Label for hashing groups to calculate their identifiers.
 	 */
-	public static final String LABEL = "org.briarproject.bramble.GROUP_ID";
+	public static final String LABEL = "org.briarproject.bramble/GROUP_ID";
 
 	public GroupId(byte[] id) {
 		super(id);

bramble-api/src/main/java/org/briarproject/bramble/api/sync/MessageId.java

@@ -16,7 +16,7 @@ public class MessageId extends UniqueId {
 	/**
 	 * Label for hashing messages to calculate their identifiers.
 	 */
-	public static final String LABEL = "org.briarproject.bramble.MESSAGE_ID";
+	public static final String LABEL = "org.briarproject.bramble/MESSAGE_ID";
 
 	public MessageId(byte[] id) {
 		super(id);

bramble-api/src/main/java/org/briarproject/bramble/api/transport/TransportConstants.java

@@ -7,7 +7,7 @@ public interface TransportConstants {
 	/**
 	 * The current version of the transport protocol.
 	 */
-	int PROTOCOL_VERSION = 3;
+	int PROTOCOL_VERSION = 4;
 
 	/**
 	 * The length of the pseudo-random tag in bytes.
@@ -80,4 +80,32 @@ public interface TransportConstants {
 	 * The size of the reordering window.
 	 */
 	int REORDERING_WINDOW_SIZE = 32;
+
+	/**
+	 * Label for deriving Alice's initial tag key from the master secret.
+	 */
+	String ALICE_TAG_LABEL = "org.briarproject.bramble.transport/ALICE_TAG_KEY";
+
+	/**
+	 * Label for deriving Bob's initial tag key from the master secret.
+	 */
+	String BOB_TAG_LABEL = "org.briarproject.bramble.transport/BOB_TAG_KEY";
+
+	/**
+	 * Label for deriving Alice's initial header key from the master secret.
+	 */
+	String ALICE_HEADER_LABEL =
+			"org.briarproject.bramble.transport/ALICE_HEADER_KEY";
+
+	/**
+	 * Label for deriving Bob's initial header key from the master secret.
+	 */
+	String BOB_HEADER_LABEL =
+			"org.briarproject.bramble.transport/BOB_HEADER_KEY";
+
+	/**
+	 * Label for deriving the next period's key in key rotation.
+	 */
+	String ROTATE_LABEL = "org.briarproject.bramble.transport/ROTATE";
+
 }

bramble-api/src/test/java/org/briarproject/bramble/test/TestUtils.java

@@ -13,9 +13,14 @@ import org.briarproject.bramble.api.sync.MessageId;
 import org.briarproject.bramble.util.IoUtils;
 
 import java.io.File;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
 import java.util.Random;
 import java.util.concurrent.atomic.AtomicInteger;
 
+import static org.briarproject.bramble.api.identity.Author.FORMAT_VERSION;
 import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_AUTHOR_NAME_LENGTH;
 import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
 import static org.briarproject.bramble.api.sync.SyncConstants.MAX_GROUP_DESCRIPTOR_LENGTH;
@@ -63,7 +68,8 @@ public class TestUtils {
 		byte[] publicKey = getRandomBytes(MAX_PUBLIC_KEY_LENGTH);
 		byte[] privateKey = getRandomBytes(MAX_PUBLIC_KEY_LENGTH);
 		long created = System.currentTimeMillis();
-		return new LocalAuthor(id, name, publicKey, privateKey, created);
+		return new LocalAuthor(id, FORMAT_VERSION, name, publicKey, privateKey,
+				created);
 	}
 
 	public static Author getAuthor() {
@@ -74,7 +80,7 @@ public class TestUtils {
 		AuthorId id = new AuthorId(getRandomId());
 		String name = getRandomString(nameLength);
 		byte[] publicKey = getRandomBytes(MAX_PUBLIC_KEY_LENGTH);
-		return new Author(id, name, publicKey);
+		return new Author(id, FORMAT_VERSION, name, publicKey);
 	}
 
 	public static Group getGroup(ClientId clientId) {
@@ -99,4 +105,38 @@ public class TestUtils {
 		long timestamp = System.currentTimeMillis();
 		return new Message(id, groupId, timestamp, raw);
 	}
+
+	public static double getMedian(Collection<? extends Number> samples) {
+		int size = samples.size();
+		if (size == 0) throw new IllegalArgumentException();
+		List<Double> sorted = new ArrayList<>(size);
+		for (Number n : samples) sorted.add(n.doubleValue());
+		Collections.sort(sorted);
+		if (size % 2 == 1) return sorted.get(size / 2);
+		double low = sorted.get(size / 2 - 1), high = sorted.get(size / 2);
+		return (low + high) / 2;
+	}
+
+	public static double getMean(Collection<? extends Number> samples) {
+		if (samples.isEmpty()) throw new IllegalArgumentException();
+		double sum = 0;
+		for (Number n : samples) sum += n.doubleValue();
+		return sum / samples.size();
+	}
+
+	public static double getVariance(Collection<? extends Number> samples) {
+		if (samples.size() < 2) throw new IllegalArgumentException();
+		double mean = getMean(samples);
+		double sumSquareDiff = 0;
+		for (Number n : samples) {
+			double diff = n.doubleValue() - mean;
+			sumSquareDiff += diff * diff;
+		}
+		return sumSquareDiff / (samples.size() - 1);
+	}
+
+	public static double getStandardDeviation(
+			Collection<? extends Number> samples) {
+		return Math.sqrt(getVariance(samples));
+	}
 }

bramble-core/build.gradle

@@ -9,12 +9,15 @@ apply plugin: 'witness'
 dependencies {
 	implementation project(path: ':bramble-api', configuration: 'default')
 	implementation 'com.madgag.spongycastle:core:1.58.0.0'
-	implementation 'com.h2database:h2:1.4.192' // This is the last version that supports Java 1.6
+	implementation 'com.h2database:h2:1.4.192' // The last version that supports Java 1.6
 	implementation 'org.bitlet:weupnp:0.1.4'
+	implementation 'net.i2p.crypto:eddsa:0.2.0'
+	implementation 'org.whispersystems:curve25519-java:0.4.1'
 
 	apt 'com.google.dagger:dagger-compiler:2.0.2'
 
 	testImplementation project(path: ':bramble-api', configuration: 'testOutput')
+	testImplementation 'org.hsqldb:hsqldb:2.3.5' // The last version that supports Java 1.6
 	testImplementation 'junit:junit:4.12'
 	testImplementation "org.jmock:jmock:2.8.2"
 	testImplementation "org.jmock:jmock-junit4:2.8.2"
@@ -37,18 +40,21 @@ dependencyVerification {
 			'com.madgag.spongycastle:core:1.58.0.0:core-1.58.0.0.jar:199617dd5698c5a9312b898c0a4cec7ce9dd8649d07f65d91629f58229d72728',
 			'javax.inject:javax.inject:1:javax.inject-1.jar:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff',
 			'junit:junit:4.12:junit-4.12.jar:59721f0805e223d84b90677887d9ff567dc534d7c502ca903c0c2b17f05c116a',
+			'net.i2p.crypto:eddsa:0.2.0:eddsa-0.2.0.jar:a7cb1b85c16e2f0730b9204106929a1d9aaae1df728adc7041a8b8b605692140',
 			'org.apache.ant:ant-launcher:1.9.4:ant-launcher-1.9.4.jar:7bccea20b41801ca17bcbc909a78c835d0f443f12d639c77bd6ae3d05861608d',
 			'org.apache.ant:ant:1.9.4:ant-1.9.4.jar:649ae0730251de07b8913f49286d46bba7b92d47c5f332610aa426c4f02161d8',
 			'org.beanshell:bsh:1.3.0:bsh-1.3.0.jar:9b04edc75d19db54f1b4e8b5355e9364384c6cf71eb0a1b9724c159d779879f8',
 			'org.bitlet:weupnp:0.1.4:weupnp-0.1.4.jar:88df7e6504929d00bdb832863761385c68ab92af945b04f0770b126270a444fb',
 			'org.hamcrest:hamcrest-core:1.3:hamcrest-core-1.3.jar:66fdef91e9739348df7a096aa384a5685f4e875584cce89386a7a47251c4d8e9',
 			'org.hamcrest:hamcrest-library:1.3:hamcrest-library-1.3.jar:711d64522f9ec410983bd310934296da134be4254a125080a0416ec178dfad1c',
+			'org.hsqldb:hsqldb:2.3.5:hsqldb-2.3.5.jar:6676a6977ac98997a80f827ddbd3fe8ca1e0853dad1492512135fd1a222ccfad',
 			'org.jmock:jmock-junit4:2.8.2:jmock-junit4-2.8.2.jar:f7ee4df4f7bd7b7f1cafad3b99eb74d579f109d5992ff625347352edb55e674c',
 			'org.jmock:jmock-legacy:2.8.2:jmock-legacy-2.8.2.jar:f2b985a5c08a9edb7f37612330c058809da3f6a6d63ce792426ebf8ff0d6d31b',
 			'org.jmock:jmock-testjar:2.8.2:jmock-testjar-2.8.2.jar:8900860f72c474e027cf97fe78dcbf154a1aa7fc62b6845c5fb4e4f3c7bc8760',
 			'org.jmock:jmock:2.8.2:jmock-2.8.2.jar:6c73cb4a2e6dbfb61fd99c9a768539c170ab6568e57846bd60dbf19596b65b16',
 			'org.objenesis:objenesis:2.1:objenesis-2.1.jar:c74330cc6b806c804fd37e74487b4fe5d7c2750c5e15fbc6efa13bdee1bdef80',
 			'org.ow2.asm:asm:5.0.4:asm-5.0.4.jar:896618ed8ae62702521a78bc7be42b7c491a08e6920a15f89a3ecdec31e9a220',
+			'org.whispersystems:curve25519-java:0.4.1:curve25519-java-0.4.1.jar:7dd659d8822c06c3aea1a47f18fac9e5761e29cab8100030b877db445005f03e',
 	]
 }
 

bramble-core/src/main/java/org/briarproject/bramble/client/ClientHelperImpl.java

@@ -15,6 +15,8 @@ import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Metadata;
 import org.briarproject.bramble.api.db.Transaction;
+import org.briarproject.bramble.api.identity.Author;
+import org.briarproject.bramble.api.identity.AuthorFactory;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.GroupId;
 import org.briarproject.bramble.api.sync.Message;
@@ -32,7 +34,12 @@ import java.util.Map.Entry;
 import javax.annotation.concurrent.Immutable;
 import javax.inject.Inject;
 
+import static org.briarproject.bramble.api.identity.Author.FORMAT_VERSION;
+import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_AUTHOR_NAME_LENGTH;
+import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
 import static org.briarproject.bramble.api.sync.SyncConstants.MESSAGE_HEADER_LENGTH;
+import static org.briarproject.bramble.util.ValidationUtils.checkLength;
+import static org.briarproject.bramble.util.ValidationUtils.checkSize;
 
 @Immutable
 @NotNullByDefault
@@ -51,12 +58,14 @@ class ClientHelperImpl implements ClientHelper {
 	private final MetadataParser metadataParser;
 	private final MetadataEncoder metadataEncoder;
 	private final CryptoComponent crypto;
+	private final AuthorFactory authorFactory;
 
 	@Inject
 	ClientHelperImpl(DatabaseComponent db, MessageFactory messageFactory,
 			BdfReaderFactory bdfReaderFactory,
 			BdfWriterFactory bdfWriterFactory, MetadataParser metadataParser,
-			MetadataEncoder metadataEncoder, CryptoComponent crypto) {
+			MetadataEncoder metadataEncoder, CryptoComponent crypto,
+			AuthorFactory authorFactory) {
 		this.db = db;
 		this.messageFactory = messageFactory;
 		this.bdfReaderFactory = bdfReaderFactory;
@@ -64,6 +73,7 @@ class ClientHelperImpl implements ClientHelper {
 		this.metadataParser = metadataParser;
 		this.metadataEncoder = metadataEncoder;
 		this.crypto = crypto;
+		this.authorFactory = authorFactory;
 	}
 
 	@Override
@@ -341,6 +351,11 @@ class ClientHelperImpl implements ClientHelper {
 				raw.length - MESSAGE_HEADER_LENGTH);
 	}
 
+	@Override
+	public BdfList toList(Author a) {
+		return BdfList.of(a.getFormatVersion(), a.getName(), a.getPublicKey());
+	}
+
 	@Override
 	public byte[] sign(String label, BdfList toSign, byte[] privateKey)
 			throws FormatException, GeneralSecurityException {
@@ -355,4 +370,16 @@ class ClientHelperImpl implements ClientHelper {
 		}
 	}
 
+	@Override
+	public Author parseAndValidateAuthor(BdfList author)
+			throws FormatException {
+		checkSize(author, 3);
+		int formatVersion = author.getLong(0).intValue();
+		if (formatVersion != FORMAT_VERSION) throw new FormatException();
+		String name = author.getString(1);
+		checkLength(name, 1, MAX_AUTHOR_NAME_LENGTH);
+		byte[] publicKey = author.getRaw(2);
+		checkLength(publicKey, 1, MAX_PUBLIC_KEY_LENGTH);
+		return authorFactory.createAuthor(formatVersion, name, publicKey);
+	}
 }

bramble-core/src/main/java/org/briarproject/bramble/client/ClientModule.java

@@ -2,14 +2,6 @@ package org.briarproject.bramble.client;
 
 import org.briarproject.bramble.api.client.ClientHelper;
 import org.briarproject.bramble.api.client.ContactGroupFactory;
-import org.briarproject.bramble.api.crypto.CryptoComponent;
-import org.briarproject.bramble.api.data.BdfReaderFactory;
-import org.briarproject.bramble.api.data.BdfWriterFactory;
-import org.briarproject.bramble.api.data.MetadataEncoder;
-import org.briarproject.bramble.api.data.MetadataParser;
-import org.briarproject.bramble.api.db.DatabaseComponent;
-import org.briarproject.bramble.api.sync.GroupFactory;
-import org.briarproject.bramble.api.sync.MessageFactory;
 
 import dagger.Module;
 import dagger.Provides;
@@ -18,19 +10,14 @@ import dagger.Provides;
 public class ClientModule {
 
 	@Provides
-	ClientHelper provideClientHelper(DatabaseComponent db,
+	ClientHelper provideClientHelper(ClientHelperImpl clientHelper) {
-			MessageFactory messageFactory, BdfReaderFactory bdfReaderFactory,
+		return clientHelper;
-			BdfWriterFactory bdfWriterFactory, MetadataParser metadataParser,
-			MetadataEncoder metadataEncoder, CryptoComponent cryptoComponent) {
-		return new ClientHelperImpl(db, messageFactory, bdfReaderFactory,
-				bdfWriterFactory, metadataParser, metadataEncoder,
-				cryptoComponent);
 	}
 
 	@Provides
-	ContactGroupFactory provideContactGroupFactory(GroupFactory groupFactory,
+	ContactGroupFactory provideContactGroupFactory(
-			ClientHelper clientHelper) {
+			ContactGroupFactoryImpl contactGroupFactory) {
-		return new ContactGroupFactoryImpl(groupFactory, clientHelper);
+		return contactGroupFactory;
 	}
 
 }

bramble-core/src/main/java/org/briarproject/bramble/client/ContactGroupFactoryImpl.java

@@ -32,23 +32,25 @@ class ContactGroupFactoryImpl implements ContactGroupFactory {
 	}
 
 	@Override
-	public Group createLocalGroup(ClientId clientId) {
+	public Group createLocalGroup(ClientId clientId, int clientVersion) {
-		return groupFactory.createGroup(clientId, LOCAL_GROUP_DESCRIPTOR);
+		return groupFactory.createGroup(clientId, clientVersion,
+				LOCAL_GROUP_DESCRIPTOR);
 	}
 
 	@Override
-	public Group createContactGroup(ClientId clientId, Contact contact) {
+	public Group createContactGroup(ClientId clientId, int clientVersion,
+			Contact contact) {
 		AuthorId local = contact.getLocalAuthorId();
 		AuthorId remote = contact.getAuthor().getId();
 		byte[] descriptor = createGroupDescriptor(local, remote);
-		return groupFactory.createGroup(clientId, descriptor);
+		return groupFactory.createGroup(clientId, clientVersion, descriptor);
 	}
 
 	@Override
-	public Group createContactGroup(ClientId clientId, AuthorId authorId1,
+	public Group createContactGroup(ClientId clientId, int clientVersion,
-			AuthorId authorId2) {
+			AuthorId authorId1, AuthorId authorId2) {
 		byte[] descriptor = createGroupDescriptor(authorId1, authorId2);
-		return groupFactory.createGroup(clientId, descriptor);
+		return groupFactory.createGroup(clientId, clientVersion, descriptor);
 	}
 
 	private byte[] createGroupDescriptor(AuthorId local, AuthorId remote) {

bramble-core/src/main/java/org/briarproject/bramble/contact/ContactExchangeTaskImpl.java

@@ -43,6 +43,7 @@ import javax.inject.Inject;
 
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
+import static org.briarproject.bramble.api.identity.Author.FORMAT_VERSION;
 import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_AUTHOR_NAME_LENGTH;
 import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
 import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_SIGNATURE_LENGTH;
@@ -141,8 +142,10 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 		}
 
 		// Derive the header keys for the transport streams
-		SecretKey aliceHeaderKey = crypto.deriveHeaderKey(masterSecret, true);
+		SecretKey aliceHeaderKey = crypto.deriveKey(ALICE_KEY_LABEL,
-		SecretKey bobHeaderKey = crypto.deriveHeaderKey(masterSecret, false);
+				masterSecret, new byte[] {PROTOCOL_VERSION});
+		SecretKey bobHeaderKey = crypto.deriveKey(BOB_KEY_LABEL, masterSecret,
+				new byte[] {PROTOCOL_VERSION});
 
 		// Create the readers
 		InputStream streamReader =
@@ -156,8 +159,10 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 		BdfWriter w = bdfWriterFactory.createWriter(streamWriter);
 
 		// Derive the nonces to be signed
-		byte[] aliceNonce = crypto.deriveSignatureNonce(masterSecret, true);
+		byte[] aliceNonce = crypto.mac(ALICE_NONCE_LABEL, masterSecret,
-		byte[] bobNonce = crypto.deriveSignatureNonce(masterSecret, false);
+				new byte[] {PROTOCOL_VERSION});
+		byte[] bobNonce = crypto.mac(BOB_NONCE_LABEL, masterSecret,
+				new byte[] {PROTOCOL_VERSION});
 
 		// Exchange pseudonyms, signed nonces, and timestamps
 		long localTimestamp = clock.currentTimeMillis();
@@ -196,8 +201,8 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 
 		try {
 			// Add the contact
-			ContactId contactId = addContact(remoteAuthor, masterSecret,
+			ContactId contactId = addContact(remoteAuthor, timestamp,
-					timestamp, alice, remoteProperties);
+					remoteProperties);
 			// Reuse the connection as a transport connection
 			connectionManager.manageOutgoingConnection(contactId, transportId,
 					conn);
@@ -223,6 +228,7 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 
 		// Write the name, public key and signature
 		w.writeListStart();
+		w.writeLong(localAuthor.getFormatVersion());
 		w.writeString(localAuthor.getName());
 		w.writeRaw(localAuthor.getPublicKey());
 		w.writeRaw(sig);
@@ -232,11 +238,16 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 
 	private Author receivePseudonym(BdfReader r, byte[] nonce)
 			throws GeneralSecurityException, IOException {
-		// Read the name, public key and signature
+		// Read the format version, name, public key and signature
 		r.readListStart();
+		int formatVersion = (int) r.readLong();
+		if (formatVersion != FORMAT_VERSION) throw new FormatException();
 		String name = r.readString(MAX_AUTHOR_NAME_LENGTH);
+		if (name.isEmpty()) throw new FormatException();
 		byte[] publicKey = r.readRaw(MAX_PUBLIC_KEY_LENGTH);
+		if (publicKey.length == 0) throw new FormatException();
 		byte[] sig = r.readRaw(MAX_SIGNATURE_LENGTH);
+		if (sig.length == 0) throw new FormatException();
 		r.readListEnd();
 		LOG.info("Received pseudonym");
 		// Verify the signature
@@ -245,7 +256,7 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 				LOG.info("Invalid signature");
 			throw new GeneralSecurityException();
 		}
-		return authorFactory.createAuthor(name, publicKey);
+		return authorFactory.createAuthor(formatVersion, name, publicKey);
 	}
 
 	private void sendTimestamp(BdfWriter w, long timestamp)
@@ -294,15 +305,15 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 		return remote;
 	}
 
-	private ContactId addContact(Author remoteAuthor, SecretKey master,
+	private ContactId addContact(Author remoteAuthor, long timestamp,
-			long timestamp, boolean alice,
 			Map<TransportId, TransportProperties> remoteProperties)
 			throws DbException {
 		ContactId contactId;
 		Transaction txn = db.startTransaction(false);
 		try {
 			contactId = contactManager.addContact(txn, remoteAuthor,
-					localAuthor.getId(), master, timestamp, alice, true, true);
+					localAuthor.getId(), masterSecret, timestamp, alice,
+					true, true);
 			transportPropertyManager.addRemoteProperties(txn, contactId,
 					remoteProperties);
 			db.commitTransaction(txn);
@@ -312,8 +323,7 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
 		return contactId;
 	}
 
-	private void tryToClose(DuplexTransportConnection conn,
+	private void tryToClose(DuplexTransportConnection conn, boolean exception) {
-			boolean exception) {
 		try {
 			LOG.info("Closing connection");
 			conn.getReader().dispose(exception, true);

bramble-core/src/main/java/org/briarproject/bramble/crypto/Blake2sDigest.java

@@ -1,547 +0,0 @@
-package org.briarproject.bramble.crypto;
-
-/*
-  The BLAKE2 cryptographic hash function was designed by Jean-
-  Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian
-  Winnerlein.
-
-  Reference Implementation and Description can be found at: https://blake2.net/
-  RFC: https://tools.ietf.org/html/rfc7693
-
-  This implementation does not support the Tree Hashing Mode.
-
-  For unkeyed hashing, developers adapting BLAKE2 to ASN.1 - based
-  message formats SHOULD use the OID tree at x = 1.3.6.1.4.1.1722.12.2.
-
-         Algorithm     | Target | Collision | Hash | Hash ASN.1 |
-            Identifier |  Arch  |  Security |  nn  | OID Suffix |
-        ---------------+--------+-----------+------+------------+
-         id-blake2s128 | 32-bit |   2**64   |  16  |   x.2.4    |
-         id-blake2s160 | 32-bit |   2**80   |  20  |   x.2.5    |
-         id-blake2s224 | 32-bit |   2**112  |  28  |   x.2.7    |
-         id-blake2s256 | 32-bit |   2**128  |  32  |   x.2.8    |
-        ---------------+--------+-----------+------+------------+
-
-  Based on the BouncyCastle implementation of BLAKE2b. License:
-
-  Copyright (c) 2000 - 2015 The Legion of the Bouncy Castle Inc.
-  (http://www.bouncycastle.org)
-
-  Permission is hereby granted, free of charge, to any person obtaining a copy
-  of this software and associated documentation files (the "Software"), to deal
-  in the Software without restriction, including without limitation the rights
-  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-  copies of the Software, and to permit persons to whom the Software is
-  furnished to do so, subject to the following conditions:
-
-  The above copyright notice and this permission notice shall be included in
-  all copies or substantial portions of the Software.
-
-  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-  SOFTWARE.
- */
-
-import org.spongycastle.crypto.ExtendedDigest;
-import org.spongycastle.util.Arrays;
-
-/**
- * Implementation of the cryptographic hash function BLAKE2s.
- * <p/>
- * BLAKE2s offers a built-in keying mechanism to be used directly
- * for authentication ("Prefix-MAC") rather than a HMAC construction.
- * <p/>
- * BLAKE2s offers a built-in support for a salt for randomized hashing
- * and a personal string for defining a unique hash function for each application.
- * <p/>
- * BLAKE2s is optimized for 32-bit platforms and produces digests of any size
- * between 1 and 32 bytes.
- */
-public class Blake2sDigest implements ExtendedDigest {
-	/** BLAKE2s Initialization Vector **/
-	private static final int blake2s_IV[] =
-			// Produced from the square root of primes 2, 3, 5, 7, 11, 13, 17, 19.
-			// The same as SHA-256 IV.
-			{
-					0x6a09e667, 0xbb67ae85, 0x3c6ef372,
-					0xa54ff53a, 0x510e527f, 0x9b05688c,
-					0x1f83d9ab, 0x5be0cd19
-			};
-
-	/** Message word permutations **/
-	private static final byte[][] blake2s_sigma =
-			{
-					{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
-					{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
-					{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
-					{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
-					{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
-					{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
-					{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
-					{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
-					{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
-					{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }
-			};
-
-	private static final int ROUNDS = 10; // to use for Catenas H'
-	private static final int BLOCK_LENGTH_BYTES = 64;// bytes
-
-	// General parameters:
-	private int digestLength = 32; // 1- 32 bytes
-	private int keyLength = 0; // 0 - 32 bytes for keyed hashing for MAC
-	private byte[] salt = null;
-	private byte[] personalization = null;
-	private byte[] key = null;
-
-	// Tree hashing parameters:
-	// Because this class does not implement the Tree Hashing Mode,
-	// these parameters can be treated as constants (see init() function)
-	/*
-	 * private int fanout = 1; // 0-255
-	 * private int depth = 1; // 1 - 255
-	 * private int leafLength= 0;
-	 * private long nodeOffset = 0L;
-	 * private int nodeDepth = 0;
-	 * private int innerHashLength = 0;
-	 */
-
-	/**
-	 * Whenever this buffer overflows, it will be processed in the compress()
-	 * function. For performance issues, long messages will not use this buffer.
-	 */
-	private byte[] buffer = null;
-	/** Position of last inserted byte **/
-	private int bufferPos = 0;// a value from 0 up to BLOCK_LENGTH_BYTES
-
-	/** Internal state, in the BLAKE2 paper it is called v **/
-	private int[] internalState = new int[16];
-	/** State vector, in the BLAKE2 paper it is called h **/
-	private int[] chainValue = null;
-
-	// counter (counts bytes): Length up to 2^64 are supported
-	/** holds least significant bits of counter **/
-	private int t0 = 0;
-	/** holds most significant bits of counter **/
-	private int t1 = 0;
-	/** finalization flag, for last block: ~0 **/
-	private int f0 = 0;
-
-	// For Tree Hashing Mode, not used here:
-	// private long f1 = 0L; // finalization flag, for last node: ~0L
-
-	/**
-	 * BLAKE2s-256 for hashing.
-	 */
-	public Blake2sDigest() {
-		this(256);
-	}
-
-	public Blake2sDigest(Blake2sDigest digest) {
-		this.bufferPos = digest.bufferPos;
-		this.buffer = Arrays.clone(digest.buffer);
-		this.keyLength = digest.keyLength;
-		this.key = Arrays.clone(digest.key);
-		this.digestLength = digest.digestLength;
-		this.chainValue = Arrays.clone(digest.chainValue);
-		this.personalization = Arrays.clone(digest.personalization);
-	}
-
-	/**
-	 * BLAKE2s for hashing.
-	 *
-	 * @param digestBits the desired digest length in bits. Must be one of
-	 *                     [128, 160, 224, 256].
-	 */
-	public Blake2sDigest(int digestBits) {
-		if (digestBits != 128 && digestBits != 160 &&
-				digestBits != 224 && digestBits != 256) {
-			throw new IllegalArgumentException(
-					"BLAKE2s digest restricted to one of [128, 160, 224, 256]");
-		}
-		buffer = new byte[BLOCK_LENGTH_BYTES];
-		keyLength = 0;
-		digestLength = digestBits / 8;
-		init();
-	}
-
-	/**
-	 * BLAKE2s for authentication ("Prefix-MAC mode").
-	 * <p/>
-	 * After calling the doFinal() method, the key will remain to be used for
-	 * further computations of this instance. The key can be overwritten using
-	 * the clearKey() method.
-	 *
-	 * @param key a key up to 32 bytes or null
-	 */
-	public Blake2sDigest(byte[] key) {
-		buffer = new byte[BLOCK_LENGTH_BYTES];
-		if (key != null) {
-			if (key.length > 32) {
-				throw new IllegalArgumentException(
-						"Keys > 32 are not supported");
-			}
-			this.key = new byte[key.length];
-			System.arraycopy(key, 0, this.key, 0, key.length);
-
-			keyLength = key.length;
-			System.arraycopy(key, 0, buffer, 0, key.length);
-			bufferPos = BLOCK_LENGTH_BYTES; // zero padding
-		}
-		digestLength = 32;
-		init();
-	}
-
-	/**
-	 * BLAKE2s with key, required digest length, salt and personalization.
-	 * <p/>
-	 * After calling the doFinal() method, the key, the salt and the personal
-	 * string will remain and might be used for further computations with this
-	 * instance. The key can be overwritten using the clearKey() method, the
-	 * salt (pepper) can be overwritten using the clearSalt() method.
-	 *
-	 * @param key a key up to 32 bytes or null
-	 * @param digestBytes from 1 up to 32 bytes
-	 * @param salt 8 bytes or null
-	 * @param personalization 8 bytes or null
-	 */
-	public Blake2sDigest(byte[] key, int digestBytes, byte[] salt,
-			byte[] personalization) {
-		buffer = new byte[BLOCK_LENGTH_BYTES];
-		if (digestBytes < 1 || digestBytes > 32) {
-			throw new IllegalArgumentException(
-					"Invalid digest length (required: 1 - 32)");
-		}
-		digestLength = digestBytes;
-		if (salt != null) {
-			if (salt.length != 8) {
-				throw new IllegalArgumentException(
-						"Salt length must be exactly 8 bytes");
-			}
-			this.salt = new byte[8];
-			System.arraycopy(salt, 0, this.salt, 0, salt.length);
-		}
-		if (personalization != null) {
-			if (personalization.length != 8) {
-				throw new IllegalArgumentException(
-						"Personalization length must be exactly 8 bytes");
-			}
-			this.personalization = new byte[8];
-			System.arraycopy(personalization, 0, this.personalization, 0,
-					personalization.length);
-		}
-		if (key != null) {
-			if (key.length > 32) {
-				throw new IllegalArgumentException(
-						"Keys > 32 bytes are not supported");
-			}
-			this.key = new byte[key.length];
-			System.arraycopy(key, 0, this.key, 0, key.length);
-
-			keyLength = key.length;
-			System.arraycopy(key, 0, buffer, 0, key.length);
-			bufferPos = BLOCK_LENGTH_BYTES; // zero padding
-		}
-		init();
-	}
-
-	// initialize chainValue
-	private void init() {
-		if (chainValue == null) {
-			chainValue = new int[8];
-
-			chainValue[0] = blake2s_IV[0]
-					^ (digestLength | (keyLength << 8) | 0x1010000);
-			// 0x1010000 = ((fanout << 16) | (depth << 24));
-			// with fanout = 1; depth = 0;
-			chainValue[1] = blake2s_IV[1];// ^ leafLength; with leafLength = 0;
-			chainValue[2] = blake2s_IV[2];// ^ nodeOffset; with nodeOffset = 0;
-			chainValue[3] = blake2s_IV[3];// ^ ( (nodeOffset << 32) |
-			// (nodeDepth << 16) | (innerHashLength << 24) );
-			// with nodeDepth = 0; innerHashLength = 0;
-
-			chainValue[4] = blake2s_IV[4];
-			chainValue[5] = blake2s_IV[5];
-			if (salt != null) {
-				chainValue[4] ^= (bytes2int(salt, 0));
-				chainValue[5] ^= (bytes2int(salt, 4));
-			}
-
-			chainValue[6] = blake2s_IV[6];
-			chainValue[7] = blake2s_IV[7];
-			if (personalization != null) {
-				chainValue[6] ^= (bytes2int(personalization, 0));
-				chainValue[7] ^= (bytes2int(personalization, 4));
-			}
-		}
-	}
-
-	private void initializeInternalState() {
-		// initialize v:
-		System.arraycopy(chainValue, 0, internalState, 0, chainValue.length);
-		System.arraycopy(blake2s_IV, 0, internalState, chainValue.length, 4);
-		internalState[12] = t0 ^ blake2s_IV[4];
-		internalState[13] = t1 ^ blake2s_IV[5];
-		internalState[14] = f0 ^ blake2s_IV[6];
-		internalState[15] = blake2s_IV[7];// ^ f1 with f1 = 0
-	}
-
-	/**
-	 * Update the message digest with a single byte.
-	 *
-	 * @param b the input byte to be entered.
-	 */
-	public void update(byte b) {
-		int remainingLength; // left bytes of buffer
-
-		// process the buffer if full else add to buffer:
-		remainingLength = BLOCK_LENGTH_BYTES - bufferPos;
-		if (remainingLength == 0) { // full buffer
-			t0 += BLOCK_LENGTH_BYTES;
-			if (t0 == 0) { // if message > 2^32
-				t1++;
-			}
-			compress(buffer, 0);
-			Arrays.fill(buffer, (byte)0);// clear buffer
-			buffer[0] = b;
-			bufferPos = 1;
-		} else {
-			buffer[bufferPos] = b;
-			bufferPos++;
-		}
-	}
-
-	/**
-	 * Update the message digest with a block of bytes.
-	 *
-	 * @param message the byte array containing the data.
-	 * @param offset the offset into the byte array where the data starts.
-	 * @param len the length of the data.
-	 */
-	public void update(byte[] message, int offset, int len) {
-		if (message == null || len == 0)
-			return;
-
-		int remainingLength = 0; // left bytes of buffer
-
-		if (bufferPos != 0) { // commenced, incomplete buffer
-
-			// complete the buffer:
-			remainingLength = BLOCK_LENGTH_BYTES - bufferPos;
-			if (remainingLength < len) { // full buffer + at least 1 byte
-				System.arraycopy(message, offset, buffer, bufferPos,
-						remainingLength);
-				t0 += BLOCK_LENGTH_BYTES;
-				if (t0 == 0) { // if message > 2^32
-					t1++;
-				}
-				compress(buffer, 0);
-				bufferPos = 0;
-				Arrays.fill(buffer, (byte) 0);// clear buffer
-			} else {
-				System.arraycopy(message, offset, buffer, bufferPos, len);
-				bufferPos += len;
-				return;
-			}
-		}
-
-		// process blocks except last block (also if last block is full)
-		int messagePos;
-		int blockWiseLastPos = offset + len - BLOCK_LENGTH_BYTES;
-		for (messagePos = offset + remainingLength;
-				messagePos < blockWiseLastPos;
-				messagePos += BLOCK_LENGTH_BYTES) { // block wise 64 bytes
-			// without buffer:
-			t0 += BLOCK_LENGTH_BYTES;
-			if (t0 == 0) {
-				t1++;
-			}
-			compress(message, messagePos);
-		}
-
-		// fill the buffer with left bytes, this might be a full block
-		System.arraycopy(message, messagePos, buffer, 0, offset + len
-				- messagePos);
-		bufferPos += offset + len - messagePos;
-	}
-
-	/**
-	 * Close the digest, producing the final digest value. The doFinal() call
-	 * leaves the digest reset. Key, salt and personal string remain.
-	 *
-	 * @param out the array the digest is to be copied into.
-	 * @param outOffset the offset into the out array the digest is to start at.
-	 */
-	public int doFinal(byte[] out, int outOffset) {
-		f0 = 0xFFFFFFFF;
-		t0 += bufferPos;
-		// bufferPos may be < 64, so (t0 == 0) does not work
-		// for 2^32 < message length > 2^32 - 63
-		if ((t0 < 0) && (bufferPos > -t0)) {
-			t1++;
-		}
-		compress(buffer, 0);
-		Arrays.fill(buffer, (byte) 0);// Holds eventually the key if input is null
-		Arrays.fill(internalState, 0);
-
-		for (int i = 0; i < chainValue.length && (i * 4 < digestLength); i++) {
-			byte[] bytes = int2bytes(chainValue[i]);
-
-			if (i * 4 < digestLength - 4) {
-				System.arraycopy(bytes, 0, out, outOffset + i * 4, 4);
-			} else {
-				System.arraycopy(bytes, 0, out, outOffset + i * 4,
-						digestLength - (i * 4));
-			}
-		}
-
-		Arrays.fill(chainValue, 0);
-
-		reset();
-
-		return digestLength;
-	}
-
-	/**
-	 * Reset the digest back to its initial state. The key, the salt and the
-	 * personal string will remain for further computations.
-	 */
-	public void reset() {
-		bufferPos = 0;
-		f0 = 0;
-		t0 = 0;
-		t1 = 0;
-		chainValue = null;
-		if (key != null) {
-			Arrays.fill(buffer, (byte) 0);
-			System.arraycopy(key, 0, buffer, 0, key.length);
-			bufferPos = BLOCK_LENGTH_BYTES; // zero padding
-		}
-		init();
-	}
-
-	private void compress(byte[] message, int messagePos) {
-		initializeInternalState();
-
-		int[] m = new int[16];
-		for (int j = 0; j < 16; j++) {
-			m[j] = bytes2int(message, messagePos + j * 4);
-		}
-
-		for (int round = 0; round < ROUNDS; round++) {
-
-			// G apply to columns of internalState:m[blake2s_sigma[round][2 *
-			// blockPos]] /+1
-			G(m[blake2s_sigma[round][0]], m[blake2s_sigma[round][1]], 0, 4, 8,
-					12);
-			G(m[blake2s_sigma[round][2]], m[blake2s_sigma[round][3]], 1, 5, 9,
-					13);
-			G(m[blake2s_sigma[round][4]], m[blake2s_sigma[round][5]], 2, 6, 10,
-					14);
-			G(m[blake2s_sigma[round][6]], m[blake2s_sigma[round][7]], 3, 7, 11,
-					15);
-			// G apply to diagonals of internalState:
-			G(m[blake2s_sigma[round][8]], m[blake2s_sigma[round][9]], 0, 5, 10,
-					15);
-			G(m[blake2s_sigma[round][10]], m[blake2s_sigma[round][11]], 1, 6,
-					11, 12);
-			G(m[blake2s_sigma[round][12]], m[blake2s_sigma[round][13]], 2, 7,
-					8, 13);
-			G(m[blake2s_sigma[round][14]], m[blake2s_sigma[round][15]], 3, 4,
-					9, 14);
-		}
-
-		// update chain values:
-		for (int offset = 0; offset < chainValue.length; offset++) {
-			chainValue[offset] = chainValue[offset] ^ internalState[offset]
-					^ internalState[offset + 8];
-		}
-	}
-
-	private void G(int m1, int m2, int posA, int posB, int posC, int posD) {
-		internalState[posA] = internalState[posA] + internalState[posB] + m1;
-		internalState[posD] = rotr32(internalState[posD] ^ internalState[posA],
-				16);
-		internalState[posC] = internalState[posC] + internalState[posD];
-		internalState[posB] = rotr32(internalState[posB] ^ internalState[posC],
-				12);
-		internalState[posA] = internalState[posA] + internalState[posB] + m2;
-		internalState[posD] = rotr32(internalState[posD] ^ internalState[posA],
-				8);
-		internalState[posC] = internalState[posC] + internalState[posD];
-		internalState[posB] = rotr32(internalState[posB] ^ internalState[posC],
-				7);
-	}
-
-	private int rotr32(int x, int rot) {
-		return x >>> rot | (x << (32 - rot));
-	}
-
-	// convert one int value in byte array
-	// little-endian byte order!
-	private byte[] int2bytes(int intValue) {
-		return new byte[] {
-				(byte) intValue, (byte) (intValue >> 8),
-				(byte) (intValue >> 16), (byte) (intValue >> 24)
-		};
-	}
-
-	// little-endian byte order!
-	private int bytes2int(byte[] byteArray, int offset) {
-		return (((int) byteArray[offset] & 0xFF)
-				| (((int) byteArray[offset + 1] & 0xFF) << 8)
-				| (((int) byteArray[offset + 2] & 0xFF) << 16)
-				| (((int) byteArray[offset + 3] & 0xFF) << 24));
-	}
-
-	/**
-	 * Return the algorithm name.
-	 *
-	 * @return the algorithm name
-	 */
-	public String getAlgorithmName() {
-		return "BLAKE2s";
-	}
-
-	/**
-	 * Return the size in bytes of the digest produced by this message digest.
-	 *
-	 * @return the size in bytes of the digest produced by this message digest.
-	 */
-	public int getDigestSize() {
-		return digestLength;
-	}
-
-	/**
-	 * Return the size in bytes of the internal buffer the digest applies its
-	 * compression function to.
-	 *
-	 * @return byte length of the digest's internal buffer.
-	 */
-	public int getByteLength() {
-		return BLOCK_LENGTH_BYTES;
-	}
-
-	/**
-	 * Overwrite the key if it is no longer used (zeroization).
-	 */
-	public void clearKey() {
-		if (key != null) {
-			Arrays.fill(key, (byte) 0);
-			Arrays.fill(buffer,  (byte) 0);
-		}
-	}
-
-	/**
-	 * Overwrite the salt (pepper) if it is secret and no longer used
-	 * (zeroization).
-	 */
-	public void clearSalt() {
-		if (salt != null) {
-			Arrays.fill(salt, (byte) 0);
-		}
-	}
-}

bramble-core/src/main/java/org/briarproject/bramble/crypto/CryptoComponentImpl.java

@@ -1,107 +1,59 @@
 package org.briarproject.bramble.crypto;
 
+import net.i2p.crypto.eddsa.EdDSAPrivateKey;
+import net.i2p.crypto.eddsa.EdDSAPublicKey;
+import net.i2p.crypto.eddsa.KeyPairGenerator;
+
 import org.briarproject.bramble.api.crypto.CryptoComponent;
 import org.briarproject.bramble.api.crypto.KeyPair;
 import org.briarproject.bramble.api.crypto.KeyParser;
 import org.briarproject.bramble.api.crypto.PrivateKey;
 import org.briarproject.bramble.api.crypto.PublicKey;
 import org.briarproject.bramble.api.crypto.SecretKey;
-import org.briarproject.bramble.api.plugin.TransportId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.SecureRandomProvider;
-import org.briarproject.bramble.api.transport.IncomingKeys;
-import org.briarproject.bramble.api.transport.OutgoingKeys;
-import org.briarproject.bramble.api.transport.TransportKeys;
 import org.briarproject.bramble.util.ByteUtils;
 import org.briarproject.bramble.util.StringUtils;
-import org.spongycastle.crypto.AsymmetricCipherKeyPair;
-import org.spongycastle.crypto.CipherParameters;
 import org.spongycastle.crypto.CryptoException;
 import org.spongycastle.crypto.Digest;
-import org.spongycastle.crypto.agreement.ECDHCBasicAgreement;
+import org.spongycastle.crypto.digests.Blake2bDigest;
-import org.spongycastle.crypto.digests.SHA256Digest;
+import org.whispersystems.curve25519.Curve25519;
-import org.spongycastle.crypto.generators.ECKeyPairGenerator;
+import org.whispersystems.curve25519.Curve25519KeyPair;
-import org.spongycastle.crypto.generators.PKCS5S2ParametersGenerator;
-import org.spongycastle.crypto.params.ECKeyGenerationParameters;
-import org.spongycastle.crypto.params.ECPrivateKeyParameters;
-import org.spongycastle.crypto.params.ECPublicKeyParameters;
-import org.spongycastle.crypto.params.KeyParameter;
 
-import java.nio.charset.Charset;
 import java.security.GeneralSecurityException;
 import java.security.NoSuchAlgorithmException;
 import java.security.Provider;
 import java.security.SecureRandom;
 import java.security.Security;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
 import java.util.logging.Logger;
 
+import javax.annotation.Nullable;
 import javax.inject.Inject;
 
 import static java.util.logging.Level.INFO;
-import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.COMMIT_LENGTH;
-import static org.briarproject.bramble.api.transport.TransportConstants.TAG_LENGTH;
-import static org.briarproject.bramble.crypto.EllipticCurveConstants.PARAMETERS;
-import static org.briarproject.bramble.util.ByteUtils.INT_16_BYTES;
 import static org.briarproject.bramble.util.ByteUtils.INT_32_BYTES;
-import static org.briarproject.bramble.util.ByteUtils.INT_64_BYTES;
-import static org.briarproject.bramble.util.ByteUtils.MAX_16_BIT_UNSIGNED;
-import static org.briarproject.bramble.util.ByteUtils.MAX_32_BIT_UNSIGNED;
 
+@NotNullByDefault
 class CryptoComponentImpl implements CryptoComponent {
 
 	private static final Logger LOG =
 			Logger.getLogger(CryptoComponentImpl.class.getName());
 
-	private static final int AGREEMENT_KEY_PAIR_BITS = 256;
 	private static final int SIGNATURE_KEY_PAIR_BITS = 256;
 	private static final int STORAGE_IV_BYTES = 24; // 196 bits
 	private static final int PBKDF_SALT_BYTES = 32; // 256 bits
-	private static final int PBKDF_TARGET_MILLIS = 500;
+	private static final int PBKDF_FORMAT_SCRYPT = 0;
-	private static final int PBKDF_SAMPLES = 30;
-	private static final int HASH_SIZE = 256 / 8;
-
-	private static byte[] ascii(String s) {
-		return s.getBytes(Charset.forName("US-ASCII"));
-	}
-
-	// KDF labels for contact exchange stream header key derivation
-	private static final byte[] A_INVITE = ascii("ALICE_INVITATION_KEY");
-	private static final byte[] B_INVITE = ascii("BOB_INVITATION_KEY");
-	// KDF labels for contact exchange signature nonce derivation
-	private static final byte[] A_SIG_NONCE = ascii("ALICE_SIGNATURE_NONCE");
-	private static final byte[] B_SIG_NONCE = ascii("BOB_SIGNATURE_NONCE");
-	// Hash label for BQP public key commitment derivation
-	private static final String COMMIT =
-			"org.briarproject.bramble.COMMIT";
-	// Hash label for shared secret derivation
-	private static final String SHARED_SECRET =
-			"org.briarproject.bramble.SHARED_SECRET";
-	// KDF label for BQP confirmation key derivation
-	private static final byte[] CONFIRMATION_KEY = ascii("CONFIRMATION_KEY");
-	// KDF label for master key derivation
-	private static final byte[] MASTER_KEY = ascii("MASTER_KEY");
-	// KDF labels for tag key derivation
-	private static final byte[] A_TAG = ascii("ALICE_TAG_KEY");
-	private static final byte[] B_TAG = ascii("BOB_TAG_KEY");
-	// KDF labels for header key derivation
-	private static final byte[] A_HEADER = ascii("ALICE_HEADER_KEY");
-	private static final byte[] B_HEADER = ascii("BOB_HEADER_KEY");
-	// KDF labels for MAC key derivation
-	private static final byte[] A_MAC = ascii("ALICE_MAC_KEY");
-	private static final byte[] B_MAC = ascii("BOB_MAC_KEY");
-	// KDF label for key rotation
-	private static final byte[] ROTATE = ascii("ROTATE");
 
 	private final SecureRandom secureRandom;
-	private final ECKeyPairGenerator agreementKeyPairGenerator;
+	private final PasswordBasedKdf passwordBasedKdf;
-	private final ECKeyPairGenerator signatureKeyPairGenerator;
+	private final Curve25519 curve25519;
+	private final KeyPairGenerator signatureKeyPairGenerator;
 	private final KeyParser agreementKeyParser, signatureKeyParser;
 	private final MessageEncrypter messageEncrypter;
 
 	@Inject
-	CryptoComponentImpl(SecureRandomProvider secureRandomProvider) {
+	CryptoComponentImpl(SecureRandomProvider secureRandomProvider,
+			PasswordBasedKdf passwordBasedKdf) {
 		if (LOG.isLoggable(INFO)) {
 			SecureRandom defaultSecureRandom = new SecureRandom();
 			String name = defaultSecureRandom.getProvider().getName();
@@ -121,16 +73,13 @@ class CryptoComponentImpl implements CryptoComponent {
 			}
 		}
 		secureRandom = new SecureRandom();
-		ECKeyGenerationParameters params = new ECKeyGenerationParameters(
+		this.passwordBasedKdf = passwordBasedKdf;
-				PARAMETERS, secureRandom);
+		curve25519 = Curve25519.getInstance("java");
-		agreementKeyPairGenerator = new ECKeyPairGenerator();
+		signatureKeyPairGenerator = new KeyPairGenerator();
-		agreementKeyPairGenerator.init(params);
+		signatureKeyPairGenerator.initialize(SIGNATURE_KEY_PAIR_BITS,
-		signatureKeyPairGenerator = new ECKeyPairGenerator();
+				secureRandom);
-		signatureKeyPairGenerator.init(params);
+		agreementKeyParser = new Curve25519KeyParser();
-		agreementKeyParser = new Sec1KeyParser(PARAMETERS,
+		signatureKeyParser = new EdKeyParser();
-				AGREEMENT_KEY_PAIR_BITS);
-		signatureKeyParser = new Sec1KeyParser(PARAMETERS,
-				SIGNATURE_KEY_PAIR_BITS);
 		messageEncrypter = new MessageEncrypter(secureRandom);
 	}
 
@@ -174,16 +123,17 @@ class CryptoComponentImpl implements CryptoComponent {
 	// Package access for testing
 	byte[] performRawKeyAgreement(PrivateKey priv, PublicKey pub)
 			throws GeneralSecurityException {
-		if (!(priv instanceof Sec1PrivateKey))
+		if (!(priv instanceof Curve25519PrivateKey))
 			throw new IllegalArgumentException();
-		if (!(pub instanceof Sec1PublicKey))
+		if (!(pub instanceof Curve25519PublicKey))
 			throw new IllegalArgumentException();
-		ECPrivateKeyParameters ecPriv = ((Sec1PrivateKey) priv).getKey();
-		ECPublicKeyParameters ecPub = ((Sec1PublicKey) pub).getKey();
 		long now = System.currentTimeMillis();
-		ECDHCBasicAgreement agreement = new ECDHCBasicAgreement();
+		byte[] secret = curve25519.calculateAgreement(pub.getEncoded(),
-		agreement.init(ecPriv);
+				priv.getEncoded());
-		byte[] secret = agreement.calculateAgreement(ecPub).toByteArray();
+		// If the shared secret is all zeroes, the public key is invalid
+		byte allZero = 0;
+		for (byte b : secret) allZero |= b;
+		if (allZero == 0) throw new GeneralSecurityException();
 		long duration = System.currentTimeMillis() - now;
 		if (LOG.isLoggable(INFO))
 			LOG.info("Deriving shared secret took " + duration + " ms");
@@ -192,18 +142,10 @@ class CryptoComponentImpl implements CryptoComponent {
 
 	@Override
 	public KeyPair generateAgreementKeyPair() {
-		AsymmetricCipherKeyPair keyPair =
+		Curve25519KeyPair keyPair = curve25519.generateKeyPair();
-				agreementKeyPairGenerator.generateKeyPair();
+		PublicKey pub = new Curve25519PublicKey(keyPair.getPublicKey());
-		// Return a wrapper that uses the SEC 1 encoding
+		PrivateKey priv = new Curve25519PrivateKey(keyPair.getPrivateKey());
-		ECPublicKeyParameters ecPublicKey =
+		return new KeyPair(pub, priv);
-				(ECPublicKeyParameters) keyPair.getPublic();
-		PublicKey publicKey = new Sec1PublicKey(ecPublicKey
-		);
-		ECPrivateKeyParameters ecPrivateKey =
-				(ECPrivateKeyParameters) keyPair.getPrivate();
-		PrivateKey privateKey = new Sec1PrivateKey(ecPrivateKey,
-				AGREEMENT_KEY_PAIR_BITS);
-		return new KeyPair(publicKey, privateKey);
 	}
 
 	@Override
@@ -213,17 +155,12 @@ class CryptoComponentImpl implements CryptoComponent {
 
 	@Override
 	public KeyPair generateSignatureKeyPair() {
-		AsymmetricCipherKeyPair keyPair =
+		java.security.KeyPair keyPair =
 				signatureKeyPairGenerator.generateKeyPair();
-		// Return a wrapper that uses the SEC 1 encoding
+		EdDSAPublicKey edPublicKey = (EdDSAPublicKey) keyPair.getPublic();
-		ECPublicKeyParameters ecPublicKey =
+		PublicKey publicKey = new EdPublicKey(edPublicKey.getAbyte());
-				(ECPublicKeyParameters) keyPair.getPublic();
+		EdDSAPrivateKey edPrivateKey = (EdDSAPrivateKey) keyPair.getPrivate();
-		PublicKey publicKey = new Sec1PublicKey(ecPublicKey
+		PrivateKey privateKey = new EdPrivateKey(edPrivateKey.getSeed());
-		);
-		ECPrivateKeyParameters ecPrivateKey =
-				(ECPrivateKeyParameters) keyPair.getPrivate();
-		PrivateKey privateKey = new Sec1PrivateKey(ecPrivateKey,
-				SIGNATURE_KEY_PAIR_BITS);
 		return new KeyPair(publicKey, privateKey);
 	}
 
@@ -238,205 +175,47 @@ class CryptoComponentImpl implements CryptoComponent {
 	}
 
 	@Override
-	public SecretKey deriveHeaderKey(SecretKey master,
+	public SecretKey deriveKey(String label, SecretKey k, byte[]... inputs) {
-			boolean alice) {
+		byte[] mac = mac(label, k, inputs);
-		return new SecretKey(macKdf(master, alice ? A_INVITE : B_INVITE));
+		if (mac.length != SecretKey.LENGTH) throw new IllegalStateException();
+		return new SecretKey(mac);
 	}
 
 	@Override
-	public SecretKey deriveMacKey(SecretKey master, boolean alice) {
+	public SecretKey deriveSharedSecret(String label, PublicKey theirPublicKey,
-		return new SecretKey(macKdf(master, alice ? A_MAC : B_MAC));
+			KeyPair ourKeyPair, byte[]... inputs)
-	}
+			throws GeneralSecurityException {
-
-	@Override
-	public byte[] deriveSignatureNonce(SecretKey master,
-			boolean alice) {
-		return macKdf(master, alice ? A_SIG_NONCE : B_SIG_NONCE);
-	}
-
-	@Override
-	public byte[] deriveKeyCommitment(byte[] publicKey) {
-		byte[] hash = hash(COMMIT, publicKey);
-		// The output is the first COMMIT_LENGTH bytes of the hash
-		byte[] commitment = new byte[COMMIT_LENGTH];
-		System.arraycopy(hash, 0, commitment, 0, COMMIT_LENGTH);
-		return commitment;
-	}
-
-	@Override
-	public SecretKey deriveSharedSecret(byte[] theirPublicKey,
-			KeyPair ourKeyPair, boolean alice) throws GeneralSecurityException {
 		PrivateKey ourPriv = ourKeyPair.getPrivate();
-		PublicKey theirPub = agreementKeyParser.parsePublicKey(theirPublicKey);
+		byte[][] hashInputs = new byte[inputs.length + 1][];
-		byte[] raw = performRawKeyAgreement(ourPriv, theirPub);
+		hashInputs[0] = performRawKeyAgreement(ourPriv, theirPublicKey);
-		byte[] alicePub, bobPub;
+		System.arraycopy(inputs, 0, hashInputs, 1, inputs.length);
-		if (alice) {
+		byte[] hash = hash(label, hashInputs);
-			alicePub = ourKeyPair.getPublic().getEncoded();
+		if (hash.length != SecretKey.LENGTH) throw new IllegalStateException();
-			bobPub = theirPublicKey;
+		return new SecretKey(hash);
-		} else {
-			alicePub = theirPublicKey;
-			bobPub = ourKeyPair.getPublic().getEncoded();
-		}
-		return new SecretKey(hash(SHARED_SECRET, raw, alicePub, bobPub));
-	}
-
-	@Override
-	public byte[] deriveConfirmationRecord(SecretKey sharedSecret,
-			byte[] theirPayload, byte[] ourPayload, byte[] theirPublicKey,
-			KeyPair ourKeyPair, boolean alice, boolean aliceRecord) {
-		SecretKey ck = new SecretKey(macKdf(sharedSecret, CONFIRMATION_KEY));
-		byte[] alicePayload, alicePub, bobPayload, bobPub;
-		if (alice) {
-			alicePayload = ourPayload;
-			alicePub = ourKeyPair.getPublic().getEncoded();
-			bobPayload = theirPayload;
-			bobPub = theirPublicKey;
-		} else {
-			alicePayload = theirPayload;
-			alicePub = theirPublicKey;
-			bobPayload = ourPayload;
-			bobPub = ourKeyPair.getPublic().getEncoded();
-		}
-		if (aliceRecord)
-			return macKdf(ck, alicePayload, alicePub, bobPayload, bobPub);
-		else
-			return macKdf(ck, bobPayload, bobPub, alicePayload, alicePub);
-	}
-
-	@Override
-	public SecretKey deriveMasterSecret(SecretKey sharedSecret) {
-		return new SecretKey(macKdf(sharedSecret, MASTER_KEY));
-	}
-
-	@Override
-	public SecretKey deriveMasterSecret(byte[] theirPublicKey,
-			KeyPair ourKeyPair, boolean alice) throws GeneralSecurityException {
-		return deriveMasterSecret(deriveSharedSecret(
-				theirPublicKey, ourKeyPair, alice));
-	}
-
-	@Override
-	public TransportKeys deriveTransportKeys(TransportId t,
-			SecretKey master, long rotationPeriod, boolean alice) {
-		// Keys for the previous period are derived from the master secret
-		SecretKey inTagPrev = deriveTagKey(master, t, !alice);
-		SecretKey inHeaderPrev = deriveHeaderKey(master, t, !alice);
-		SecretKey outTagPrev = deriveTagKey(master, t, alice);
-		SecretKey outHeaderPrev = deriveHeaderKey(master, t, alice);
-		// Derive the keys for the current and next periods
-		SecretKey inTagCurr = rotateKey(inTagPrev, rotationPeriod);
-		SecretKey inHeaderCurr = rotateKey(inHeaderPrev, rotationPeriod);
-		SecretKey inTagNext = rotateKey(inTagCurr, rotationPeriod + 1);
-		SecretKey inHeaderNext = rotateKey(inHeaderCurr, rotationPeriod + 1);
-		SecretKey outTagCurr = rotateKey(outTagPrev, rotationPeriod);
-		SecretKey outHeaderCurr = rotateKey(outHeaderPrev, rotationPeriod);
-		// Initialise the reordering windows and stream counters
-		IncomingKeys inPrev = new IncomingKeys(inTagPrev, inHeaderPrev,
-				rotationPeriod - 1);
-		IncomingKeys inCurr = new IncomingKeys(inTagCurr, inHeaderCurr,
-				rotationPeriod);
-		IncomingKeys inNext = new IncomingKeys(inTagNext, inHeaderNext,
-				rotationPeriod + 1);
-		OutgoingKeys outCurr = new OutgoingKeys(outTagCurr, outHeaderCurr,
-				rotationPeriod);
-		// Collect and return the keys
-		return new TransportKeys(t, inPrev, inCurr, inNext, outCurr);
-	}
-
-	@Override
-	public TransportKeys rotateTransportKeys(TransportKeys k,
-			long rotationPeriod) {
-		if (k.getRotationPeriod() >= rotationPeriod) return k;
-		IncomingKeys inPrev = k.getPreviousIncomingKeys();
-		IncomingKeys inCurr = k.getCurrentIncomingKeys();
-		IncomingKeys inNext = k.getNextIncomingKeys();
-		OutgoingKeys outCurr = k.getCurrentOutgoingKeys();
-		long startPeriod = outCurr.getRotationPeriod();
-		// Rotate the keys
-		for (long p = startPeriod + 1; p <= rotationPeriod; p++) {
-			inPrev = inCurr;
-			inCurr = inNext;
-			SecretKey inNextTag = rotateKey(inNext.getTagKey(), p + 1);
-			SecretKey inNextHeader = rotateKey(inNext.getHeaderKey(), p + 1);
-			inNext = new IncomingKeys(inNextTag, inNextHeader, p + 1);
-			SecretKey outCurrTag = rotateKey(outCurr.getTagKey(), p);
-			SecretKey outCurrHeader = rotateKey(outCurr.getHeaderKey(), p);
-			outCurr = new OutgoingKeys(outCurrTag, outCurrHeader, p);
-		}
-		// Collect and return the keys
-		return new TransportKeys(k.getTransportId(), inPrev, inCurr, inNext,
-				outCurr);
-	}
-
-	private SecretKey rotateKey(SecretKey k, long rotationPeriod) {
-		byte[] period = new byte[INT_64_BYTES];
-		ByteUtils.writeUint64(rotationPeriod, period, 0);
-		return new SecretKey(macKdf(k, ROTATE, period));
-	}
-
-	private SecretKey deriveTagKey(SecretKey master, TransportId t,
-			boolean alice) {
-		byte[] id = StringUtils.toUtf8(t.getString());
-		return new SecretKey(macKdf(master, alice ? A_TAG : B_TAG, id));
-	}
-
-	private SecretKey deriveHeaderKey(SecretKey master, TransportId t,
-			boolean alice) {
-		byte[] id = StringUtils.toUtf8(t.getString());
-		return new SecretKey(macKdf(master, alice ? A_HEADER : B_HEADER, id));
-	}
-
-	@Override
-	public void encodeTag(byte[] tag, SecretKey tagKey, int protocolVersion,
-			long streamNumber) {
-		if (tag.length < TAG_LENGTH) throw new IllegalArgumentException();
-		if (protocolVersion < 0 || protocolVersion > MAX_16_BIT_UNSIGNED)
-			throw new IllegalArgumentException();
-		if (streamNumber < 0 || streamNumber > MAX_32_BIT_UNSIGNED)
-			throw new IllegalArgumentException();
-		// Initialise the PRF
-		Digest prf = new Blake2sDigest(tagKey.getBytes());
-		// The output of the PRF must be long enough to use as a tag
-		int macLength = prf.getDigestSize();
-		if (macLength < TAG_LENGTH) throw new IllegalStateException();
-		// The input is the protocol version as a 16-bit integer, followed by
-		// the stream number as a 64-bit integer
-		byte[] protocolVersionBytes = new byte[INT_16_BYTES];
-		ByteUtils.writeUint16(protocolVersion, protocolVersionBytes, 0);
-		prf.update(protocolVersionBytes, 0, protocolVersionBytes.length);
-		byte[] streamNumberBytes = new byte[INT_64_BYTES];
-		ByteUtils.writeUint64(streamNumber, streamNumberBytes, 0);
-		prf.update(streamNumberBytes, 0, streamNumberBytes.length);
-		byte[] mac = new byte[macLength];
-		prf.doFinal(mac, 0);
-		// The output is the first TAG_LENGTH bytes of the MAC
-		System.arraycopy(mac, 0, tag, 0, TAG_LENGTH);
 	}
 
 	@Override
 	public byte[] sign(String label, byte[] toSign, byte[] privateKey)
 			throws GeneralSecurityException {
-		Signature signature = new SignatureImpl(secureRandom);
+		PrivateKey key = signatureKeyParser.parsePrivateKey(privateKey);
-		KeyParser keyParser = getSignatureKeyParser();
+		Signature sig = new EdSignature();
-		PrivateKey key = keyParser.parsePrivateKey(privateKey);
+		sig.initSign(key);
-		signature.initSign(key);
+		updateSignature(sig, label, toSign);
-		updateSignature(signature, label, toSign);
+		return sig.sign();
-		return signature.sign();
 	}
 
 	@Override
 	public boolean verify(String label, byte[] signedData, byte[] publicKey,
 			byte[] signature) throws GeneralSecurityException {
-		Signature sig = new SignatureImpl(secureRandom);
+		PublicKey key = signatureKeyParser.parsePublicKey(publicKey);
-		KeyParser keyParser = getSignatureKeyParser();
+		Signature sig = new EdSignature();
-		PublicKey key = keyParser.parsePublicKey(publicKey);
 		sig.initVerify(key);
 		updateSignature(sig, label, signedData);
 		return sig.verify(signature);
 	}
 
 	private void updateSignature(Signature signature, String label,
-			byte[] toSign) {
+			byte[] toSign) throws GeneralSecurityException {
 		byte[] labelBytes = StringUtils.toUtf8(label);
 		byte[] length = new byte[INT_32_BYTES];
 		ByteUtils.writeUint32(labelBytes.length, length, 0);
@@ -450,7 +229,7 @@ class CryptoComponentImpl implements CryptoComponent {
 	@Override
 	public byte[] hash(String label, byte[]... inputs) {
 		byte[] labelBytes = StringUtils.toUtf8(label);
-		Digest digest = new Blake2sDigest();
+		Digest digest = new Blake2bDigest(256);
 		byte[] length = new byte[INT_32_BYTES];
 		ByteUtils.writeUint32(labelBytes.length, length, 0);
 		digest.update(length, 0, length.length);
@@ -466,14 +245,13 @@ class CryptoComponentImpl implements CryptoComponent {
 	}
 
 	@Override
-	public int getHashLength() {
+	public byte[] mac(String label, SecretKey macKey, byte[]... inputs) {
-		return HASH_SIZE;
+		byte[] labelBytes = StringUtils.toUtf8(label);
-	}
+		Digest mac = new Blake2bDigest(macKey.getBytes(), 32, null, null);
-
-	@Override
-	public byte[] mac(SecretKey macKey, byte[]... inputs) {
-		Digest mac = new Blake2sDigest(macKey.getBytes());
 		byte[] length = new byte[INT_32_BYTES];
+		ByteUtils.writeUint32(labelBytes.length, length, 0);
+		mac.update(length, 0, length.length);
+		mac.update(labelBytes, 0, labelBytes.length);
 		for (byte[] input : inputs) {
 			ByteUtils.writeUint32(input.length, length, 0);
 			mac.update(length, 0, length.length);
@@ -492,23 +270,33 @@ class CryptoComponentImpl implements CryptoComponent {
 		byte[] salt = new byte[PBKDF_SALT_BYTES];
 		secureRandom.nextBytes(salt);
 		// Calibrate the KDF
-		int iterations = chooseIterationCount(PBKDF_TARGET_MILLIS);
+		int cost = passwordBasedKdf.chooseCostParameter();
 		// Derive the key from the password
-		SecretKey key = new SecretKey(pbkdf2(password, salt, iterations));
+		SecretKey key = passwordBasedKdf.deriveKey(password, salt, cost);
 		// Generate a random IV
 		byte[] iv = new byte[STORAGE_IV_BYTES];
 		secureRandom.nextBytes(iv);
-		// The output contains the salt, iterations, IV, ciphertext and MAC
+		// The output contains the format version, salt, cost parameter, IV,
-		int outputLen = salt.length + INT_32_BYTES + iv.length + input.length
+		// ciphertext and MAC
-				+ macBytes;
+		int outputLen = 1 + salt.length + INT_32_BYTES + iv.length
+				+ input.length + macBytes;
 		byte[] output = new byte[outputLen];
-		System.arraycopy(salt, 0, output, 0, salt.length);
+		int outputOff = 0;
-		ByteUtils.writeUint32(iterations, output, salt.length);
+		// Format version
-		System.arraycopy(iv, 0, output, salt.length + INT_32_BYTES, iv.length);
+		output[outputOff] = PBKDF_FORMAT_SCRYPT;
+		outputOff++;
+		// Salt
+		System.arraycopy(salt, 0, output, outputOff, salt.length);
+		outputOff += salt.length;
+		// Cost parameter
+		ByteUtils.writeUint32(cost, output, outputOff);
+		outputOff += INT_32_BYTES;
+		// IV
+		System.arraycopy(iv, 0, output, outputOff, iv.length);
+		outputOff += iv.length;
 		// Initialise the cipher and encrypt the plaintext
 		try {
 			cipher.init(true, key, iv);
-			int outputOff = salt.length + INT_32_BYTES + iv.length;
 			cipher.process(input, 0, input.length, output, outputOff);
 			return output;
 		} catch (GeneralSecurityException e) {
@@ -517,22 +305,36 @@ class CryptoComponentImpl implements CryptoComponent {
 	}
 
 	@Override
+	@Nullable
 	public byte[] decryptWithPassword(byte[] input, String password) {
 		AuthenticatedCipher cipher = new XSalsa20Poly1305AuthenticatedCipher();
 		int macBytes = cipher.getMacBytes();
-		// The input contains the salt, iterations, IV, ciphertext and MAC
+		// The input contains the format version, salt, cost parameter, IV,
-		if (input.length < PBKDF_SALT_BYTES + INT_32_BYTES + STORAGE_IV_BYTES
+		// ciphertext and MAC
-				+ macBytes)
+		if (input.length < 1 + PBKDF_SALT_BYTES + INT_32_BYTES
+				+ STORAGE_IV_BYTES + macBytes)
 			return null; // Invalid input
+		int inputOff = 0;
+		// Format version
+		byte formatVersion = input[inputOff];
+		inputOff++;
+		if (formatVersion != PBKDF_FORMAT_SCRYPT)
+			return null; // Unknown format
+		// Salt
 		byte[] salt = new byte[PBKDF_SALT_BYTES];
-		System.arraycopy(input, 0, salt, 0, salt.length);
+		System.arraycopy(input, inputOff, salt, 0, salt.length);
-		long iterations = ByteUtils.readUint32(input, salt.length);
+		inputOff += salt.length;
-		if (iterations < 0 || iterations > Integer.MAX_VALUE)
+		// Cost parameter
-			return null; // Invalid iteration count
+		long cost = ByteUtils.readUint32(input, inputOff);
+		inputOff += INT_32_BYTES;
+		if (cost < 2 || cost > Integer.MAX_VALUE)
+			return null; // Invalid cost parameter
+		// IV
 		byte[] iv = new byte[STORAGE_IV_BYTES];
-		System.arraycopy(input, salt.length + INT_32_BYTES, iv, 0, iv.length);
+		System.arraycopy(input, inputOff, iv, 0, iv.length);
+		inputOff += iv.length;
 		// Derive the key from the password
-		SecretKey key = new SecretKey(pbkdf2(password, salt, (int) iterations));
+		SecretKey key = passwordBasedKdf.deriveKey(password, salt, (int) cost);
 		// Initialise the cipher
 		try {
 			cipher.init(false, key, iv);
@@ -541,7 +343,6 @@ class CryptoComponentImpl implements CryptoComponent {
 		}
 		// Try to decrypt the ciphertext (may be invalid)
 		try {
-			int inputOff = salt.length + INT_32_BYTES + iv.length;
 			int inputLen = input.length - inputOff;
 			byte[] output = new byte[inputLen - macBytes];
 			cipher.process(input, inputOff, inputLen, output, 0);
@@ -564,88 +365,4 @@ class CryptoComponentImpl implements CryptoComponent {
 	public String asciiArmour(byte[] b, int lineLength) {
 		return AsciiArmour.wrap(b, lineLength);
 	}
-
-	// Key derivation function based on a pseudo-random function - see
-	// NIST SP 800-108, section 5.1
-	private byte[] macKdf(SecretKey key, byte[]... inputs) {
-		// Initialise the PRF
-		Digest prf = new Blake2sDigest(key.getBytes());
-		// The output of the PRF must be long enough to use as a key
-		int macLength = prf.getDigestSize();
-		if (macLength < SecretKey.LENGTH) throw new IllegalStateException();
-		// Calculate the PRF over the concatenated length-prefixed inputs
-		byte[] length = new byte[INT_32_BYTES];
-		for (byte[] input : inputs) {
-			ByteUtils.writeUint32(input.length, length, 0);
-			prf.update(length, 0, length.length);
-			prf.update(input, 0, input.length);
-		}
-		byte[] mac = new byte[macLength];
-		prf.doFinal(mac, 0);
-		// The output is the first SecretKey.LENGTH bytes of the MAC
-		if (mac.length == SecretKey.LENGTH) return mac;
-		byte[] truncated = new byte[SecretKey.LENGTH];
-		System.arraycopy(mac, 0, truncated, 0, truncated.length);
-		return truncated;
-	}
-
-	// Password-based key derivation function - see PKCS#5 v2.1, section 5.2
-	private byte[] pbkdf2(String password, byte[] salt, int iterations) {
-		byte[] utf8 = StringUtils.toUtf8(password);
-		Digest digest = new SHA256Digest();
-		PKCS5S2ParametersGenerator gen = new PKCS5S2ParametersGenerator(digest);
-		gen.init(utf8, salt, iterations);
-		int keyLengthInBits = SecretKey.LENGTH * 8;
-		CipherParameters p = gen.generateDerivedParameters(keyLengthInBits);
-		return ((KeyParameter) p).getKey();
-	}
-
-	// Package access for testing
-	int chooseIterationCount(int targetMillis) {
-		List<Long> quickSamples = new ArrayList<>(PBKDF_SAMPLES);
-		List<Long> slowSamples = new ArrayList<>(PBKDF_SAMPLES);
-		long iterationNanos = 0, initNanos = 0;
-		while (iterationNanos <= 0 || initNanos <= 0) {
-			// Sample the running time with one iteration and two iterations
-			for (int i = 0; i < PBKDF_SAMPLES; i++) {
-				quickSamples.add(sampleRunningTime(1));
-				slowSamples.add(sampleRunningTime(2));
-			}
-			// Calculate the iteration time and the initialisation time
-			long quickMedian = median(quickSamples);
-			long slowMedian = median(slowSamples);
-			iterationNanos = slowMedian - quickMedian;
-			initNanos = quickMedian - iterationNanos;
-			if (LOG.isLoggable(INFO)) {
-				LOG.info("Init: " + initNanos + ", iteration: "
-						+ iterationNanos);
-			}
-		}
-		long targetNanos = targetMillis * 1000L * 1000L;
-		long iterations = (targetNanos - initNanos) / iterationNanos;
-		if (LOG.isLoggable(INFO)) LOG.info("Target iterations: " + iterations);
-		if (iterations < 1) return 1;
-		if (iterations > Integer.MAX_VALUE) return Integer.MAX_VALUE;
-		return (int) iterations;
-	}
-
-	private long sampleRunningTime(int iterations) {
-		byte[] password = {'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
-		byte[] salt = new byte[PBKDF_SALT_BYTES];
-		int keyLengthInBits = SecretKey.LENGTH * 8;
-		long start = System.nanoTime();
-		Digest digest = new SHA256Digest();
-		PKCS5S2ParametersGenerator gen = new PKCS5S2ParametersGenerator(digest);
-		gen.init(password, salt, iterations);
-		gen.generateDerivedParameters(keyLengthInBits);
-		return System.nanoTime() - start;
-	}
-
-	private long median(List<Long> list) {
-		int size = list.size();
-		if (size == 0) throw new IllegalArgumentException();
-		Collections.sort(list);
-		if (size % 2 == 1) return list.get(size / 2);
-		return list.get(size / 2 - 1) + list.get(size / 2) / 2;
-	}
 }

bramble-core/src/main/java/org/briarproject/bramble/crypto/CryptoModule.java

@@ -3,9 +3,11 @@ package org.briarproject.bramble.crypto;
 import org.briarproject.bramble.TimeLoggingExecutor;
 import org.briarproject.bramble.api.crypto.CryptoComponent;
 import org.briarproject.bramble.api.crypto.CryptoExecutor;
+import org.briarproject.bramble.api.crypto.KeyAgreementCrypto;
 import org.briarproject.bramble.api.crypto.PasswordStrengthEstimator;
 import org.briarproject.bramble.api.crypto.StreamDecrypterFactory;
 import org.briarproject.bramble.api.crypto.StreamEncrypterFactory;
+import org.briarproject.bramble.api.crypto.TransportCrypto;
 import org.briarproject.bramble.api.lifecycle.LifecycleManager;
 import org.briarproject.bramble.api.system.SecureRandomProvider;
 
@@ -65,8 +67,9 @@ public class CryptoModule {
 	@Provides
 	@Singleton
 	CryptoComponent provideCryptoComponent(
-			SecureRandomProvider secureRandomProvider) {
+			SecureRandomProvider secureRandomProvider,
-		return new CryptoComponentImpl(secureRandomProvider);
+			ScryptKdf passwordBasedKdf) {
+		return new CryptoComponentImpl(secureRandomProvider, passwordBasedKdf);
 	}
 
 	@Provides
@@ -74,6 +77,12 @@ public class CryptoModule {
 		return new PasswordStrengthEstimatorImpl();
 	}
 
+	@Provides
+	TransportCrypto provideTransportCrypto(
+			TransportCryptoImpl transportCrypto) {
+		return transportCrypto;
+	}
+
 	@Provides
 	StreamDecrypterFactory provideStreamDecrypterFactory(
 			Provider<AuthenticatedCipher> cipherProvider) {
@@ -81,9 +90,17 @@ public class CryptoModule {
 	}
 
 	@Provides
-	StreamEncrypterFactory provideStreamEncrypterFactory(CryptoComponent crypto,
+	StreamEncrypterFactory provideStreamEncrypterFactory(
+			CryptoComponent crypto, TransportCrypto transportCrypto,
 			Provider<AuthenticatedCipher> cipherProvider) {
-		return new StreamEncrypterFactoryImpl(crypto, cipherProvider);
+		return new StreamEncrypterFactoryImpl(crypto, transportCrypto,
+				cipherProvider);
+	}
+
+	@Provides
+	KeyAgreementCrypto provideKeyAgreementCrypto(
+			KeyAgreementCryptoImpl keyAgreementCrypto) {
+		return keyAgreementCrypto;
 	}
 
 	@Provides

bramble-core/src/main/java/org/briarproject/bramble/crypto/Curve25519KeyParser.java

@@ -0,0 +1,35 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.crypto.KeyParser;
+import org.briarproject.bramble.api.crypto.PrivateKey;
+import org.briarproject.bramble.api.crypto.PublicKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.security.GeneralSecurityException;
+
+@NotNullByDefault
+class Curve25519KeyParser implements KeyParser {
+
+	@Override
+	public PublicKey parsePublicKey(byte[] encodedKey)
+			throws GeneralSecurityException {
+		if (encodedKey.length != 32) throw new GeneralSecurityException();
+		return new Curve25519PublicKey(encodedKey);
+	}
+
+	@Override
+	public PrivateKey parsePrivateKey(byte[] encodedKey)
+			throws GeneralSecurityException {
+		if (encodedKey.length != 32) throw new GeneralSecurityException();
+		return new Curve25519PrivateKey(clamp(encodedKey));
+	}
+
+	static byte[] clamp(byte[] b) {
+		byte[] clamped = new byte[32];
+		System.arraycopy(b, 0, clamped, 0, 32);
+		clamped[0] &= 248;
+		clamped[31] &= 127;
+		clamped[31] |= 64;
+		return clamped;
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/Curve25519PrivateKey.java

@@ -0,0 +1,18 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.Bytes;
+import org.briarproject.bramble.api.crypto.PrivateKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+class Curve25519PrivateKey extends Bytes implements PrivateKey {
+
+	Curve25519PrivateKey(byte[] bytes) {
+		super(bytes);
+	}
+
+	@Override
+	public byte[] getEncoded() {
+		return getBytes();
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/Curve25519PublicKey.java

@@ -0,0 +1,18 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.Bytes;
+import org.briarproject.bramble.api.crypto.PublicKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+class Curve25519PublicKey extends Bytes implements PublicKey {
+
+	Curve25519PublicKey(byte[] bytes) {
+		super(bytes);
+	}
+
+	@Override
+	public byte[] getEncoded() {
+		return getBytes();
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/EdKeyParser.java

@@ -0,0 +1,26 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.crypto.KeyParser;
+import org.briarproject.bramble.api.crypto.PrivateKey;
+import org.briarproject.bramble.api.crypto.PublicKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.security.GeneralSecurityException;
+
+@NotNullByDefault
+class EdKeyParser implements KeyParser {
+
+	@Override
+	public PublicKey parsePublicKey(byte[] encodedKey)
+			throws GeneralSecurityException {
+		if (encodedKey.length != 32) throw new GeneralSecurityException();
+		return new EdPublicKey(encodedKey);
+	}
+
+	@Override
+	public PrivateKey parsePrivateKey(byte[] encodedKey)
+			throws GeneralSecurityException {
+		if (encodedKey.length != 32) throw new GeneralSecurityException();
+		return new EdPrivateKey(encodedKey);
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/EdPrivateKey.java

@@ -0,0 +1,18 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.Bytes;
+import org.briarproject.bramble.api.crypto.PrivateKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+class EdPrivateKey extends Bytes implements PrivateKey {
+
+	EdPrivateKey(byte[] bytes) {
+		super(bytes);
+	}
+
+	@Override
+	public byte[] getEncoded() {
+		return getBytes();
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/EdPublicKey.java

@@ -0,0 +1,18 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.Bytes;
+import org.briarproject.bramble.api.crypto.PublicKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+class EdPublicKey extends Bytes implements PublicKey {
+
+	EdPublicKey(byte[] bytes) {
+		super(bytes);
+	}
+
+	@Override
+	public byte[] getEncoded() {
+		return getBytes();
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/EdSignature.java

@@ -0,0 +1,83 @@
+package org.briarproject.bramble.crypto;
+
+import net.i2p.crypto.eddsa.EdDSAPrivateKey;
+import net.i2p.crypto.eddsa.EdDSAPublicKey;
+import net.i2p.crypto.eddsa.EdDSASecurityProvider;
+import net.i2p.crypto.eddsa.spec.EdDSANamedCurveSpec;
+import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable;
+import net.i2p.crypto.eddsa.spec.EdDSAPrivateKeySpec;
+import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec;
+
+import org.briarproject.bramble.api.crypto.PrivateKey;
+import org.briarproject.bramble.api.crypto.PublicKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.security.GeneralSecurityException;
+import java.security.NoSuchAlgorithmException;
+import java.security.Provider;
+
+import static net.i2p.crypto.eddsa.EdDSAEngine.SIGNATURE_ALGORITHM;
+
+@NotNullByDefault
+class EdSignature implements Signature {
+
+	private static final Provider PROVIDER = new EdDSASecurityProvider();
+
+	private static final EdDSANamedCurveSpec CURVE_SPEC =
+			EdDSANamedCurveTable.getByName("Ed25519");
+
+	private final java.security.Signature signature;
+
+	EdSignature() {
+		try {
+			signature = java.security.Signature
+					.getInstance(SIGNATURE_ALGORITHM, PROVIDER);
+		} catch (NoSuchAlgorithmException e) {
+			throw new AssertionError(e);
+		}
+	}
+
+	@Override
+	public void initSign(PrivateKey k) throws GeneralSecurityException {
+		if (!(k instanceof EdPrivateKey))
+			throw new IllegalArgumentException();
+		EdDSAPrivateKey privateKey = new EdDSAPrivateKey(
+				new EdDSAPrivateKeySpec(k.getEncoded(), CURVE_SPEC));
+		signature.initSign(privateKey);
+	}
+
+	@Override
+	public void initVerify(PublicKey k) throws GeneralSecurityException {
+		if (!(k instanceof EdPublicKey))
+			throw new IllegalArgumentException();
+		EdDSAPublicKey publicKey = new EdDSAPublicKey(
+				new EdDSAPublicKeySpec(k.getEncoded(), CURVE_SPEC));
+		signature.initVerify(publicKey);
+	}
+
+	@Override
+	public void update(byte b) throws GeneralSecurityException {
+		signature.update(b);
+	}
+
+	@Override
+	public void update(byte[] b) throws GeneralSecurityException {
+		signature.update(b);
+	}
+
+	@Override
+	public void update(byte[] b, int off, int len)
+			throws GeneralSecurityException {
+		signature.update(b, off, len);
+	}
+
+	@Override
+	public byte[] sign() throws GeneralSecurityException {
+		return signature.sign();
+	}
+
+	@Override
+	public boolean verify(byte[] sig) throws GeneralSecurityException {
+		return signature.verify(sig);
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/EllipticCurveConstants.java

@@ -1,32 +0,0 @@
-package org.briarproject.bramble.crypto;
-
-import org.spongycastle.asn1.teletrust.TeleTrusTNamedCurves;
-import org.spongycastle.asn1.x9.X9ECParameters;
-import org.spongycastle.crypto.params.ECDomainParameters;
-import org.spongycastle.math.ec.ECCurve;
-import org.spongycastle.math.ec.ECMultiplier;
-import org.spongycastle.math.ec.ECPoint;
-import org.spongycastle.math.ec.MontgomeryLadderMultiplier;
-
-import java.math.BigInteger;
-
-/**
- * Parameters for curve brainpoolp256r1 - see RFC 5639.
- */
-class EllipticCurveConstants {
-
-	static final ECDomainParameters PARAMETERS;
-
-	static {
-		// Start with the default implementation of the curve
-		X9ECParameters x9 = TeleTrusTNamedCurves.getByName("brainpoolp256r1");
-		// Use a constant-time multiplier
-		ECMultiplier monty = new MontgomeryLadderMultiplier();
-		ECCurve curve = x9.getCurve().configure().setMultiplier(monty).create();
-		BigInteger gX = x9.getG().getAffineXCoord().toBigInteger();
-		BigInteger gY = x9.getG().getAffineYCoord().toBigInteger();
-		ECPoint g = curve.createPoint(gX, gY);
-		// Convert to ECDomainParameters using the new multiplier
-		PARAMETERS = new ECDomainParameters(curve, g, x9.getN(), x9.getH());
-	}
-}

bramble-core/src/main/java/org/briarproject/bramble/crypto/KeyAgreementCryptoImpl.java

@@ -0,0 +1,56 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.crypto.CryptoComponent;
+import org.briarproject.bramble.api.crypto.KeyAgreementCrypto;
+import org.briarproject.bramble.api.crypto.KeyPair;
+import org.briarproject.bramble.api.crypto.PublicKey;
+import org.briarproject.bramble.api.crypto.SecretKey;
+
+import javax.inject.Inject;
+
+import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.COMMIT_LENGTH;
+
+class KeyAgreementCryptoImpl implements KeyAgreementCrypto {
+
+	private final CryptoComponent crypto;
+
+	@Inject
+	KeyAgreementCryptoImpl(CryptoComponent crypto) {
+		this.crypto = crypto;
+	}
+
+	@Override
+	public byte[] deriveKeyCommitment(PublicKey publicKey) {
+		byte[] hash = crypto.hash(COMMIT_LABEL, publicKey.getEncoded());
+		// The output is the first COMMIT_LENGTH bytes of the hash
+		byte[] commitment = new byte[COMMIT_LENGTH];
+		System.arraycopy(hash, 0, commitment, 0, COMMIT_LENGTH);
+		return commitment;
+	}
+
+	@Override
+	public byte[] deriveConfirmationRecord(SecretKey sharedSecret,
+			byte[] theirPayload, byte[] ourPayload, PublicKey theirPublicKey,
+			KeyPair ourKeyPair, boolean alice, boolean aliceRecord) {
+		SecretKey ck = crypto.deriveKey(CONFIRMATION_KEY_LABEL, sharedSecret);
+		byte[] alicePayload, alicePub, bobPayload, bobPub;
+		if (alice) {
+			alicePayload = ourPayload;
+			alicePub = ourKeyPair.getPublic().getEncoded();
+			bobPayload = theirPayload;
+			bobPub = theirPublicKey.getEncoded();
+		} else {
+			alicePayload = theirPayload;
+			alicePub = theirPublicKey.getEncoded();
+			bobPayload = ourPayload;
+			bobPub = ourKeyPair.getPublic().getEncoded();
+		}
+		if (aliceRecord) {
+			return crypto.mac(CONFIRMATION_MAC_LABEL, ck, alicePayload,
+					alicePub, bobPayload, bobPub);
+		} else {
+			return crypto.mac(CONFIRMATION_MAC_LABEL, ck, bobPayload, bobPub,
+					alicePayload, alicePub);
+		}
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/PasswordBasedKdf.java

@@ -0,0 +1,10 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.crypto.SecretKey;
+
+interface PasswordBasedKdf {
+
+	int chooseCostParameter();
+
+	SecretKey deriveKey(String password, byte[] salt, int cost);
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/ScryptKdf.java

@@ -0,0 +1,62 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.crypto.SecretKey;
+import org.briarproject.bramble.api.system.Clock;
+import org.briarproject.bramble.util.StringUtils;
+import org.spongycastle.crypto.generators.SCrypt;
+
+import java.util.logging.Logger;
+
+import javax.inject.Inject;
+
+import static java.util.logging.Level.INFO;
+
+class ScryptKdf implements PasswordBasedKdf {
+
+	private static final Logger LOG =
+			Logger.getLogger(ScryptKdf.class.getName());
+
+	private static final int MIN_COST = 256; // Min parameter N
+	private static final int MAX_COST = 1024 * 1024; // Max parameter N
+	private static final int BLOCK_SIZE = 8; // Parameter r
+	private static final int PARALLELIZATION = 1; // Parameter p
+	private static final int TARGET_MS = 1000;
+
+	private final Clock clock;
+
+	@Inject
+	ScryptKdf(Clock clock) {
+		this.clock = clock;
+	}
+
+	@Override
+	public int chooseCostParameter() {
+		// Increase the cost from min to max while measuring performance
+		int cost = MIN_COST;
+		while (cost * 2 <= MAX_COST && measureDuration(cost) * 2 <= TARGET_MS)
+			cost *= 2;
+		if (LOG.isLoggable(INFO))
+			LOG.info("KDF cost parameter " + cost);
+		return cost;
+	}
+
+	private long measureDuration(int cost) {
+		byte[] password = new byte[16], salt = new byte[32];
+		long start = clock.currentTimeMillis();
+		SCrypt.generate(password, salt, cost, BLOCK_SIZE, PARALLELIZATION,
+				SecretKey.LENGTH);
+		return clock.currentTimeMillis() - start;
+	}
+
+	@Override
+	public SecretKey deriveKey(String password, byte[] salt, int cost) {
+		long start = System.currentTimeMillis();
+		byte[] passwordBytes = StringUtils.toUtf8(password);
+		SecretKey k = new SecretKey(SCrypt.generate(passwordBytes, salt, cost,
+				BLOCK_SIZE, PARALLELIZATION, SecretKey.LENGTH));
+		long duration = System.currentTimeMillis() - start;
+		if (LOG.isLoggable(INFO))
+			LOG.info("Deriving key from password took " + duration + " ms");
+		return k;
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/crypto/Signature.java

@@ -22,25 +22,25 @@ interface Signature {
 	/**
 	 * @see {@link java.security.Signature#update(byte)}
 	 */
-	void update(byte b);
+	void update(byte b) throws GeneralSecurityException;
 
 	/**
 	 * @see {@link java.security.Signature#update(byte[])}
 	 */
-	void update(byte[] b);
+	void update(byte[] b) throws GeneralSecurityException;
 
 	/**
 	 * @see {@link java.security.Signature#update(byte[], int, int)}
 	 */
-	void update(byte[] b, int off, int len);
+	void update(byte[] b, int off, int len) throws GeneralSecurityException;
 
 	/**
 	 * @see {@link java.security.Signature#sign()}
 	 */
-	byte[] sign();
+	byte[] sign() throws GeneralSecurityException;
 
 	/**
 	 * @see {@link java.security.Signature#verify(byte[])}
 	 */
-	boolean verify(byte[] signature);
+	boolean verify(byte[] signature) throws GeneralSecurityException;
 }

bramble-core/src/main/java/org/briarproject/bramble/crypto/SignatureImpl.java

@@ -1,90 +0,0 @@
-package org.briarproject.bramble.crypto;
-
-import org.briarproject.bramble.api.crypto.PrivateKey;
-import org.briarproject.bramble.api.crypto.PublicKey;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.spongycastle.crypto.Digest;
-import org.spongycastle.crypto.params.ECPrivateKeyParameters;
-import org.spongycastle.crypto.params.ECPublicKeyParameters;
-import org.spongycastle.crypto.params.ParametersWithRandom;
-import org.spongycastle.crypto.signers.DSADigestSigner;
-import org.spongycastle.crypto.signers.DSAKCalculator;
-import org.spongycastle.crypto.signers.ECDSASigner;
-import org.spongycastle.crypto.signers.HMacDSAKCalculator;
-
-import java.security.GeneralSecurityException;
-import java.security.SecureRandom;
-import java.util.logging.Logger;
-
-import javax.annotation.concurrent.NotThreadSafe;
-
-import static java.util.logging.Level.INFO;
-
-@NotThreadSafe
-@NotNullByDefault
-class SignatureImpl implements Signature {
-
-	private static final Logger LOG =
-			Logger.getLogger(SignatureImpl.class.getName());
-
-	private final SecureRandom secureRandom;
-	private final DSADigestSigner signer;
-
-	SignatureImpl(SecureRandom secureRandom) {
-		this.secureRandom = secureRandom;
-		Digest digest = new Blake2sDigest();
-		DSAKCalculator calculator = new HMacDSAKCalculator(digest);
-		signer = new DSADigestSigner(new ECDSASigner(calculator), digest);
-	}
-
-	@Override
-	public void initSign(PrivateKey k) throws GeneralSecurityException {
-		if (!(k instanceof Sec1PrivateKey))
-			throw new IllegalArgumentException();
-		ECPrivateKeyParameters priv = ((Sec1PrivateKey) k).getKey();
-		signer.init(true, new ParametersWithRandom(priv, secureRandom));
-	}
-
-	@Override
-	public void initVerify(PublicKey k) throws GeneralSecurityException {
-		if (!(k instanceof Sec1PublicKey))
-			throw new IllegalArgumentException();
-		ECPublicKeyParameters pub = ((Sec1PublicKey) k).getKey();
-		signer.init(false, pub);
-	}
-
-	@Override
-	public void update(byte b) {
-		signer.update(b);
-	}
-
-	@Override
-	public void update(byte[] b) {
-		update(b, 0, b.length);
-	}
-
-	@Override
-	public void update(byte[] b, int off, int len) {
-		signer.update(b, off, len);
-	}
-
-	@Override
-	public byte[] sign() {
-		long now = System.currentTimeMillis();
-		byte[] signature = signer.generateSignature();
-		long duration = System.currentTimeMillis() - now;
-		if (LOG.isLoggable(INFO))
-			LOG.info("Generating signature took " + duration + " ms");
-		return signature;
-	}
-
-	@Override
-	public boolean verify(byte[] signature) {
-		long now = System.currentTimeMillis();
-		boolean valid = signer.verifySignature(signature);
-		long duration = System.currentTimeMillis() - now;
-		if (LOG.isLoggable(INFO))
-			LOG.info("Verifying signature took " + duration + " ms");
-		return valid;
-	}
-}

bramble-core/src/main/java/org/briarproject/bramble/crypto/StreamEncrypterFactoryImpl.java

@@ -4,6 +4,7 @@ import org.briarproject.bramble.api.crypto.CryptoComponent;
 import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.crypto.StreamEncrypter;
 import org.briarproject.bramble.api.crypto.StreamEncrypterFactory;
+import org.briarproject.bramble.api.crypto.TransportCrypto;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.transport.StreamContext;
 
@@ -22,12 +23,15 @@ import static org.briarproject.bramble.api.transport.TransportConstants.TAG_LENG
 class StreamEncrypterFactoryImpl implements StreamEncrypterFactory {
 
 	private final CryptoComponent crypto;
+	private final TransportCrypto transportCrypto;
 	private final Provider<AuthenticatedCipher> cipherProvider;
 
 	@Inject
 	StreamEncrypterFactoryImpl(CryptoComponent crypto,
+			TransportCrypto transportCrypto,
 			Provider<AuthenticatedCipher> cipherProvider) {
 		this.crypto = crypto;
+		this.transportCrypto = transportCrypto;
 		this.cipherProvider = cipherProvider;
 	}
 
@@ -37,7 +41,8 @@ class StreamEncrypterFactoryImpl implements StreamEncrypterFactory {
 		AuthenticatedCipher cipher = cipherProvider.get();
 		long streamNumber = ctx.getStreamNumber();
 		byte[] tag = new byte[TAG_LENGTH];
-		crypto.encodeTag(tag, ctx.getTagKey(), PROTOCOL_VERSION, streamNumber);
+		transportCrypto.encodeTag(tag, ctx.getTagKey(), PROTOCOL_VERSION,
+				streamNumber);
 		byte[] streamHeaderNonce = new byte[STREAM_HEADER_NONCE_LENGTH];
 		crypto.getSecureRandom().nextBytes(streamHeaderNonce);
 		SecretKey frameKey = crypto.generateSecretKey();

bramble-core/src/main/java/org/briarproject/bramble/crypto/TransportCryptoImpl.java

@@ -0,0 +1,136 @@
+package org.briarproject.bramble.crypto;
+
+import org.briarproject.bramble.api.crypto.CryptoComponent;
+import org.briarproject.bramble.api.crypto.SecretKey;
+import org.briarproject.bramble.api.crypto.TransportCrypto;
+import org.briarproject.bramble.api.plugin.TransportId;
+import org.briarproject.bramble.api.transport.IncomingKeys;
+import org.briarproject.bramble.api.transport.OutgoingKeys;
+import org.briarproject.bramble.api.transport.TransportKeys;
+import org.briarproject.bramble.util.ByteUtils;
+import org.briarproject.bramble.util.StringUtils;
+import org.spongycastle.crypto.Digest;
+import org.spongycastle.crypto.digests.Blake2bDigest;
+
+import javax.inject.Inject;
+
+import static org.briarproject.bramble.api.transport.TransportConstants.ALICE_HEADER_LABEL;
+import static org.briarproject.bramble.api.transport.TransportConstants.ALICE_TAG_LABEL;
+import static org.briarproject.bramble.api.transport.TransportConstants.BOB_HEADER_LABEL;
+import static org.briarproject.bramble.api.transport.TransportConstants.BOB_TAG_LABEL;
+import static org.briarproject.bramble.api.transport.TransportConstants.ROTATE_LABEL;
+import static org.briarproject.bramble.api.transport.TransportConstants.TAG_LENGTH;
+import static org.briarproject.bramble.util.ByteUtils.INT_16_BYTES;
+import static org.briarproject.bramble.util.ByteUtils.INT_64_BYTES;
+import static org.briarproject.bramble.util.ByteUtils.MAX_16_BIT_UNSIGNED;
+import static org.briarproject.bramble.util.ByteUtils.MAX_32_BIT_UNSIGNED;
+
+class TransportCryptoImpl implements TransportCrypto {
+
+	private final CryptoComponent crypto;
+
+	@Inject
+	TransportCryptoImpl(CryptoComponent crypto) {
+		this.crypto = crypto;
+	}
+
+	@Override
+	public TransportKeys deriveTransportKeys(TransportId t,
+			SecretKey master, long rotationPeriod, boolean alice) {
+		// Keys for the previous period are derived from the master secret
+		SecretKey inTagPrev = deriveTagKey(master, t, !alice);
+		SecretKey inHeaderPrev = deriveHeaderKey(master, t, !alice);
+		SecretKey outTagPrev = deriveTagKey(master, t, alice);
+		SecretKey outHeaderPrev = deriveHeaderKey(master, t, alice);
+		// Derive the keys for the current and next periods
+		SecretKey inTagCurr = rotateKey(inTagPrev, rotationPeriod);
+		SecretKey inHeaderCurr = rotateKey(inHeaderPrev, rotationPeriod);
+		SecretKey inTagNext = rotateKey(inTagCurr, rotationPeriod + 1);
+		SecretKey inHeaderNext = rotateKey(inHeaderCurr, rotationPeriod + 1);
+		SecretKey outTagCurr = rotateKey(outTagPrev, rotationPeriod);
+		SecretKey outHeaderCurr = rotateKey(outHeaderPrev, rotationPeriod);
+		// Initialise the reordering windows and stream counters
+		IncomingKeys inPrev = new IncomingKeys(inTagPrev, inHeaderPrev,
+				rotationPeriod - 1);
+		IncomingKeys inCurr = new IncomingKeys(inTagCurr, inHeaderCurr,
+				rotationPeriod);
+		IncomingKeys inNext = new IncomingKeys(inTagNext, inHeaderNext,
+				rotationPeriod + 1);
+		OutgoingKeys outCurr = new OutgoingKeys(outTagCurr, outHeaderCurr,
+				rotationPeriod);
+		// Collect and return the keys
+		return new TransportKeys(t, inPrev, inCurr, inNext, outCurr);
+	}
+
+	@Override
+	public TransportKeys rotateTransportKeys(TransportKeys k,
+			long rotationPeriod) {
+		if (k.getRotationPeriod() >= rotationPeriod) return k;
+		IncomingKeys inPrev = k.getPreviousIncomingKeys();
+		IncomingKeys inCurr = k.getCurrentIncomingKeys();
+		IncomingKeys inNext = k.getNextIncomingKeys();
+		OutgoingKeys outCurr = k.getCurrentOutgoingKeys();
+		long startPeriod = outCurr.getRotationPeriod();
+		// Rotate the keys
+		for (long p = startPeriod + 1; p <= rotationPeriod; p++) {
+			inPrev = inCurr;
+			inCurr = inNext;
+			SecretKey inNextTag = rotateKey(inNext.getTagKey(), p + 1);
+			SecretKey inNextHeader = rotateKey(inNext.getHeaderKey(), p + 1);
+			inNext = new IncomingKeys(inNextTag, inNextHeader, p + 1);
+			SecretKey outCurrTag = rotateKey(outCurr.getTagKey(), p);
+			SecretKey outCurrHeader = rotateKey(outCurr.getHeaderKey(), p);
+			outCurr = new OutgoingKeys(outCurrTag, outCurrHeader, p);
+		}
+		// Collect and return the keys
+		return new TransportKeys(k.getTransportId(), inPrev, inCurr, inNext,
+				outCurr);
+	}
+
+	private SecretKey rotateKey(SecretKey k, long rotationPeriod) {
+		byte[] period = new byte[INT_64_BYTES];
+		ByteUtils.writeUint64(rotationPeriod, period, 0);
+		return crypto.deriveKey(ROTATE_LABEL, k, period);
+	}
+
+	private SecretKey deriveTagKey(SecretKey master, TransportId t,
+			boolean alice) {
+		String label = alice ? ALICE_TAG_LABEL : BOB_TAG_LABEL;
+		byte[] id = StringUtils.toUtf8(t.getString());
+		return crypto.deriveKey(label, master, id);
+	}
+
+	private SecretKey deriveHeaderKey(SecretKey master, TransportId t,
+			boolean alice) {
+		String label = alice ? ALICE_HEADER_LABEL : BOB_HEADER_LABEL;
+		byte[] id = StringUtils.toUtf8(t.getString());
+		return crypto.deriveKey(label, master, id);
+	}
+
+	@Override
+	public void encodeTag(byte[] tag, SecretKey tagKey, int protocolVersion,
+			long streamNumber) {
+		if (tag.length < TAG_LENGTH) throw new IllegalArgumentException();
+		if (protocolVersion < 0 || protocolVersion > MAX_16_BIT_UNSIGNED)
+			throw new IllegalArgumentException();
+		if (streamNumber < 0 || streamNumber > MAX_32_BIT_UNSIGNED)
+			throw new IllegalArgumentException();
+		// Initialise the PRF
+		Digest prf = new Blake2bDigest(tagKey.getBytes(), 32, null, null);
+		// The output of the PRF must be long enough to use as a tag
+		int macLength = prf.getDigestSize();
+		if (macLength < TAG_LENGTH) throw new IllegalStateException();
+		// The input is the protocol version as a 16-bit integer, followed by
+		// the stream number as a 64-bit integer
+		byte[] protocolVersionBytes = new byte[INT_16_BYTES];
+		ByteUtils.writeUint16(protocolVersion, protocolVersionBytes, 0);
+		prf.update(protocolVersionBytes, 0, protocolVersionBytes.length);
+		byte[] streamNumberBytes = new byte[INT_64_BYTES];
+		ByteUtils.writeUint64(streamNumber, streamNumberBytes, 0);
+		prf.update(streamNumberBytes, 0, streamNumberBytes.length);
+		byte[] mac = new byte[macLength];
+		prf.doFinal(mac, 0);
+		// The output is the first TAG_LENGTH bytes of the MAC
+		System.arraycopy(mac, 0, tag, 0, TAG_LENGTH);
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/db/Database.java

@@ -6,7 +6,6 @@ import org.briarproject.bramble.api.db.DataTooNewException;
 import org.briarproject.bramble.api.db.DataTooOldException;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Metadata;
-import org.briarproject.bramble.api.db.MigrationListener;
 import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.identity.AuthorId;
 import org.briarproject.bramble.api.identity.LocalAuthor;
@@ -46,7 +45,7 @@ interface Database<T> {
 	 * @throws DataTooOldException if the data uses an older schema than the
 	 * current code and cannot be migrated
 	 */
-	boolean open(@Nullable MigrationListener listener) throws DbException;
+	boolean open() throws DbException;
 
 	/**
 	 * Prevents new transactions from starting, waits for all current
@@ -424,27 +423,31 @@ interface Database<T> {
 			throws DbException;
 
 	/**
-	 * Returns the IDs of any messages that need to be validated.
+	 * Returns the IDs of any messages that need to be validated by the given
+	 * client.
 	 * <p/>
 	 * Read-only.
 	 */
-	Collection<MessageId> getMessagesToValidate(T txn) throws DbException;
+	Collection<MessageId> getMessagesToValidate(T txn, ClientId c)
+			throws DbException;
 
 	/**
-	 * Returns the IDs of any messages that are pending delivery due to
+	 * Returns the IDs of any messages that are still pending due to
-	 * dependencies on other messages.
+	 * dependencies to other messages for the given client.
 	 * <p/>
 	 * Read-only.
 	 */
-	Collection<MessageId> getPendingMessages(T txn) throws DbException;
+	Collection<MessageId> getPendingMessages(T txn, ClientId c)
+			throws DbException;
 
 	/**
-	 * Returns the IDs of any messages that have a shared dependent but have
+	 * Returns the IDs of any messages from the given client
-	 * not yet been shared themselves.
+	 * that have a shared dependent, but are still not shared themselves.
 	 * <p/>
 	 * Read-only.
 	 */
-	Collection<MessageId> getMessagesToShare(T txn) throws DbException;
+	Collection<MessageId> getMessagesToShare(T txn, ClientId c)
+			throws DbException;
 
 	/**
 	 * Returns the next time (in milliseconds since the Unix epoch) when a

bramble-core/src/main/java/org/briarproject/bramble/db/DatabaseComponentImpl.java

@@ -10,7 +10,6 @@ import org.briarproject.bramble.api.db.ContactExistsException;
 import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Metadata;
-import org.briarproject.bramble.api.db.MigrationListener;
 import org.briarproject.bramble.api.db.NoSuchContactException;
 import org.briarproject.bramble.api.db.NoSuchGroupException;
 import org.briarproject.bramble.api.db.NoSuchLocalAuthorException;
@@ -101,9 +100,8 @@ class DatabaseComponentImpl<T> implements DatabaseComponent {
 	}
 
 	@Override
-	public boolean open(@Nullable MigrationListener listener)
+	public boolean open() throws DbException {
-			throws DbException {
+		boolean reopened = db.open();
-		boolean reopened = db.open(listener);
 		shutdown.addShutdownHook(() -> {
 			try {
 				close();
@@ -455,24 +453,24 @@ class DatabaseComponentImpl<T> implements DatabaseComponent {
 	}
 
 	@Override
-	public Collection<MessageId> getMessagesToValidate(Transaction transaction)
+	public Collection<MessageId> getMessagesToValidate(Transaction transaction,
-			throws DbException {
+			ClientId c) throws DbException {
 		T txn = unbox(transaction);
-		return db.getMessagesToValidate(txn);
+		return db.getMessagesToValidate(txn, c);
 	}
 
 	@Override
-	public Collection<MessageId> getPendingMessages(Transaction transaction)
+	public Collection<MessageId> getPendingMessages(Transaction transaction,
-			throws DbException {
+			ClientId c) throws DbException {
 		T txn = unbox(transaction);
-		return db.getPendingMessages(txn);
+		return db.getPendingMessages(txn, c);
 	}
 
 	@Override
-	public Collection<MessageId> getMessagesToShare(Transaction transaction)
+	public Collection<MessageId> getMessagesToShare(
-			throws DbException {
+			Transaction transaction, ClientId c) throws DbException {
 		T txn = unbox(transaction);
-		return db.getMessagesToShare(txn);
+		return db.getMessagesToShare(txn, c);
 	}
 
 	@Nullable
@@ -573,7 +571,7 @@ class DatabaseComponentImpl<T> implements DatabaseComponent {
 
 	@Override
 	public long getNextSendTime(Transaction transaction, ContactId c)
-			throws DbException {
+		throws DbException {
 		T txn = unbox(transaction);
 		return db.getNextSendTime(txn, c);
 	}

bramble-core/src/main/java/org/briarproject/bramble/db/H2Database.java

@@ -3,7 +3,6 @@ package org.briarproject.bramble.db;
 import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.db.DatabaseConfig;
 import org.briarproject.bramble.api.db.DbException;
-import org.briarproject.bramble.api.db.MigrationListener;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.Clock;
 import org.briarproject.bramble.util.StringUtils;
@@ -14,7 +13,6 @@ import java.sql.DriverManager;
 import java.sql.SQLException;
 import java.util.Properties;
 
-import javax.annotation.Nullable;
 import javax.inject.Inject;
 
 /**
@@ -24,29 +22,30 @@ import javax.inject.Inject;
 class H2Database extends JdbcDatabase {
 
 	private static final String HASH_TYPE = "BINARY(32)";
+	private static final String SECRET_TYPE = "BINARY(32)";
 	private static final String BINARY_TYPE = "BINARY";
 	private static final String COUNTER_TYPE = "INT NOT NULL AUTO_INCREMENT";
-	private static final String SECRET_TYPE = "BINARY(32)";
+	private static final String STRING_TYPE = "VARCHAR";
 
 	private final DatabaseConfig config;
 	private final String url;
 
 	@Inject
 	H2Database(DatabaseConfig config, Clock clock) {
-		super(HASH_TYPE, BINARY_TYPE, COUNTER_TYPE, SECRET_TYPE, clock);
+		super(HASH_TYPE, SECRET_TYPE, BINARY_TYPE, COUNTER_TYPE, STRING_TYPE,
+				clock);
 		this.config = config;
 		File dir = config.getDatabaseDirectory();
 		String path = new File(dir, "db").getAbsolutePath();
 		url = "jdbc:h2:split:" + path + ";CIPHER=AES;MULTI_THREADED=1"
-				+ ";WRITE_DELAY=0;DB_CLOSE_ON_EXIT=false";
+				+ ";WRITE_DELAY=0";
 	}
 
 	@Override
-	public boolean open(@Nullable MigrationListener listener)
+	public boolean open() throws DbException {
-			throws DbException {
 		boolean reopen = config.databaseExists();
 		if (!reopen) config.getDatabaseDirectory().mkdirs();
-		super.open("org.h2.Driver", reopen, listener);
+		super.open("org.h2.Driver", reopen);
 		return reopen;
 	}
 
@@ -93,6 +92,10 @@ class H2Database extends JdbcDatabase {
 		// Separate the file password from the user password with a space
 		String hex = StringUtils.toHexString(key.getBytes());
 		props.put("password", hex + " password");
-		return DriverManager.getConnection(url, props);
+		return DriverManager.getConnection(getUrl(), props);
+	}
+
+	String getUrl() {
+		return url;
 	}
 }

bramble-core/src/main/java/org/briarproject/bramble/db/HyperSqlDatabase.java

@@ -0,0 +1,99 @@
+package org.briarproject.bramble.db;
+
+import org.briarproject.bramble.api.crypto.SecretKey;
+import org.briarproject.bramble.api.db.DatabaseConfig;
+import org.briarproject.bramble.api.db.DbException;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.system.Clock;
+import org.briarproject.bramble.util.StringUtils;
+
+import java.io.File;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+import javax.inject.Inject;
+
+/**
+ * Contains all the HSQLDB-specific code for the database.
+ */
+@NotNullByDefault
+class HyperSqlDatabase extends JdbcDatabase {
+
+	private static final String HASH_TYPE = "BINARY(32)";
+	private static final String SECRET_TYPE = "BINARY(32)";
+	private static final String BINARY_TYPE = "BINARY";
+	private static final String COUNTER_TYPE =
+			"INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY(START WITH 1)";
+	private static final String STRING_TYPE = "VARCHAR";
+
+	private final DatabaseConfig config;
+	private final String url;
+
+	@Inject
+	HyperSqlDatabase(DatabaseConfig config, Clock clock) {
+		super(HASH_TYPE, SECRET_TYPE, BINARY_TYPE, COUNTER_TYPE, STRING_TYPE,
+				clock);
+		this.config = config;
+		File dir = config.getDatabaseDirectory();
+		String path = new File(dir, "db").getAbsolutePath();
+		url = "jdbc:hsqldb:file:" + path
+				+ ";sql.enforce_size=false;allow_empty_batch=true"
+				+ ";encrypt_lobs=true;crypt_type=AES";
+	}
+
+	@Override
+	public boolean open() throws DbException {
+		boolean reopen = config.databaseExists();
+		if (!reopen) config.getDatabaseDirectory().mkdirs();
+		super.open("org.hsqldb.jdbc.JDBCDriver", reopen);
+		return reopen;
+	}
+
+	@Override
+	public void close() throws DbException {
+		try {
+			super.closeAllConnections();
+			Connection c = createConnection();
+			Statement s = c.createStatement();
+			s.executeQuery("SHUTDOWN");
+			s.close();
+			c.close();
+		} catch (SQLException e) {
+			throw new DbException(e);
+		}
+	}
+
+	@Override
+	public long getFreeSpace() throws DbException {
+		File dir = config.getDatabaseDirectory();
+		long maxSize = config.getMaxSize();
+		long free = dir.getFreeSpace();
+		long used = getDiskSpace(dir);
+		long quota = maxSize - used;
+		return Math.min(free, quota);
+	}
+
+	private long getDiskSpace(File f) {
+		if (f.isDirectory()) {
+			long total = 0;
+			File[] children = f.listFiles();
+			if (children != null)
+				for (File child : children) total += getDiskSpace(child);
+			return total;
+		} else if (f.isFile()) {
+			return f.length();
+		} else {
+			return 0;
+		}
+	}
+
+	@Override
+	protected Connection createConnection() throws SQLException {
+		SecretKey key = config.getEncryptionKey();
+		if (key == null) throw new IllegalStateException();
+		String hex = StringUtils.toHexString(key.getBytes());
+		return DriverManager.getConnection(url + ";crypt_key=" + hex);
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/db/JdbcDatabase.java

@@ -8,7 +8,6 @@ import org.briarproject.bramble.api.db.DataTooOldException;
 import org.briarproject.bramble.api.db.DbClosedException;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Metadata;
-import org.briarproject.bramble.api.db.MigrationListener;
 import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.identity.AuthorId;
 import org.briarproject.bramble.api.identity.LocalAuthor;
@@ -34,7 +33,6 @@ import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
@@ -73,31 +71,33 @@ import static org.briarproject.bramble.db.ExponentialBackoff.calculateExpiry;
 abstract class JdbcDatabase implements Database<Connection> {
 
 	// Package access for testing
-	static final int CODE_SCHEMA_VERSION = 32;
+	static final int CODE_SCHEMA_VERSION = 35;
 
 	private static final String CREATE_SETTINGS =
 			"CREATE TABLE settings"
-					+ " (namespace VARCHAR NOT NULL,"
+					+ " (namespace _STRING NOT NULL,"
-					+ " key VARCHAR NOT NULL,"
+					+ " settingKey _STRING NOT NULL,"
-					+ " value VARCHAR NOT NULL,"
+					+ " value _STRING NOT NULL,"
-					+ " PRIMARY KEY (namespace, key))";
+					+ " PRIMARY KEY (namespace, settingKey))";
 
 	private static final String CREATE_LOCAL_AUTHORS =
 			"CREATE TABLE localAuthors"
-					+ " (authorId HASH NOT NULL,"
+					+ " (authorId _HASH NOT NULL,"
-					+ " name VARCHAR NOT NULL,"
+					+ " formatVersion INT NOT NULL,"
-					+ " publicKey BINARY NOT NULL,"
+					+ " name _STRING NOT NULL,"
-					+ " privateKey BINARY NOT NULL,"
+					+ " publicKey _BINARY NOT NULL,"
+					+ " privateKey _BINARY NOT NULL,"
 					+ " created BIGINT NOT NULL,"
 					+ " PRIMARY KEY (authorId))";
 
 	private static final String CREATE_CONTACTS =
 			"CREATE TABLE contacts"
-					+ " (contactId COUNTER,"
+					+ " (contactId _COUNTER,"
-					+ " authorId HASH NOT NULL,"
+					+ " authorId _HASH NOT NULL,"
-					+ " name VARCHAR NOT NULL,"
+					+ " formatVersion INT NOT NULL,"
-					+ " publicKey BINARY NOT NULL,"
+					+ " name _STRING NOT NULL,"
-					+ " localAuthorId HASH NOT NULL,"
+					+ " publicKey _BINARY NOT NULL,"
+					+ " localAuthorId _HASH NOT NULL,"
 					+ " verified BOOLEAN NOT NULL,"
 					+ " active BOOLEAN NOT NULL,"
 					+ " PRIMARY KEY (contactId),"
@@ -107,17 +107,17 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	private static final String CREATE_GROUPS =
 			"CREATE TABLE groups"
-					+ " (groupId HASH NOT NULL,"
+					+ " (groupId _HASH NOT NULL,"
-					+ " clientId VARCHAR NOT NULL,"
+					+ " clientId _STRING NOT NULL,"
-					+ " descriptor BINARY NOT NULL,"
+					+ " descriptor _BINARY NOT NULL,"
 					+ " PRIMARY KEY (groupId))";
 
 	private static final String CREATE_GROUP_METADATA =
 			"CREATE TABLE groupMetadata"
-					+ " (groupId HASH NOT NULL,"
+					+ " (groupId _HASH NOT NULL,"
-					+ " key VARCHAR NOT NULL,"
+					+ " metaKey _STRING NOT NULL,"
-					+ " value BINARY NOT NULL,"
+					+ " value _BINARY NOT NULL,"
-					+ " PRIMARY KEY (groupId, key),"
+					+ " PRIMARY KEY (groupId, metaKey),"
 					+ " FOREIGN KEY (groupId)"
 					+ " REFERENCES groups (groupId)"
 					+ " ON DELETE CASCADE)";
@@ -125,7 +125,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 	private static final String CREATE_GROUP_VISIBILITIES =
 			"CREATE TABLE groupVisibilities"
 					+ " (contactId INT NOT NULL,"
-					+ " groupId HASH NOT NULL,"
+					+ " groupId _HASH NOT NULL,"
 					+ " shared BOOLEAN NOT NULL,"
 					+ " PRIMARY KEY (contactId, groupId),"
 					+ " FOREIGN KEY (contactId)"
@@ -137,8 +137,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	private static final String CREATE_MESSAGES =
 			"CREATE TABLE messages"
-					+ " (messageId HASH NOT NULL,"
+					+ " (messageId _HASH NOT NULL,"
-					+ " groupId HASH NOT NULL,"
+					+ " groupId _HASH NOT NULL,"
 					+ " timestamp BIGINT NOT NULL,"
 					+ " state INT NOT NULL,"
 					+ " shared BOOLEAN NOT NULL,"
@@ -151,12 +151,12 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	private static final String CREATE_MESSAGE_METADATA =
 			"CREATE TABLE messageMetadata"
-					+ " (messageId HASH NOT NULL,"
+					+ " (messageId _HASH NOT NULL,"
-					+ " groupId HASH NOT NULL," // Denormalised
+					+ " groupId _HASH NOT NULL," // Denormalised
 					+ " state INT NOT NULL," // Denormalised
-					+ " key VARCHAR NOT NULL,"
+					+ " metaKey _STRING NOT NULL,"
-					+ " value BINARY NOT NULL,"
+					+ " value _BINARY NOT NULL,"
-					+ " PRIMARY KEY (messageId, key),"
+					+ " PRIMARY KEY (messageId, metaKey),"
 					+ " FOREIGN KEY (messageId)"
 					+ " REFERENCES messages (messageId)"
 					+ " ON DELETE CASCADE,"
@@ -166,9 +166,9 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	private static final String CREATE_MESSAGE_DEPENDENCIES =
 			"CREATE TABLE messageDependencies"
-					+ " (groupId HASH NOT NULL,"
+					+ " (groupId _HASH NOT NULL,"
-					+ " messageId HASH NOT NULL,"
+					+ " messageId _HASH NOT NULL,"
-					+ " dependencyId HASH NOT NULL," // Not a foreign key
+					+ " dependencyId _HASH NOT NULL," // Not a foreign key
 					+ " FOREIGN KEY (groupId)"
 					+ " REFERENCES groups (groupId)"
 					+ " ON DELETE CASCADE,"
@@ -178,7 +178,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	private static final String CREATE_OFFERS =
 			"CREATE TABLE offers"
-					+ " (messageId HASH NOT NULL," // Not a foreign key
+					+ " (messageId _HASH NOT NULL," // Not a foreign key
 					+ " contactId INT NOT NULL,"
 					+ " PRIMARY KEY (messageId, contactId),"
 					+ " FOREIGN KEY (contactId)"
@@ -187,9 +187,9 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	private static final String CREATE_STATUSES =
 			"CREATE TABLE statuses"
-					+ " (messageId HASH NOT NULL,"
+					+ " (messageId _HASH NOT NULL,"
 					+ " contactId INT NOT NULL,"
-					+ " groupId HASH NOT NULL," // Denormalised
+					+ " groupId _HASH NOT NULL," // Denormalised
 					+ " timestamp BIGINT NOT NULL," // Denormalised
 					+ " length INT NOT NULL," // Denormalised
 					+ " state INT NOT NULL," // Denormalised
@@ -214,20 +214,20 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	private static final String CREATE_TRANSPORTS =
 			"CREATE TABLE transports"
-					+ " (transportId VARCHAR NOT NULL,"
+					+ " (transportId _STRING NOT NULL,"
 					+ " maxLatency INT NOT NULL,"
 					+ " PRIMARY KEY (transportId))";
 
 	private static final String CREATE_INCOMING_KEYS =
 			"CREATE TABLE incomingKeys"
 					+ " (contactId INT NOT NULL,"
-					+ " transportId VARCHAR NOT NULL,"
+					+ " transportId _STRING NOT NULL,"
-					+ " period BIGINT NOT NULL,"
+					+ " rotationPeriod BIGINT NOT NULL,"
-					+ " tagKey SECRET NOT NULL,"
+					+ " tagKey _SECRET NOT NULL,"
-					+ " headerKey SECRET NOT NULL,"
+					+ " headerKey _SECRET NOT NULL,"
 					+ " base BIGINT NOT NULL,"
-					+ " bitmap BINARY NOT NULL,"
+					+ " bitmap _BINARY NOT NULL,"
-					+ " PRIMARY KEY (contactId, transportId, period),"
+					+ " PRIMARY KEY (contactId, transportId, rotationPeriod),"
 					+ " FOREIGN KEY (contactId)"
 					+ " REFERENCES contacts (contactId)"
 					+ " ON DELETE CASCADE,"
@@ -238,10 +238,10 @@ abstract class JdbcDatabase implements Database<Connection> {
 	private static final String CREATE_OUTGOING_KEYS =
 			"CREATE TABLE outgoingKeys"
 					+ " (contactId INT NOT NULL,"
-					+ " transportId VARCHAR NOT NULL,"
+					+ " transportId _STRING NOT NULL,"
-					+ " period BIGINT NOT NULL,"
+					+ " rotationPeriod BIGINT NOT NULL,"
-					+ " tagKey SECRET NOT NULL,"
+					+ " tagKey _SECRET NOT NULL,"
-					+ " headerKey SECRET NOT NULL,"
+					+ " headerKey _SECRET NOT NULL,"
 					+ " stream BIGINT NOT NULL,"
 					+ " PRIMARY KEY (contactId, transportId),"
 					+ " FOREIGN KEY (contactId)"
@@ -275,7 +275,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 			Logger.getLogger(JdbcDatabase.class.getName());
 
 	// Different database libraries use different names for certain types
-	private final String hashType, binaryType, counterType, secretType;
+	private final String hashType, secretType, binaryType;
+	private final String counterType, stringType;
 	private final Clock clock;
 
 	// Locking: connectionsLock
@@ -290,17 +291,17 @@ abstract class JdbcDatabase implements Database<Connection> {
 	private final Lock connectionsLock = new ReentrantLock();
 	private final Condition connectionsChanged = connectionsLock.newCondition();
 
-	JdbcDatabase(String hashType, String binaryType, String counterType,
+	JdbcDatabase(String hashType, String secretType, String binaryType,
-			String secretType, Clock clock) {
+			String counterType, String stringType, Clock clock) {
 		this.hashType = hashType;
+		this.secretType = secretType;
 		this.binaryType = binaryType;
 		this.counterType = counterType;
-		this.secretType = secretType;
+		this.stringType = stringType;
 		this.clock = clock;
 	}
 
-	protected void open(String driverClass, boolean reopen,
+	protected void open(String driverClass, boolean reopen) throws DbException {
-			@Nullable MigrationListener listener) throws DbException {
 		// Load the JDBC driver
 		try {
 			Class.forName(driverClass);
@@ -311,7 +312,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		Connection txn = startTransaction();
 		try {
 			if (reopen) {
-				checkSchemaVersion(txn, listener);
+				checkSchemaVersion(txn);
 			} else {
 				createTables(txn);
 				storeSchemaVersion(txn, CODE_SCHEMA_VERSION);
@@ -334,8 +335,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 	 * @throws DataTooOldException if the data uses an older schema than the
 	 * current code and cannot be migrated
 	 */
-	private void checkSchemaVersion(Connection txn,
+	private void checkSchemaVersion(Connection txn) throws DbException {
-			@Nullable MigrationListener listener) throws DbException {
 		Settings s = getSettings(txn, DB_SETTINGS_NAMESPACE);
 		int dataSchemaVersion = s.getInt(SCHEMA_VERSION_KEY, -1);
 		if (dataSchemaVersion == -1) throw new DbException();
@@ -348,7 +348,6 @@ abstract class JdbcDatabase implements Database<Connection> {
 			if (start == dataSchemaVersion) {
 				if (LOG.isLoggable(INFO))
 					LOG.info("Migrating from schema " + start + " to " + end);
-				if (listener != null) listener.onMigrationRun();
 				// Apply the migration
 				m.migrate(txn);
 				// Store the new schema version
@@ -362,7 +361,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 
 	// Package access for testing
 	List<Migration<Connection>> getMigrations() {
-		return Arrays.asList(new Migration30_31(), new Migration31_32());
+		return Collections.emptyList();
 	}
 
 	private void storeSchemaVersion(Connection txn, int version)
@@ -430,16 +429,17 @@ abstract class JdbcDatabase implements Database<Connection> {
 	}
 
 	private String insertTypeNames(String s) {
-		s = s.replaceAll("HASH", hashType);
+		s = s.replaceAll("_HASH", hashType);
-		s = s.replaceAll("BINARY", binaryType);
+		s = s.replaceAll("_SECRET", secretType);
-		s = s.replaceAll("COUNTER", counterType);
+		s = s.replaceAll("_BINARY", binaryType);
-		s = s.replaceAll("SECRET", secretType);
+		s = s.replaceAll("_COUNTER", counterType);
+		s = s.replaceAll("_STRING", stringType);
 		return s;
 	}
 
 	@Override
 	public Connection startTransaction() throws DbException {
-		Connection txn = null;
+		Connection txn;
 		connectionsLock.lock();
 		try {
 			if (closed) throw new DbClosedException();
@@ -547,16 +547,18 @@ abstract class JdbcDatabase implements Database<Connection> {
 		try {
 			// Create a contact row
 			String sql = "INSERT INTO contacts"
-					+ " (authorId, name, publicKey, localAuthorId,"
+					+ " (authorId, formatVersion, name, publicKey,"
+					+ " localAuthorId,"
 					+ " verified, active)"
-					+ " VALUES (?, ?, ?, ?, ?, ?)";
+					+ " VALUES (?, ?, ?, ?, ?, ?, ?)";
 			ps = txn.prepareStatement(sql);
 			ps.setBytes(1, remote.getId().getBytes());
-			ps.setString(2, remote.getName());
+			ps.setInt(2, remote.getFormatVersion());
-			ps.setBytes(3, remote.getPublicKey());
+			ps.setString(3, remote.getName());
-			ps.setBytes(4, local.getBytes());
+			ps.setBytes(4, remote.getPublicKey());
-			ps.setBoolean(5, verified);
+			ps.setBytes(5, local.getBytes());
-			ps.setBoolean(6, active);
+			ps.setBoolean(6, verified);
+			ps.setBoolean(7, active);
 			int affected = ps.executeUpdate();
 			if (affected != 1) throw new DbStateException();
 			ps.close();
@@ -658,14 +660,16 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		try {
 			String sql = "INSERT INTO localAuthors"
-					+ " (authorId, name, publicKey, privateKey, created)"
+					+ " (authorId, formatVersion, name, publicKey,"
-					+ " VALUES (?, ?, ?, ?, ?)";
+					+ " privateKey, created)"
+					+ " VALUES (?, ?, ?, ?, ?, ?)";
 			ps = txn.prepareStatement(sql);
 			ps.setBytes(1, a.getId().getBytes());
-			ps.setString(2, a.getName());
+			ps.setInt(2, a.getFormatVersion());
-			ps.setBytes(3, a.getPublicKey());
+			ps.setString(3, a.getName());
-			ps.setBytes(4, a.getPrivateKey());
+			ps.setBytes(4, a.getPublicKey());
-			ps.setLong(5, a.getTimeCreated());
+			ps.setBytes(5, a.getPrivateKey());
+			ps.setLong(6, a.getTimeCreated());
 			int affected = ps.executeUpdate();
 			if (affected != 1) throw new DbStateException();
 			ps.close();
@@ -822,7 +826,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		try {
 			// Store the incoming keys
 			String sql = "INSERT INTO incomingKeys (contactId, transportId,"
-					+ " period, tagKey, headerKey, base, bitmap)"
+					+ " rotationPeriod, tagKey, headerKey, base, bitmap)"
 					+ " VALUES (?, ?, ?, ?, ?, ?, ?)";
 			ps = txn.prepareStatement(sql);
 			ps.setInt(1, c.getInt());
@@ -857,8 +861,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 				if (rows != 1) throw new DbStateException();
 			ps.close();
 			// Store the outgoing keys
-			sql = "INSERT INTO outgoingKeys (contactId, transportId, period,"
+			sql = "INSERT INTO outgoingKeys (contactId, transportId,"
-					+ " tagKey, headerKey, stream)"
+					+ " rotationPeriod, tagKey, headerKey, stream)"
 					+ " VALUES (?, ?, ?, ?, ?, ?)";
 			ps = txn.prepareStatement(sql);
 			ps.setInt(1, c.getInt());
@@ -1106,7 +1110,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT authorId, name, publicKey,"
+			String sql = "SELECT authorId, formatVersion, name, publicKey,"
 					+ " localAuthorId, verified, active"
 					+ " FROM contacts"
 					+ " WHERE contactId = ?";
@@ -1115,14 +1119,16 @@ abstract class JdbcDatabase implements Database<Connection> {
 			rs = ps.executeQuery();
 			if (!rs.next()) throw new DbStateException();
 			AuthorId authorId = new AuthorId(rs.getBytes(1));
-			String name = rs.getString(2);
+			int formatVersion = rs.getInt(2);
-			byte[] publicKey = rs.getBytes(3);
+			String name = rs.getString(3);
-			AuthorId localAuthorId = new AuthorId(rs.getBytes(4));
+			byte[] publicKey = rs.getBytes(4);
-			boolean verified = rs.getBoolean(5);
+			AuthorId localAuthorId = new AuthorId(rs.getBytes(5));
-			boolean active = rs.getBoolean(6);
+			boolean verified = rs.getBoolean(6);
+			boolean active = rs.getBoolean(7);
 			rs.close();
 			ps.close();
-			Author author = new Author(authorId, name, publicKey);
+			Author author =
+					new Author(authorId, formatVersion, name, publicKey);
 			return new Contact(c, author, localAuthorId, verified, active);
 		} catch (SQLException e) {
 			tryToClose(rs);
@@ -1137,8 +1143,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT contactId, authorId, name, publicKey,"
+			String sql = "SELECT contactId, authorId, formatVersion, name,"
-					+ " localAuthorId, verified, active"
+					+ " publicKey, localAuthorId, verified, active"
 					+ " FROM contacts";
 			ps = txn.prepareStatement(sql);
 			rs = ps.executeQuery();
@@ -1146,12 +1152,14 @@ abstract class JdbcDatabase implements Database<Connection> {
 			while (rs.next()) {
 				ContactId contactId = new ContactId(rs.getInt(1));
 				AuthorId authorId = new AuthorId(rs.getBytes(2));
-				String name = rs.getString(3);
+				int formatVersion = rs.getInt(3);
-				byte[] publicKey = rs.getBytes(4);
+				String name = rs.getString(4);
-				Author author = new Author(authorId, name, publicKey);
+				byte[] publicKey = rs.getBytes(5);
-				AuthorId localAuthorId = new AuthorId(rs.getBytes(5));
+				Author author =
-				boolean verified = rs.getBoolean(6);
+						new Author(authorId, formatVersion, name, publicKey);
-				boolean active = rs.getBoolean(7);
+				AuthorId localAuthorId = new AuthorId(rs.getBytes(6));
+				boolean verified = rs.getBoolean(7);
+				boolean active = rs.getBoolean(8);
 				contacts.add(new Contact(contactId, author, localAuthorId,
 						verified, active));
 			}
@@ -1194,7 +1202,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT contactId, name, publicKey,"
+			String sql = "SELECT contactId, formatVersion, name, publicKey,"
 					+ " localAuthorId, verified, active"
 					+ " FROM contacts"
 					+ " WHERE authorId = ?";
@@ -1204,12 +1212,14 @@ abstract class JdbcDatabase implements Database<Connection> {
 			List<Contact> contacts = new ArrayList<>();
 			while (rs.next()) {
 				ContactId c = new ContactId(rs.getInt(1));
-				String name = rs.getString(2);
+				int formatVersion = rs.getInt(2);
-				byte[] publicKey = rs.getBytes(3);
+				String name = rs.getString(3);
-				AuthorId localAuthorId = new AuthorId(rs.getBytes(4));
+				byte[] publicKey = rs.getBytes(4);
-				boolean verified = rs.getBoolean(5);
+				AuthorId localAuthorId = new AuthorId(rs.getBytes(5));
-				boolean active = rs.getBoolean(6);
+				boolean verified = rs.getBoolean(6);
-				Author author = new Author(remote, name, publicKey);
+				boolean active = rs.getBoolean(7);
+				Author author =
+						new Author(remote, formatVersion, name, publicKey);
 				contacts.add(new Contact(c, author, localAuthorId, verified,
 						active));
 			}
@@ -1329,19 +1339,21 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT name, publicKey, privateKey, created"
+			String sql = "SELECT formatVersion, name, publicKey,"
+					+ " privateKey, created"
 					+ " FROM localAuthors"
 					+ " WHERE authorId = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setBytes(1, a.getBytes());
 			rs = ps.executeQuery();
 			if (!rs.next()) throw new DbStateException();
-			String name = rs.getString(1);
+			int formatVersion = rs.getInt(1);
-			byte[] publicKey = rs.getBytes(2);
+			String name = rs.getString(2);
-			byte[] privateKey = rs.getBytes(3);
+			byte[] publicKey = rs.getBytes(3);
-			long created = rs.getLong(4);
+			byte[] privateKey = rs.getBytes(4);
-			LocalAuthor localAuthor = new LocalAuthor(a, name, publicKey,
+			long created = rs.getLong(5);
-					privateKey, created);
+			LocalAuthor localAuthor = new LocalAuthor(a, formatVersion, name,
+					publicKey, privateKey, created);
 			if (rs.next()) throw new DbStateException();
 			rs.close();
 			ps.close();
@@ -1359,19 +1371,21 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT authorId, name, publicKey, privateKey, created"
+			String sql = "SELECT authorId, formatVersion, name, publicKey,"
+					+ " privateKey, created"
 					+ " FROM localAuthors";
 			ps = txn.prepareStatement(sql);
 			rs = ps.executeQuery();
 			List<LocalAuthor> authors = new ArrayList<>();
 			while (rs.next()) {
 				AuthorId authorId = new AuthorId(rs.getBytes(1));
-				String name = rs.getString(2);
+				int formatVersion = rs.getInt(2);
-				byte[] publicKey = rs.getBytes(3);
+				String name = rs.getString(3);
-				byte[] privateKey = rs.getBytes(4);
+				byte[] publicKey = rs.getBytes(4);
-				long created = rs.getLong(5);
+				byte[] privateKey = rs.getBytes(5);
-				authors.add(new LocalAuthor(authorId, name, publicKey,
+				long created = rs.getLong(6);
-						privateKey, created));
+				authors.add(new LocalAuthor(authorId, formatVersion, name,
+						publicKey, privateKey, created));
 			}
 			rs.close();
 			ps.close();
@@ -1440,7 +1454,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 			Set<MessageId> intersection = null;
 			String sql = "SELECT messageId FROM messageMetadata"
 					+ " WHERE groupId = ? AND state = ?"
-					+ " AND key = ? AND value = ?";
+					+ " AND metaKey = ? AND value = ?";
 			for (Entry<String, byte[]> e : query.entrySet()) {
 				ps = txn.prepareStatement(sql);
 				ps.setBytes(1, g.getBytes());
@@ -1472,7 +1486,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT messageId, key, value"
+			String sql = "SELECT messageId, metaKey, value"
 					+ " FROM messageMetadata"
 					+ " WHERE groupId = ? AND state = ?";
 			ps = txn.prepareStatement(sql);
@@ -1517,7 +1531,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT key, value FROM groupMetadata"
+			String sql = "SELECT metaKey, value FROM groupMetadata"
 					+ " WHERE groupId = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setBytes(1, g.getBytes());
@@ -1540,7 +1554,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT key, value FROM messageMetadata"
+			String sql = "SELECT metaKey, value FROM messageMetadata"
 					+ " WHERE state = ? AND messageId = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setInt(1, DELIVERED.getValue());
@@ -1564,7 +1578,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT key, value FROM messageMetadata"
+			String sql = "SELECT metaKey, value FROM messageMetadata"
 					+ " WHERE (state = ? OR state = ?)"
 					+ " AND messageId = ?";
 			ps = txn.prepareStatement(sql);
@@ -1850,26 +1864,28 @@ abstract class JdbcDatabase implements Database<Connection> {
 	}
 
 	@Override
-	public Collection<MessageId> getMessagesToValidate(Connection txn)
+	public Collection<MessageId> getMessagesToValidate(Connection txn,
-			throws DbException {
+			ClientId c) throws DbException {
-		return getMessagesInState(txn, UNKNOWN);
+		return getMessagesInState(txn, c, UNKNOWN);
 	}
 
 	@Override
-	public Collection<MessageId> getPendingMessages(Connection txn)
+	public Collection<MessageId> getPendingMessages(Connection txn,
-			throws DbException {
+			ClientId c) throws DbException {
-		return getMessagesInState(txn, PENDING);
+		return getMessagesInState(txn, c, PENDING);
 	}
 
-	private Collection<MessageId> getMessagesInState(Connection txn,
+	private Collection<MessageId> getMessagesInState(Connection txn, ClientId c,
 			State state) throws DbException {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT messageId FROM messages"
+			String sql = "SELECT messageId FROM messages AS m"
-					+ " WHERE state = ? AND raw IS NOT NULL";
+					+ " JOIN groups AS g ON m.groupId = g.groupId"
+					+ " WHERE state = ? AND clientId = ? AND raw IS NOT NULL";
 			ps = txn.prepareStatement(sql);
 			ps.setInt(1, state.getValue());
+			ps.setString(2, c.getString());
 			rs = ps.executeQuery();
 			List<MessageId> ids = new ArrayList<>();
 			while (rs.next()) ids.add(new MessageId(rs.getBytes(1)));
@@ -1884,7 +1900,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 	}
 
 	@Override
-	public Collection<MessageId> getMessagesToShare(Connection txn)
+	public Collection<MessageId> getMessagesToShare(Connection txn, ClientId c)
 			throws DbException {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
@@ -1894,10 +1910,12 @@ abstract class JdbcDatabase implements Database<Connection> {
 					+ " ON m.messageId = d.dependencyId"
 					+ " JOIN messages AS m1"
 					+ " ON d.messageId = m1.messageId"
-					+ " WHERE m.state = ?"
+					+ " JOIN groups AS g"
-					+ " AND m.shared = FALSE AND m1.shared = TRUE";
+					+ " ON m.groupId = g.groupId"
+					+ " WHERE m.shared = FALSE AND m1.shared = TRUE"
+					+ " AND g.clientId = ?";
 			ps = txn.prepareStatement(sql);
-			ps.setInt(1, DELIVERED.getValue());
+			ps.setString(1, c.getString());
 			rs = ps.executeQuery();
 			List<MessageId> ids = new ArrayList<>();
 			while (rs.next()) ids.add(new MessageId(rs.getBytes(1)));
@@ -2008,7 +2026,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		ResultSet rs = null;
 		try {
-			String sql = "SELECT key, value FROM settings WHERE namespace = ?";
+			String sql = "SELECT settingKey, value FROM settings"
+					+ " WHERE namespace = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setString(1, namespace);
 			rs = ps.executeQuery();
@@ -2031,10 +2050,11 @@ abstract class JdbcDatabase implements Database<Connection> {
 		ResultSet rs = null;
 		try {
 			// Retrieve the incoming keys
-			String sql = "SELECT period, tagKey, headerKey, base, bitmap"
+			String sql = "SELECT rotationPeriod, tagKey, headerKey,"
+					+ " base, bitmap"
 					+ " FROM incomingKeys"
 					+ " WHERE transportId = ?"
-					+ " ORDER BY contactId, period";
+					+ " ORDER BY contactId, rotationPeriod";
 			ps = txn.prepareStatement(sql);
 			ps.setString(1, t.getString());
 			rs = ps.executeQuery();
@@ -2051,10 +2071,10 @@ abstract class JdbcDatabase implements Database<Connection> {
 			rs.close();
 			ps.close();
 			// Retrieve the outgoing keys in the same order
-			sql = "SELECT contactId, period, tagKey, headerKey, stream"
+			sql = "SELECT contactId, rotationPeriod, tagKey, headerKey, stream"
 					+ " FROM outgoingKeys"
 					+ " WHERE transportId = ?"
-					+ " ORDER BY contactId, period";
+					+ " ORDER BY contactId, rotationPeriod";
 			ps = txn.prepareStatement(sql);
 			ps.setString(1, t.getString());
 			rs = ps.executeQuery();
@@ -2091,7 +2111,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		try {
 			String sql = "UPDATE outgoingKeys SET stream = stream + 1"
-					+ " WHERE contactId = ? AND transportId = ? AND period = ?";
+					+ " WHERE contactId = ? AND transportId = ?"
+					+ " AND rotationPeriod = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setInt(1, c.getInt());
 			ps.setString(2, t.getString());
@@ -2168,7 +2189,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 					g.getBytes(), meta, "groupMetadata", "groupId");
 			if (added.isEmpty()) return;
 			// Insert any keys that don't already exist
-			String sql = "INSERT INTO groupMetadata (groupId, key, value)"
+			String sql = "INSERT INTO groupMetadata (groupId, metaKey, value)"
 					+ " VALUES (?, ?, ?)";
 			ps = txn.prepareStatement(sql);
 			ps.setBytes(1, g.getBytes());
@@ -2211,7 +2232,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 			ps.close();
 			// Insert any keys that don't already exist
 			sql = "INSERT INTO messageMetadata"
-					+ " (messageId, groupId, state, key, value)"
+					+ " (messageId, groupId, state, metaKey, value)"
 					+ " VALUES (?, ?, ?, ?, ?)";
 			ps = txn.prepareStatement(sql);
 			ps.setBytes(1, m.getBytes());
@@ -2252,7 +2273,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 			// Delete any keys that are being removed
 			if (!removed.isEmpty()) {
 				String sql = "DELETE FROM " + tableName
-						+ " WHERE " + columnName + " = ? AND key = ?";
+						+ " WHERE " + columnName + " = ? AND metaKey = ?";
 				ps = txn.prepareStatement(sql);
 				ps.setBytes(1, id);
 				for (String key : removed) {
@@ -2271,7 +2292,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 			if (notRemoved.isEmpty()) return Collections.emptyMap();
 			// Update any keys that already exist
 			String sql = "UPDATE " + tableName + " SET value = ?"
-					+ " WHERE " + columnName + " = ? AND key = ?";
+					+ " WHERE " + columnName + " = ? AND metaKey = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setBytes(2, id);
 			for (Entry<String, byte[]> e : notRemoved.entrySet()) {
@@ -2308,7 +2329,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 		try {
 			// Update any settings that already exist
 			String sql = "UPDATE settings SET value = ?"
-					+ " WHERE namespace = ? AND key = ?";
+					+ " WHERE namespace = ? AND settingKey = ?";
 			ps = txn.prepareStatement(sql);
 			for (Entry<String, String> e : s.entrySet()) {
 				ps.setString(1, e.getValue());
@@ -2323,7 +2344,7 @@ abstract class JdbcDatabase implements Database<Connection> {
 				if (rows > 1) throw new DbStateException();
 			}
 			// Insert any settings that don't already exist
-			sql = "INSERT INTO settings (namespace, key, value)"
+			sql = "INSERT INTO settings (namespace, settingKey, value)"
 					+ " VALUES (?, ?, ?)";
 			ps = txn.prepareStatement(sql);
 			int updateIndex = 0, inserted = 0;
@@ -2722,7 +2743,8 @@ abstract class JdbcDatabase implements Database<Connection> {
 		PreparedStatement ps = null;
 		try {
 			String sql = "UPDATE incomingKeys SET base = ?, bitmap = ?"
-					+ " WHERE contactId = ? AND transportId = ? AND period = ?";
+					+ " WHERE contactId = ? AND transportId = ?"
+					+ " AND rotationPeriod = ?";
 			ps = txn.prepareStatement(sql);
 			ps.setLong(1, base);
 			ps.setBytes(2, bitmap);

bramble-core/src/main/java/org/briarproject/bramble/db/Migration30_31.java

@@ -1,75 +0,0 @@
-package org.briarproject.bramble.db;
-
-import org.briarproject.bramble.api.db.DbException;
-
-import java.sql.Connection;
-import java.sql.SQLException;
-import java.sql.Statement;
-import java.util.logging.Logger;
-
-import javax.annotation.Nullable;
-
-import static java.util.logging.Level.WARNING;
-
-class Migration30_31 implements Migration<Connection> {
-
-	private static final Logger LOG =
-			Logger.getLogger(Migration30_31.class.getName());
-
-	@Override
-	public int getStartVersion() {
-		return 30;
-	}
-
-	@Override
-	public int getEndVersion() {
-		return 31;
-	}
-
-	@Override
-	public void migrate(Connection txn) throws DbException {
-		Statement s = null;
-		try {
-			s = txn.createStatement();
-			// Add groupId column
-			s.execute("ALTER TABLE messageMetadata"
-					+ " ADD COLUMN groupId BINARY(32) AFTER messageId");
-			// Populate groupId column
-			s.execute("UPDATE messageMetadata AS mm SET groupId ="
-					+ " (SELECT groupId FROM messages AS m"
-					+ " WHERE mm.messageId = m.messageId)");
-			// Add not null constraint now column has been populated
-			s.execute("ALTER TABLE messageMetadata"
-					+ " ALTER COLUMN groupId"
-					+ " SET NOT NULL");
-			// Add foreign key constraint
-			s.execute("ALTER TABLE messageMetadata"
-					+ " ADD CONSTRAINT groupIdForeignKey"
-					+ " FOREIGN KEY (groupId)"
-					+ " REFERENCES groups (groupId)"
-					+ " ON DELETE CASCADE");
-			// Add state column
-			s.execute("ALTER TABLE messageMetadata"
-					+ " ADD COLUMN state INT AFTER groupId");
-			// Populate state column
-			s.execute("UPDATE messageMetadata AS mm SET state ="
-					+ " (SELECT state FROM messages AS m"
-					+ " WHERE mm.messageId = m.messageId)");
-			// Add not null constraint now column has been populated
-			s.execute("ALTER TABLE messageMetadata"
-					+ " ALTER COLUMN state"
-					+ " SET NOT NULL");
-		} catch (SQLException e) {
-			tryToClose(s);
-			throw new DbException(e);
-		}
-	}
-
-	private void tryToClose(@Nullable Statement s) {
-		try {
-			if (s != null) s.close();
-		} catch (SQLException e) {
-			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-		}
-	}
-}

bramble-core/src/main/java/org/briarproject/bramble/db/Migration31_32.java

@@ -1,84 +0,0 @@
-package org.briarproject.bramble.db;
-
-import org.briarproject.bramble.api.db.DbException;
-
-import java.sql.Connection;
-import java.sql.SQLException;
-import java.sql.Statement;
-import java.util.logging.Logger;
-
-import javax.annotation.Nullable;
-
-import static java.util.logging.Level.WARNING;
-
-class Migration31_32 implements Migration<Connection> {
-
-	private static final Logger LOG =
-			Logger.getLogger(Migration31_32.class.getName());
-
-	@Override
-	public int getStartVersion() {
-		return 31;
-	}
-
-	@Override
-	public int getEndVersion() {
-		return 32;
-	}
-
-	@Override
-	public void migrate(Connection txn) throws DbException {
-		Statement s = null;
-		try {
-			s = txn.createStatement();
-			// Add denormalised columns
-			s.execute("ALTER TABLE statuses ADD COLUMN"
-					+ " (groupId BINARY(32),"
-					+ " timestamp BIGINT,"
-					+ " length INT,"
-					+ " state INT,"
-					+ " groupShared BOOLEAN,"
-					+ " messageShared BOOLEAN,"
-					+ " deleted BOOLEAN)");
-			// Populate columns from messages table
-			s.execute("UPDATE statuses AS s SET (groupId, timestamp, length,"
-					+ " state, messageShared, deleted) ="
-					+ " (SELECT groupId, timestamp, length, state, shared,"
-					+ " raw IS NULL FROM messages AS m"
-					+ " WHERE s.messageId = m.messageId)");
-			// Populate column from groupVisibilities table
-			s.execute("UPDATE statuses AS s SET groupShared ="
-					+ " (SELECT shared FROM groupVisibilities AS gv"
-					+ " WHERE s.contactId = gv.contactId"
-					+ " AND s.groupId = gv.groupId)");
-			// Add not null constraints now columns have been populated
-			s.execute("ALTER TABLE statuses ALTER COLUMN groupId SET NOT NULL");
-			s.execute("ALTER TABLE statuses ALTER COLUMN timestamp"
-					+ " SET NOT NULL");
-			s.execute("ALTER TABLE statuses ALTER COLUMN length SET NOT NULL");
-			s.execute("ALTER TABLE statuses ALTER COLUMN state SET NOT NULL");
-			s.execute("ALTER TABLE statuses ALTER COLUMN groupShared"
-					+ " SET NOT NULL");
-			s.execute("ALTER TABLE statuses ALTER COLUMN messageShared"
-					+ " SET NOT NULL");
-			s.execute("ALTER TABLE statuses ALTER COLUMN deleted SET NOT NULL");
-			// Add foreign key constraint
-			s.execute("ALTER TABLE statuses"
-					+ " ADD CONSTRAINT statusesForeignKeyGroupId"
-					+ " FOREIGN KEY (groupId)"
-					+ " REFERENCES groups (groupId)"
-					+ " ON DELETE CASCADE");
-		} catch (SQLException e) {
-			tryToClose(s);
-			throw new DbException(e);
-		}
-	}
-
-	private void tryToClose(@Nullable Statement s) {
-		try {
-			if (s != null) s.close();
-		} catch (SQLException e) {
-			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-		}
-	}
-}

bramble-core/src/main/java/org/briarproject/bramble/identity/AuthorFactoryImpl.java

@@ -1,61 +1,65 @@
 package org.briarproject.bramble.identity;
 
 import org.briarproject.bramble.api.crypto.CryptoComponent;
-import org.briarproject.bramble.api.data.BdfWriter;
-import org.briarproject.bramble.api.data.BdfWriterFactory;
 import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.identity.AuthorFactory;
 import org.briarproject.bramble.api.identity.AuthorId;
 import org.briarproject.bramble.api.identity.LocalAuthor;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.Clock;
-
+import org.briarproject.bramble.util.ByteUtils;
-import java.io.ByteArrayOutputStream;
+import org.briarproject.bramble.util.StringUtils;
-import java.io.IOException;
 
 import javax.annotation.concurrent.Immutable;
 import javax.inject.Inject;
 
+import static org.briarproject.bramble.api.identity.Author.FORMAT_VERSION;
+import static org.briarproject.bramble.api.identity.AuthorId.LABEL;
+import static org.briarproject.bramble.util.ByteUtils.INT_32_BYTES;
+
 @Immutable
 @NotNullByDefault
 class AuthorFactoryImpl implements AuthorFactory {
 
 	private final CryptoComponent crypto;
-	private final BdfWriterFactory bdfWriterFactory;
 	private final Clock clock;
 
 	@Inject
-	AuthorFactoryImpl(CryptoComponent crypto, BdfWriterFactory bdfWriterFactory,
+	AuthorFactoryImpl(CryptoComponent crypto, Clock clock) {
-			Clock clock) {
 		this.crypto = crypto;
-		this.bdfWriterFactory = bdfWriterFactory;
 		this.clock = clock;
 	}
 
 	@Override
 	public Author createAuthor(String name, byte[] publicKey) {
-		return new Author(getId(name, publicKey), name, publicKey);
+		return createAuthor(FORMAT_VERSION, name, publicKey);
+	}
+
+	@Override
+	public Author createAuthor(int formatVersion, String name,
+			byte[] publicKey) {
+		AuthorId id = getId(formatVersion, name, publicKey);
+		return new Author(id, formatVersion, name, publicKey);
 	}
 
 	@Override
 	public LocalAuthor createLocalAuthor(String name, byte[] publicKey,
 			byte[] privateKey) {
-		return new LocalAuthor(getId(name, publicKey), name, publicKey,
+		return createLocalAuthor(FORMAT_VERSION, name, publicKey, privateKey);
-				privateKey, clock.currentTimeMillis());
 	}
 
-	private AuthorId getId(String name, byte[] publicKey) {
+	@Override
-		ByteArrayOutputStream out = new ByteArrayOutputStream();
+	public LocalAuthor createLocalAuthor(int formatVersion, String name,
-		BdfWriter w = bdfWriterFactory.createWriter(out);
+			byte[] publicKey, byte[] privateKey) {
-		try {
+		AuthorId id = getId(formatVersion, name, publicKey);
-			w.writeListStart();
+		return new LocalAuthor(id, formatVersion, name, publicKey, privateKey,
-			w.writeString(name);
+				clock.currentTimeMillis());
-			w.writeRaw(publicKey);
+	}
-			w.writeListEnd();
+
-		} catch (IOException e) {
+	private AuthorId getId(int formatVersion, String name, byte[] publicKey) {
-			// Shouldn't happen with ByteArrayOutputStream
+		byte[] formatVersionBytes = new byte[INT_32_BYTES];
-			throw new RuntimeException(e);
+		ByteUtils.writeUint32(formatVersion, formatVersionBytes, 0);
-		}
+		return new AuthorId(crypto.hash(LABEL, formatVersionBytes,
-		return new AuthorId(crypto.hash(AuthorId.LABEL, out.toByteArray()));
+				StringUtils.toUtf8(name), publicKey));
 	}
 }

bramble-core/src/main/java/org/briarproject/bramble/identity/AuthorReader.java

@@ -1,36 +0,0 @@
-package org.briarproject.bramble.identity;
-
-import org.briarproject.bramble.api.FormatException;
-import org.briarproject.bramble.api.data.BdfReader;
-import org.briarproject.bramble.api.data.ObjectReader;
-import org.briarproject.bramble.api.identity.Author;
-import org.briarproject.bramble.api.identity.AuthorFactory;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-
-import java.io.IOException;
-
-import javax.annotation.concurrent.Immutable;
-
-import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_AUTHOR_NAME_LENGTH;
-import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
-
-@Immutable
-@NotNullByDefault
-class AuthorReader implements ObjectReader<Author> {
-
-	private final AuthorFactory authorFactory;
-
-	AuthorReader(AuthorFactory authorFactory) {
-		this.authorFactory = authorFactory;
-	}
-
-	@Override
-	public Author readObject(BdfReader r) throws IOException {
-		r.readListStart();
-		String name = r.readString(MAX_AUTHOR_NAME_LENGTH);
-		if (name.length() == 0) throw new FormatException();
-		byte[] publicKey = r.readRaw(MAX_PUBLIC_KEY_LENGTH);
-		r.readListEnd();
-		return authorFactory.createAuthor(name, publicKey);
-	}
-}

bramble-core/src/main/java/org/briarproject/bramble/identity/IdentityModule.java

@@ -1,13 +1,7 @@
 package org.briarproject.bramble.identity;
 
-import org.briarproject.bramble.api.crypto.CryptoComponent;
-import org.briarproject.bramble.api.data.BdfWriterFactory;
-import org.briarproject.bramble.api.data.ObjectReader;
-import org.briarproject.bramble.api.db.DatabaseComponent;
-import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.identity.AuthorFactory;
 import org.briarproject.bramble.api.identity.IdentityManager;
-import org.briarproject.bramble.api.system.Clock;
 
 import javax.inject.Inject;
 import javax.inject.Singleton;
@@ -24,19 +18,14 @@ public class IdentityModule {
 	}
 
 	@Provides
-	AuthorFactory provideAuthorFactory(CryptoComponent crypto,
+	AuthorFactory provideAuthorFactory(AuthorFactoryImpl authorFactory) {
-			BdfWriterFactory bdfWriterFactory, Clock clock) {
+		return authorFactory;
-		return new AuthorFactoryImpl(crypto, bdfWriterFactory, clock);
 	}
 
 	@Provides
 	@Singleton
-	IdentityManager provideIdentityModule(DatabaseComponent db) {
+	IdentityManager provideIdentityManager(
-		return new IdentityManagerImpl(db);
+			IdentityManagerImpl identityManager) {
-	}
+		return identityManager;
-
-	@Provides
-	ObjectReader<Author> provideAuthorReader(AuthorFactory authorFactory) {
-		return new AuthorReader(authorFactory);
 	}
 }

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/ConnectionChooser.java

@@ -2,35 +2,38 @@ package org.briarproject.bramble.keyagreement;
 
 import org.briarproject.bramble.api.keyagreement.KeyAgreementConnection;
 
-import java.util.concurrent.Callable;
-
 import javax.annotation.Nullable;
 
 interface ConnectionChooser {
 
 	/**
-	 * Submits a connection task to the chooser.
+	 * Adds a connection to the set of connections that may be chosen. If
+	 * {@link #stop()} has already been called, the connection will be closed
+	 * immediately.
 	 */
-	void submit(Callable<KeyAgreementConnection> task);
+	void addConnection(KeyAgreementConnection c);
 
 	/**
-	 * Returns a connection returned by any of the tasks submitted to the
+	 * Chooses one of the connections passed to
-	 * chooser, waiting up to the given amount of time for a connection if
+	 * {@link #addConnection(KeyAgreementConnection)} and returns it,
-	 * necessary. Returns null if the time elapses without a connection
+	 * waiting up to the given amount of time for a suitable connection to
-	 * becoming available.
+	 * become available. Returns null if the time elapses without a suitable
+	 * connection becoming available.
 	 *
+	 * @param alice true if the local party is Alice
 	 * @param timeout the timeout in milliseconds
 	 * @throws InterruptedException if the thread is interrupted while waiting
-	 * for a connection to become available
+	 * for a suitable connection to become available
 	 */
 	@Nullable
-	KeyAgreementConnection poll(long timeout) throws InterruptedException;
+	KeyAgreementConnection chooseConnection(boolean alice, long timeout)
+			throws InterruptedException;
 
 	/**
-	 * Stops the chooser. Any connections already returned to the chooser are
+	 * Stops the chooser from accepting new connections. Closes any connections
-	 * closed unless they have been removed from the chooser by calling
+	 * already passed to {@link #addConnection(KeyAgreementConnection)}
-	 * {@link #poll(long)}. Any connections subsequently returned to the
+	 * and not chosen. Any connections subsequently passed to
-	 * chooser will also be closed.
+	 * {@link #addConnection(KeyAgreementConnection)} will be closed.
 	 */
 	void stop();
 }

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/ConnectionChooserImpl.java

@@ -1,18 +1,16 @@
 package org.briarproject.bramble.keyagreement;
 
+import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.keyagreement.KeyAgreementConnection;
-import org.briarproject.bramble.api.lifecycle.IoExecutor;
+import org.briarproject.bramble.api.keyagreement.event.KeyAgreementWaitingEvent;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
 import org.briarproject.bramble.api.system.Clock;
 
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.LinkedList;
+import java.util.Iterator;
 import java.util.List;
-import java.util.Queue;
-import java.util.concurrent.Callable;
-import java.util.concurrent.Executor;
 import java.util.logging.Logger;
 
 import javax.annotation.Nullable;
@@ -20,6 +18,7 @@ import javax.annotation.concurrent.ThreadSafe;
 import javax.inject.Inject;
 
 import static java.util.logging.Level.INFO;
+import static java.util.logging.Level.WARNING;
 
 @NotNullByDefault
 @ThreadSafe
@@ -28,54 +27,114 @@ class ConnectionChooserImpl implements ConnectionChooser {
 	private static final Logger LOG =
 			Logger.getLogger(ConnectionChooserImpl.class.getName());
 
+	private final EventBus eventBus;
 	private final Clock clock;
-	private final Executor ioExecutor;
 	private final Object lock = new Object();
-
+	private final List<KeyAgreementConnection> connections =
-	// The following are locking: lock
+			new ArrayList<>(); // Locking: lock
-	private boolean stopped = false;
+	private boolean stopped = false; // Locking: lock
-	private final Queue<KeyAgreementConnection> results = new LinkedList<>();
 
 	@Inject
-	ConnectionChooserImpl(Clock clock, @IoExecutor Executor ioExecutor) {
+	ConnectionChooserImpl(EventBus eventBus, Clock clock) {
+		this.eventBus = eventBus;
 		this.clock = clock;
-		this.ioExecutor = ioExecutor;
 	}
 
 	@Override
-	public void submit(Callable<KeyAgreementConnection> task) {
+	public void addConnection(KeyAgreementConnection conn) {
-		ioExecutor.execute(() -> {
+		boolean close = false;
-			try {
+		synchronized (lock) {
-				KeyAgreementConnection c = task.call();
+			if (stopped) {
-				if (c != null) addResult(c);
+				// Already stopped, close the connection
-			} catch (Exception e) {
+				close = true;
-				if (LOG.isLoggable(INFO)) LOG.info(e.toString());
+			} else {
+				connections.add(conn);
+				lock.notifyAll();
 			}
-		});
+		}
+		if (close) tryToClose(conn.getConnection());
 	}
 
 	@Nullable
 	@Override
-	public KeyAgreementConnection poll(long timeout)
+	public KeyAgreementConnection chooseConnection(boolean alice, long timeout)
 			throws InterruptedException {
+		if (alice) return chooseConnectionAlice(timeout);
+		else return chooseConnectionBob(timeout);
+	}
+
+	@Nullable
+	private KeyAgreementConnection chooseConnectionAlice(long timeout)
+			throws InterruptedException {
+		LOG.info("Choosing connection for Alice");
 		long now = clock.currentTimeMillis();
 		long end = now + timeout;
+		KeyAgreementConnection chosen;
 		synchronized (lock) {
-			while (!stopped && results.isEmpty() && now < end) {
+			// Wait until we're stopped, a connection is added, or we time out
+			while (!stopped && connections.isEmpty() && now < end) {
 				lock.wait(end - now);
 				now = clock.currentTimeMillis();
 			}
-			return results.poll();
+			if (connections.isEmpty()) {
+				LOG.info("No suitable connection for Alice");
+				return null;
+			}
+			// Choose the first connection
+			chosen = connections.remove(0);
 		}
+		if (LOG.isLoggable(INFO))
+			LOG.info("Choosing " + chosen.getTransportId());
+		return chosen;
+	}
+
+	@Nullable
+	private KeyAgreementConnection chooseConnectionBob(long timeout)
+			throws InterruptedException {
+		LOG.info("Choosing connection for Bob");
+		// Bob waits here for Alice to scan his QR code, determine her role,
+		// choose a connection and send her key
+		eventBus.broadcast(new KeyAgreementWaitingEvent());
+		long now = clock.currentTimeMillis();
+		long end = now + timeout;
+		synchronized (lock) {
+			while (!stopped && now < end) {
+				// Check whether any connection has data available
+				Iterator<KeyAgreementConnection> it = connections.iterator();
+				while (it.hasNext()) {
+					KeyAgreementConnection c = it.next();
+					try {
+						int available = c.getConnection().getReader()
+								.getInputStream().available();
+						if (available > 0) {
+							if (LOG.isLoggable(INFO))
+								LOG.info("Choosing " + c.getTransportId());
+							it.remove();
+							return c;
+						}
+					} catch (IOException e) {
+						if (LOG.isLoggable(WARNING))
+							LOG.log(WARNING, e.toString(), e);
+						tryToClose(c.getConnection());
+						it.remove();
+					}
+				}
+				// Wait for 1 second before checking again
+				lock.wait(Math.min(1000, end - now));
+				now = clock.currentTimeMillis();
+			}
+		}
+		LOG.info("No suitable connection for Bob");
+		return null;
 	}
 
 	@Override
 	public void stop() {
 		List<KeyAgreementConnection> unused;
 		synchronized (lock) {
-			unused = new ArrayList<>(results);
-			results.clear();
 			stopped = true;
+			unused = new ArrayList<>(connections);
+			connections.clear();
 			lock.notifyAll();
 		}
 		if (LOG.isLoggable(INFO))
@@ -83,24 +142,6 @@ class ConnectionChooserImpl implements ConnectionChooser {
 		for (KeyAgreementConnection c : unused) tryToClose(c.getConnection());
 	}
 
-	private void addResult(KeyAgreementConnection c) {
-		if (LOG.isLoggable(INFO))
-			LOG.info("Got connection for " + c.getTransportId());
-		boolean close = false;
-		synchronized (lock) {
-			if (stopped) {
-				close = true;
-			} else {
-				results.add(c);
-				lock.notifyAll();
-			}
-		}
-		if (close) {
-			LOG.info("Already stopped");
-			tryToClose(c.getConnection());
-		}
-	}
-
 	private void tryToClose(DuplexTransportConnection conn) {
 		try {
 			conn.getReader().dispose(false, true);

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/KeyAgreementConnector.java

@@ -1,27 +1,26 @@
 package org.briarproject.bramble.keyagreement;
 
-import org.briarproject.bramble.api.crypto.CryptoComponent;
+import org.briarproject.bramble.api.crypto.KeyAgreementCrypto;
 import org.briarproject.bramble.api.crypto.KeyPair;
 import org.briarproject.bramble.api.data.BdfList;
 import org.briarproject.bramble.api.keyagreement.KeyAgreementConnection;
 import org.briarproject.bramble.api.keyagreement.KeyAgreementListener;
 import org.briarproject.bramble.api.keyagreement.Payload;
 import org.briarproject.bramble.api.keyagreement.TransportDescriptor;
+import org.briarproject.bramble.api.lifecycle.IoExecutor;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.Plugin;
 import org.briarproject.bramble.api.plugin.PluginManager;
 import org.briarproject.bramble.api.plugin.TransportId;
 import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
 import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
+import org.briarproject.bramble.api.system.Clock;
 
 import java.io.IOException;
-import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.concurrent.Callable;
 import java.util.concurrent.CopyOnWriteArrayList;
-import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.Executor;
-import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.logging.Logger;
 
 import javax.annotation.Nullable;
@@ -33,39 +32,35 @@ import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.CO
 @NotNullByDefault
 class KeyAgreementConnector {
 
-	interface Callbacks {
-		void connectionWaiting();
-	}
-
 	private static final Logger LOG =
 			Logger.getLogger(KeyAgreementConnector.class.getName());
 
-	private final Callbacks callbacks;
+	private final Clock clock;
-	private final CryptoComponent crypto;
+	private final KeyAgreementCrypto keyAgreementCrypto;
 	private final PluginManager pluginManager;
+	private final Executor ioExecutor;
 	private final ConnectionChooser connectionChooser;
 
 	private final List<KeyAgreementListener> listeners =
 			new CopyOnWriteArrayList<>();
-	private final CountDownLatch aliceLatch = new CountDownLatch(1);
-	private final AtomicBoolean waitingSent = new AtomicBoolean(false);
 
-	private volatile boolean alice = false, stopped = false;
+	private volatile boolean stopped = false;
 
-	KeyAgreementConnector(Callbacks callbacks,
+	KeyAgreementConnector(Clock clock, KeyAgreementCrypto keyAgreementCrypto,
-			CryptoComponent crypto, PluginManager pluginManager,
+			PluginManager pluginManager, Executor ioExecutor,
 			ConnectionChooser connectionChooser) {
-		this.callbacks = callbacks;
+		this.clock = clock;
-		this.crypto = crypto;
+		this.keyAgreementCrypto = keyAgreementCrypto;
 		this.pluginManager = pluginManager;
+		this.ioExecutor = ioExecutor;
 		this.connectionChooser = connectionChooser;
 	}
 
 	Payload listen(KeyPair localKeyPair) {
 		LOG.info("Starting BQP listeners");
 		// Derive commitment
-		byte[] commitment = crypto.deriveKeyCommitment(
+		byte[] commitment = keyAgreementCrypto.deriveKeyCommitment(
-				localKeyPair.getPublic().getEncoded());
+				localKeyPair.getPublic());
 		// Start all listeners and collect their descriptors
 		List<TransportDescriptor> descriptors = new ArrayList<>();
 		for (DuplexPlugin plugin : pluginManager.getKeyAgreementPlugins()) {
@@ -76,7 +71,14 @@ class KeyAgreementConnector {
 				descriptors.add(new TransportDescriptor(id, l.getDescriptor()));
 				if (LOG.isLoggable(INFO)) LOG.info("Listening via " + id);
 				listeners.add(l);
-				connectionChooser.submit(new ReadableTask(l::accept));
+				ioExecutor.execute(() -> {
+					try {
+						connectionChooser.addConnection(l.accept());
+					} catch (IOException e) {
+						if (LOG.isLoggable(WARNING))
+							LOG.log(WARNING, e.toString(), e);
+					}
+				});
 			}
 		}
 		return new Payload(commitment, descriptors);
@@ -85,17 +87,13 @@ class KeyAgreementConnector {
 	void stopListening() {
 		LOG.info("Stopping BQP listeners");
 		stopped = true;
-		aliceLatch.countDown();
 		for (KeyAgreementListener l : listeners) l.close();
+		listeners.clear();
 		connectionChooser.stop();
 	}
 
 	@Nullable
 	public KeyAgreementTransport connect(Payload remotePayload, boolean alice) {
-		// Let the ReadableTasks know if we are Alice
-		this.alice = alice;
-		aliceLatch.countDown();
-
 		// Start connecting over supported transports
 		if (LOG.isLoggable(INFO)) {
 			LOG.info("Starting outgoing BQP connections as "
@@ -109,16 +107,23 @@ class KeyAgreementConnector {
 				DuplexPlugin plugin = (DuplexPlugin) p;
 				byte[] commitment = remotePayload.getCommitment();
 				BdfList descriptor = d.getDescriptor();
-				connectionChooser.submit(new ReadableTask(
+				ioExecutor.execute(() -> {
-						new ConnectorTask(plugin, commitment, descriptor)));
+					try {
+						KeyAgreementConnection c =
+								connect(plugin, commitment, descriptor);
+						if (c != null) connectionChooser.addConnection(c);
+					} catch (InterruptedException e) {
+						LOG.info("Interrupted while waiting to connect");
+					}
+				});
 			}
 		}
 
 		// Get chosen connection
 		try {
-			KeyAgreementConnection chosen =
+			KeyAgreementConnection chosen = connectionChooser.chooseConnection(
-					connectionChooser.poll(CONNECTION_TIMEOUT);
+					alice, CONNECTION_TIMEOUT);
-			if (chosen == null) return null;
+			if (chosen == null) return null; // No suitable connection
 			return new KeyAgreementTransport(chosen);
 		} catch (InterruptedException e) {
 			LOG.info("Interrupted while waiting for connection");
@@ -132,70 +137,20 @@ class KeyAgreementConnector {
 		}
 	}
 
-	private void waitingForAlice() {
+	@Nullable
-		if (!waitingSent.getAndSet(true)) callbacks.connectionWaiting();
+	@IoExecutor
-	}
+	private KeyAgreementConnection connect(DuplexPlugin plugin,
-
+			byte[] commitment, BdfList descriptor) throws InterruptedException {
-	private class ConnectorTask implements Callable<KeyAgreementConnection> {
+		// Repeat attempts until we time out, get stopped, or get interrupted
-
+		long end = clock.currentTimeMillis() + CONNECTION_TIMEOUT;
-		private final byte[] commitment;
+		while (!stopped && clock.currentTimeMillis() < end) {
-		private final BdfList descriptor;
+			DuplexTransportConnection conn =
-		private final DuplexPlugin plugin;
+					plugin.createKeyAgreementConnection(commitment, descriptor);
-
+			if (conn != null)
-		private ConnectorTask(DuplexPlugin plugin, byte[] commitment,
+				return new KeyAgreementConnection(conn, plugin.getId());
-				BdfList descriptor) {
+			// Wait 2s before retry (to circumvent transient failures)
-			this.plugin = plugin;
+			Thread.sleep(2000);
-			this.commitment = commitment;
-			this.descriptor = descriptor;
-		}
-
-		@Nullable
-		@Override
-		public KeyAgreementConnection call() throws Exception {
-			// Repeat attempts until we connect, get stopped, or get interrupted
-			while (!stopped) {
-				DuplexTransportConnection conn =
-						plugin.createKeyAgreementConnection(commitment,
-								descriptor);
-				if (conn != null) {
-					if (LOG.isLoggable(INFO))
-						LOG.info(plugin.getId() + ": Outgoing connection");
-					return new KeyAgreementConnection(conn, plugin.getId());
-				}
-				// Wait 2s before retry (to circumvent transient failures)
-				Thread.sleep(2000);
-			}
-			return null;
-		}
-	}
-
-	private class ReadableTask implements Callable<KeyAgreementConnection> {
-
-		private final Callable<KeyAgreementConnection> connectionTask;
-
-		private ReadableTask(Callable<KeyAgreementConnection> connectionTask) {
-			this.connectionTask = connectionTask;
-		}
-
-		@Nullable
-		@Override
-		public KeyAgreementConnection call() throws Exception {
-			KeyAgreementConnection c = connectionTask.call();
-			if (c == null) return null;
-			aliceLatch.await();
-			if (alice || stopped) return c;
-			// Bob waits here for Alice to scan his QR code, determine her
-			// role, and send her key
-			InputStream in = c.getConnection().getReader().getInputStream();
-			while (!stopped && in.available() == 0) {
-				if (LOG.isLoggable(INFO))
-					LOG.info(c.getTransportId() + ": Waiting for data");
-				waitingForAlice();
-				Thread.sleep(500);
-			}
-			if (!stopped && LOG.isLoggable(INFO))
-				LOG.info(c.getTransportId().getString() + ": Data available");
-			return c;
 		}
+		return null;
 	}
 }

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/KeyAgreementModule.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.keyagreement;
 
 import org.briarproject.bramble.api.data.BdfReaderFactory;
 import org.briarproject.bramble.api.data.BdfWriterFactory;
-import org.briarproject.bramble.api.keyagreement.KeyAgreementTaskFactory;
+import org.briarproject.bramble.api.keyagreement.KeyAgreementTask;
 import org.briarproject.bramble.api.keyagreement.PayloadEncoder;
 import org.briarproject.bramble.api.keyagreement.PayloadParser;
 
@@ -13,9 +13,9 @@ import dagger.Provides;
 public class KeyAgreementModule {
 
 	@Provides
-	KeyAgreementTaskFactory provideKeyAgreementTaskFactory(
+	KeyAgreementTask provideKeyAgreementTask(
-			KeyAgreementTaskFactoryImpl keyAgreementTaskFactory) {
+			KeyAgreementTaskImpl keyAgreementTask) {
-		return keyAgreementTaskFactory;
+		return keyAgreementTask;
 	}
 
 	@Provides

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/KeyAgreementProtocol.java

@@ -1,7 +1,10 @@
 package org.briarproject.bramble.keyagreement;
 
 import org.briarproject.bramble.api.crypto.CryptoComponent;
+import org.briarproject.bramble.api.crypto.KeyAgreementCrypto;
 import org.briarproject.bramble.api.crypto.KeyPair;
+import org.briarproject.bramble.api.crypto.KeyParser;
+import org.briarproject.bramble.api.crypto.PublicKey;
 import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.keyagreement.Payload;
 import org.briarproject.bramble.api.keyagreement.PayloadEncoder;
@@ -11,6 +14,10 @@ import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.util.Arrays;
 
+import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.MASTER_SECRET_LABEL;
+import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.PROTOCOL_VERSION;
+import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.SHARED_SECRET_LABEL;
+
 /**
  * Implementation of the BQP protocol.
  * <p/>
@@ -57,6 +64,7 @@ class KeyAgreementProtocol {
 
 	private final Callbacks callbacks;
 	private final CryptoComponent crypto;
+	private final KeyAgreementCrypto keyAgreementCrypto;
 	private final PayloadEncoder payloadEncoder;
 	private final KeyAgreementTransport transport;
 	private final Payload theirPayload, ourPayload;
@@ -64,11 +72,13 @@ class KeyAgreementProtocol {
 	private final boolean alice;
 
 	KeyAgreementProtocol(Callbacks callbacks, CryptoComponent crypto,
+			KeyAgreementCrypto keyAgreementCrypto,
 			PayloadEncoder payloadEncoder, KeyAgreementTransport transport,
 			Payload theirPayload, Payload ourPayload, KeyPair ourKeyPair,
 			boolean alice) {
 		this.callbacks = callbacks;
 		this.crypto = crypto;
+		this.keyAgreementCrypto = keyAgreementCrypto;
 		this.payloadEncoder = payloadEncoder;
 		this.transport = transport;
 		this.theirPayload = theirPayload;
@@ -86,7 +96,7 @@ class KeyAgreementProtocol {
 	 */
 	SecretKey perform() throws AbortException, IOException {
 		try {
-			byte[] theirPublicKey;
+			PublicKey theirPublicKey;
 			if (alice) {
 				sendKey();
 				// Alice waits here for Bob to scan her QR code, determine his
@@ -105,7 +115,7 @@ class KeyAgreementProtocol {
 				receiveConfirm(s, theirPublicKey);
 				sendConfirm(s, theirPublicKey);
 			}
-			return crypto.deriveMasterSecret(s);
+			return crypto.deriveKey(MASTER_SECRET_LABEL, s);
 		} catch (AbortException e) {
 			sendAbort(e.getCause() != null);
 			throw e;
@@ -116,27 +126,41 @@ class KeyAgreementProtocol {
 		transport.sendKey(ourKeyPair.getPublic().getEncoded());
 	}
 
-	private byte[] receiveKey() throws AbortException {
+	private PublicKey receiveKey() throws AbortException {
-		byte[] publicKey = transport.receiveKey();
+		byte[] publicKeyBytes = transport.receiveKey();
 		callbacks.initialRecordReceived();
-		byte[] expected = crypto.deriveKeyCommitment(publicKey);
+		KeyParser keyParser = crypto.getAgreementKeyParser();
-		if (!Arrays.equals(expected, theirPayload.getCommitment()))
+		try {
+			PublicKey publicKey = keyParser.parsePublicKey(publicKeyBytes);
+			byte[] expected = keyAgreementCrypto.deriveKeyCommitment(publicKey);
+			if (!Arrays.equals(expected, theirPayload.getCommitment()))
+				throw new AbortException();
+			return publicKey;
+		} catch (GeneralSecurityException e) {
 			throw new AbortException();
-		return publicKey;
+		}
 	}
 
-	private SecretKey deriveSharedSecret(byte[] theirPublicKey)
+	private SecretKey deriveSharedSecret(PublicKey theirPublicKey)
 			throws AbortException {
 		try {
-			return crypto.deriveSharedSecret(theirPublicKey, ourKeyPair, alice);
+			byte[] ourPublicKeyBytes = ourKeyPair.getPublic().getEncoded();
+			byte[] theirPublicKeyBytes = theirPublicKey.getEncoded();
+			byte[][] inputs = {
+					new byte[] {PROTOCOL_VERSION},
+					alice ? ourPublicKeyBytes : theirPublicKeyBytes,
+					alice ? theirPublicKeyBytes : ourPublicKeyBytes
+			};
+			return crypto.deriveSharedSecret(SHARED_SECRET_LABEL,
+					theirPublicKey, ourKeyPair, inputs);
 		} catch (GeneralSecurityException e) {
 			throw new AbortException(e);
 		}
 	}
 
-	private void sendConfirm(SecretKey s, byte[] theirPublicKey)
+	private void sendConfirm(SecretKey s, PublicKey theirPublicKey)
 			throws IOException {
-		byte[] confirm = crypto.deriveConfirmationRecord(s,
+		byte[] confirm = keyAgreementCrypto.deriveConfirmationRecord(s,
 				payloadEncoder.encode(theirPayload),
 				payloadEncoder.encode(ourPayload),
 				theirPublicKey, ourKeyPair,
@@ -144,10 +168,10 @@ class KeyAgreementProtocol {
 		transport.sendConfirm(confirm);
 	}
 
-	private void receiveConfirm(SecretKey s, byte[] theirPublicKey)
+	private void receiveConfirm(SecretKey s, PublicKey theirPublicKey)
 			throws AbortException {
 		byte[] confirm = transport.receiveConfirm();
-		byte[] expected = crypto.deriveConfirmationRecord(s,
+		byte[] expected = keyAgreementCrypto.deriveConfirmationRecord(s,
 				payloadEncoder.encode(theirPayload),
 				payloadEncoder.encode(ourPayload),
 				theirPublicKey, ourKeyPair,

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/KeyAgreementTaskFactoryImpl.java

@@ -1,41 +0,0 @@
-package org.briarproject.bramble.keyagreement;
-
-import org.briarproject.bramble.api.crypto.CryptoComponent;
-import org.briarproject.bramble.api.event.EventBus;
-import org.briarproject.bramble.api.keyagreement.KeyAgreementTask;
-import org.briarproject.bramble.api.keyagreement.KeyAgreementTaskFactory;
-import org.briarproject.bramble.api.keyagreement.PayloadEncoder;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.bramble.api.plugin.PluginManager;
-
-import javax.annotation.concurrent.Immutable;
-import javax.inject.Inject;
-import javax.inject.Provider;
-
-@Immutable
-@NotNullByDefault
-class KeyAgreementTaskFactoryImpl implements KeyAgreementTaskFactory {
-
-	private final CryptoComponent crypto;
-	private final EventBus eventBus;
-	private final PayloadEncoder payloadEncoder;
-	private final PluginManager pluginManager;
-	private final Provider<ConnectionChooser> connectionChooserProvider;
-
-	@Inject
-	KeyAgreementTaskFactoryImpl(CryptoComponent crypto, EventBus eventBus,
-			PayloadEncoder payloadEncoder, PluginManager pluginManager,
-			Provider<ConnectionChooser> connectionChooserProvider) {
-		this.crypto = crypto;
-		this.eventBus = eventBus;
-		this.payloadEncoder = payloadEncoder;
-		this.pluginManager = pluginManager;
-		this.connectionChooserProvider = connectionChooserProvider;
-	}
-
-	@Override
-	public KeyAgreementTask createTask() {
-		return new KeyAgreementTaskImpl(crypto, eventBus, payloadEncoder,
-				pluginManager, connectionChooserProvider.get());
-	}
-}

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/KeyAgreementTaskImpl.java

@@ -1,6 +1,7 @@
 package org.briarproject.bramble.keyagreement;
 
 import org.briarproject.bramble.api.crypto.CryptoComponent;
+import org.briarproject.bramble.api.crypto.KeyAgreementCrypto;
 import org.briarproject.bramble.api.crypto.KeyPair;
 import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.event.EventBus;
@@ -14,24 +15,30 @@ import org.briarproject.bramble.api.keyagreement.event.KeyAgreementFinishedEvent
 import org.briarproject.bramble.api.keyagreement.event.KeyAgreementListeningEvent;
 import org.briarproject.bramble.api.keyagreement.event.KeyAgreementStartedEvent;
 import org.briarproject.bramble.api.keyagreement.event.KeyAgreementWaitingEvent;
+import org.briarproject.bramble.api.lifecycle.IoExecutor;
 import org.briarproject.bramble.api.nullsafety.MethodsNotNullByDefault;
 import org.briarproject.bramble.api.nullsafety.ParametersNotNullByDefault;
 import org.briarproject.bramble.api.plugin.PluginManager;
+import org.briarproject.bramble.api.system.Clock;
 
 import java.io.IOException;
+import java.util.concurrent.Executor;
 import java.util.logging.Logger;
 
+import javax.inject.Inject;
+
 import static java.util.logging.Level.WARNING;
 
 @MethodsNotNullByDefault
 @ParametersNotNullByDefault
-class KeyAgreementTaskImpl extends Thread implements KeyAgreementTask,
+class KeyAgreementTaskImpl extends Thread implements
-		KeyAgreementProtocol.Callbacks, KeyAgreementConnector.Callbacks {
+		KeyAgreementTask, KeyAgreementProtocol.Callbacks {
 
 	private static final Logger LOG =
 			Logger.getLogger(KeyAgreementTaskImpl.class.getName());
 
 	private final CryptoComponent crypto;
+	private final KeyAgreementCrypto keyAgreementCrypto;
 	private final EventBus eventBus;
 	private final PayloadEncoder payloadEncoder;
 	private final KeyPair localKeyPair;
@@ -40,15 +47,19 @@ class KeyAgreementTaskImpl extends Thread implements KeyAgreementTask,
 	private Payload localPayload;
 	private Payload remotePayload;
 
-	KeyAgreementTaskImpl(CryptoComponent crypto, EventBus eventBus,
+	@Inject
+	KeyAgreementTaskImpl(Clock clock, CryptoComponent crypto,
+			KeyAgreementCrypto keyAgreementCrypto, EventBus eventBus,
 			PayloadEncoder payloadEncoder, PluginManager pluginManager,
+			@IoExecutor Executor ioExecutor,
 			ConnectionChooser connectionChooser) {
 		this.crypto = crypto;
+		this.keyAgreementCrypto = keyAgreementCrypto;
 		this.eventBus = eventBus;
 		this.payloadEncoder = payloadEncoder;
 		localKeyPair = crypto.generateAgreementKeyPair();
-		connector = new KeyAgreementConnector(this, crypto, pluginManager,
+		connector = new KeyAgreementConnector(clock, keyAgreementCrypto,
-				connectionChooser);
+				pluginManager, ioExecutor, connectionChooser);
 	}
 
 	@Override
@@ -95,8 +106,8 @@ class KeyAgreementTaskImpl extends Thread implements KeyAgreementTask,
 		// Run BQP protocol over the connection
 		LOG.info("Starting BQP protocol");
 		KeyAgreementProtocol protocol = new KeyAgreementProtocol(this, crypto,
-				payloadEncoder, transport, remotePayload, localPayload,
+				keyAgreementCrypto, payloadEncoder, transport, remotePayload,
-				localKeyPair, alice);
+				localPayload, localKeyPair, alice);
 		try {
 			SecretKey master = protocol.perform();
 			KeyAgreementResult result =

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/PayloadEncoderImpl.java

@@ -29,10 +29,10 @@ class PayloadEncoderImpl implements PayloadEncoder {
 	@Override
 	public byte[] encode(Payload p) {
 		ByteArrayOutputStream out = new ByteArrayOutputStream();
+		out.write(PROTOCOL_VERSION);
 		BdfWriter w = bdfWriterFactory.createWriter(out);
 		try {
 			w.writeListStart(); // Payload start
-			w.writeLong(PROTOCOL_VERSION);
 			w.writeRaw(p.getCommitment());
 			for (TransportDescriptor d : p.getTransportDescriptors())
 				w.writeList(d.getDescriptor());

bramble-core/src/main/java/org/briarproject/bramble/keyagreement/PayloadParserImpl.java

@@ -1,6 +1,7 @@
 package org.briarproject.bramble.keyagreement;
 
 import org.briarproject.bramble.api.FormatException;
+import org.briarproject.bramble.api.UnsupportedVersionException;
 import org.briarproject.bramble.api.data.BdfList;
 import org.briarproject.bramble.api.data.BdfReader;
 import org.briarproject.bramble.api.data.BdfReaderFactory;
@@ -39,20 +40,22 @@ class PayloadParserImpl implements PayloadParser {
 	@Override
 	public Payload parse(byte[] raw) throws IOException {
 		ByteArrayInputStream in = new ByteArrayInputStream(raw);
+		// First byte: the protocol version
+		int protocolVersion = in.read();
+		if (protocolVersion == -1) throw new FormatException();
+		if (protocolVersion != PROTOCOL_VERSION)
+			throw new UnsupportedVersionException();
+		// The rest of the payload is a BDF list with one or more elements
 		BdfReader r = bdfReaderFactory.createReader(in);
-		// The payload is a BDF list with two or more elements
 		BdfList payload = r.readList();
-		if (payload.size() < 2) throw new FormatException();
+		if (payload.isEmpty()) throw new FormatException();
 		if (!r.eof()) throw new FormatException();
-		// First element: the protocol version
+		// First element: the public key commitment
-		long protocolVersion = payload.getLong(0);
+		byte[] commitment = payload.getRaw(0);
-		if (protocolVersion != PROTOCOL_VERSION) throw new FormatException();
-		// Second element: the public key commitment
-		byte[] commitment = payload.getRaw(1);
 		if (commitment.length != COMMIT_LENGTH) throw new FormatException();
 		// Remaining elements: transport descriptors
 		List<TransportDescriptor> recognised = new ArrayList<>();
-		for (int i = 2; i < payload.size(); i++) {
+		for (int i = 1; i < payload.size(); i++) {
 			BdfList descriptor = payload.getList(i);
 			long transportId = descriptor.getLong(0);
 			if (transportId == TRANSPORT_ID_BLUETOOTH) {

bramble-core/src/main/java/org/briarproject/bramble/lifecycle/LifecycleManagerImpl.java

@@ -2,11 +2,8 @@ package org.briarproject.bramble.lifecycle;
 
 import org.briarproject.bramble.api.crypto.CryptoComponent;
 import org.briarproject.bramble.api.crypto.KeyPair;
-import org.briarproject.bramble.api.db.DataTooNewException;
-import org.briarproject.bramble.api.db.DataTooOldException;
 import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.DbException;
-import org.briarproject.bramble.api.db.MigrationListener;
 import org.briarproject.bramble.api.db.Transaction;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.identity.AuthorFactory;
@@ -15,7 +12,7 @@ import org.briarproject.bramble.api.identity.LocalAuthor;
 import org.briarproject.bramble.api.lifecycle.LifecycleManager;
 import org.briarproject.bramble.api.lifecycle.Service;
 import org.briarproject.bramble.api.lifecycle.ServiceException;
-import org.briarproject.bramble.api.lifecycle.event.LifecycleEvent;
+import org.briarproject.bramble.api.lifecycle.event.ShutdownEvent;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.Client;
 
@@ -32,21 +29,14 @@ import javax.inject.Inject;
 
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.MIGRATING_DATABASE;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.RUNNING;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.STARTING;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.STARTING_SERVICES;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.STOPPING;
 import static org.briarproject.bramble.api.lifecycle.LifecycleManager.StartResult.ALREADY_RUNNING;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.StartResult.DATA_TOO_NEW_ERROR;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.StartResult.DATA_TOO_OLD_ERROR;
 import static org.briarproject.bramble.api.lifecycle.LifecycleManager.StartResult.DB_ERROR;
 import static org.briarproject.bramble.api.lifecycle.LifecycleManager.StartResult.SERVICE_ERROR;
 import static org.briarproject.bramble.api.lifecycle.LifecycleManager.StartResult.SUCCESS;
 
 @ThreadSafe
 @NotNullByDefault
-class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
+class LifecycleManagerImpl implements LifecycleManager {
 
 	private static final Logger LOG =
 			Logger.getLogger(LifecycleManagerImpl.class.getName());
@@ -64,8 +54,6 @@ class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
 	private final CountDownLatch startupLatch = new CountDownLatch(1);
 	private final CountDownLatch shutdownLatch = new CountDownLatch(1);
 
-	private volatile LifecycleState state = STARTING;
-
 	@Inject
 	LifecycleManagerImpl(DatabaseComponent db, EventBus eventBus,
 			CryptoComponent crypto, AuthorFactory authorFactory,
@@ -131,7 +119,7 @@ class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
 			LOG.info("Starting services");
 			long start = System.currentTimeMillis();
 
-			boolean reopened = db.open(this);
+			boolean reopened = db.open();
 			long duration = System.currentTimeMillis() - start;
 			if (LOG.isLoggable(INFO)) {
 				if (reopened)
@@ -143,10 +131,7 @@ class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
 				registerLocalAuthor(createLocalAuthor(nickname));
 			}
 
-			state = STARTING_SERVICES;
 			dbLatch.countDown();
-			eventBus.broadcast(new LifecycleEvent(STARTING_SERVICES));
-
 			Transaction txn = db.startTransaction(false);
 			try {
 				for (Client c : clients) {
@@ -172,17 +157,8 @@ class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
 							+ " took " + duration + " ms");
 				}
 			}
-
-			state = RUNNING;
 			startupLatch.countDown();
-			eventBus.broadcast(new LifecycleEvent(RUNNING));
 			return SUCCESS;
-		} catch (DataTooOldException e) {
-			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-			return DATA_TOO_OLD_ERROR;
-		} catch (DataTooNewException e) {
-			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-			return DATA_TOO_NEW_ERROR;
 		} catch (DbException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			return DB_ERROR;
@@ -194,12 +170,6 @@ class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
 		}
 	}
 
-	@Override
-	public void onMigrationRun() {
-		state = MIGRATING_DATABASE;
-		eventBus.broadcast(new LifecycleEvent(MIGRATING_DATABASE));
-	}
-
 	@Override
 	public void stopServices() {
 		try {
@@ -210,8 +180,7 @@ class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
 		}
 		try {
 			LOG.info("Stopping services");
-			state = STOPPING;
+			eventBus.broadcast(new ShutdownEvent());
-			eventBus.broadcast(new LifecycleEvent(STOPPING));
 			for (Service s : services) {
 				long start = System.currentTimeMillis();
 				s.stopService();
@@ -256,8 +225,4 @@ class LifecycleManagerImpl implements LifecycleManager, MigrationListener {
 		shutdownLatch.await();
 	}
 
-	@Override
-	public LifecycleState getLifecycleState() {
-		return state;
-	}
 }

bramble-core/src/main/java/org/briarproject/bramble/plugin/ConnectionManagerImpl.java

@@ -247,12 +247,12 @@ class ConnectionManagerImpl implements ConnectionManager {
 				ctx = keyManager.getStreamContext(transportId, tag);
 			} catch (IOException | DbException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeReader(true, false);
+				dispose(true, false);
 				return;
 			}
 			if (ctx == null) {
 				LOG.info("Unrecognised tag");
-				disposeReader(false, false);
+				dispose(false, false);
 				return;
 			}
 			contactId = ctx.getContactId();
@@ -263,10 +263,10 @@ class ConnectionManagerImpl implements ConnectionManager {
 				// Create and run the incoming session
 				incomingSession = createIncomingSession(ctx, reader);
 				incomingSession.run();
-				disposeReader(false, true);
+				dispose(false, true);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeReader(true, true);
+				dispose(true, true);
 			} finally {
 				connectionRegistry.unregisterConnection(contactId, transportId,
 						true);
@@ -280,39 +280,28 @@ class ConnectionManagerImpl implements ConnectionManager {
 				ctx = keyManager.getStreamContext(contactId, transportId);
 			} catch (DbException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeWriter(true);
+				dispose(true, true);
 				return;
 			}
 			if (ctx == null) {
 				LOG.warning("Could not allocate stream context");
-				disposeWriter(true);
+				dispose(true, true);
 				return;
 			}
 			try {
 				// Create and run the outgoing session
 				outgoingSession = createDuplexOutgoingSession(ctx, writer);
 				outgoingSession.run();
-				disposeWriter(false);
+				dispose(false, true);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeWriter(true);
+				dispose(true, true);
 			}
 		}
 
-		private void disposeReader(boolean exception, boolean recognised) {
+		private void dispose(boolean exception, boolean recognised) {
-			if (exception && outgoingSession != null)
-				outgoingSession.interrupt();
 			try {
 				reader.dispose(exception, recognised);
-			} catch (IOException e) {
-				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-			}
-		}
-
-		private void disposeWriter(boolean exception) {
-			if (exception && incomingSession != null)
-				incomingSession.interrupt();
-			try {
 				writer.dispose(exception);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
@@ -346,12 +335,12 @@ class ConnectionManagerImpl implements ConnectionManager {
 				ctx = keyManager.getStreamContext(contactId, transportId);
 			} catch (DbException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeWriter(true);
+				dispose(true);
 				return;
 			}
 			if (ctx == null) {
 				LOG.warning("Could not allocate stream context");
-				disposeWriter(true);
+				dispose(true);
 				return;
 			}
 			// Start the incoming session on another thread
@@ -360,10 +349,10 @@ class ConnectionManagerImpl implements ConnectionManager {
 				// Create and run the outgoing session
 				outgoingSession = createDuplexOutgoingSession(ctx, writer);
 				outgoingSession.run();
-				disposeWriter(false);
+				dispose(false);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeWriter(true);
+				dispose(true);
 			}
 		}
 
@@ -375,19 +364,19 @@ class ConnectionManagerImpl implements ConnectionManager {
 				ctx = keyManager.getStreamContext(transportId, tag);
 			} catch (IOException | DbException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeReader(true, false);
+				dispose(true);
 				return;
 			}
 			// Unrecognised tags are suspicious in this case
 			if (ctx == null) {
 				LOG.warning("Unrecognised tag for returning stream");
-				disposeReader(true, false);
+				dispose(true);
 				return;
 			}
 			// Check that the stream comes from the expected contact
 			if (!ctx.getContactId().equals(contactId)) {
 				LOG.warning("Wrong contact ID for returning stream");
-				disposeReader(true, true);
+				dispose(true);
 				return;
 			}
 			connectionRegistry.registerConnection(contactId, transportId,
@@ -396,30 +385,20 @@ class ConnectionManagerImpl implements ConnectionManager {
 				// Create and run the incoming session
 				incomingSession = createIncomingSession(ctx, reader);
 				incomingSession.run();
-				disposeReader(false, true);
+				dispose(false);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-				disposeReader(true, true);
+				dispose(true);
 			} finally {
 				connectionRegistry.unregisterConnection(contactId, transportId,
 						false);
 			}
 		}
 
-		private void disposeReader(boolean exception, boolean recognised) {
+		private void dispose(boolean exception) {
-			if (exception && outgoingSession != null)
-				outgoingSession.interrupt();
-			try {
-				reader.dispose(exception, recognised);
-			} catch (IOException e) {
-				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
-			}
-		}
-
-		private void disposeWriter(boolean exception) {
-			if (exception && incomingSession != null)
-				incomingSession.interrupt();
 			try {
+				// 'Recognised' is always true because we opened the connection
+				reader.dispose(exception, true);
 				writer.dispose(exception);
 			} catch (IOException e) {
 				if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);

bramble-core/src/main/java/org/briarproject/bramble/plugin/ConnectionRegistryImpl.java

@@ -1,5 +1,6 @@
 package org.briarproject.bramble.plugin;
 
+import org.briarproject.bramble.api.Multiset;
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
@@ -36,14 +37,14 @@ class ConnectionRegistryImpl implements ConnectionRegistry {
 	private final Lock lock = new ReentrantLock();
 
 	// The following are locking: lock
-	private final Map<TransportId, Map<ContactId, Integer>> connections;
+	private final Map<TransportId, Multiset<ContactId>> connections;
-	private final Map<ContactId, Integer> contactCounts;
+	private final Multiset<ContactId> contactCounts;
 
 	@Inject
 	ConnectionRegistryImpl(EventBus eventBus) {
 		this.eventBus = eventBus;
 		connections = new HashMap<>();
-		contactCounts = new HashMap<>();
+		contactCounts = new Multiset<>();
 	}
 
 	@Override
@@ -56,21 +57,13 @@ class ConnectionRegistryImpl implements ConnectionRegistry {
 		boolean firstConnection = false;
 		lock.lock();
 		try {
-			Map<ContactId, Integer> m = connections.get(t);
+			Multiset<ContactId> m = connections.get(t);
 			if (m == null) {
-				m = new HashMap<>();
+				m = new Multiset<>();
 				connections.put(t, m);
 			}
-			Integer count = m.get(c);
+			m.add(c);
-			if (count == null) m.put(c, 1);
+			if (contactCounts.add(c) == 1) firstConnection = true;
-			else m.put(c, count + 1);
-			count = contactCounts.get(c);
-			if (count == null) {
-				firstConnection = true;
-				contactCounts.put(c, 1);
-			} else {
-				contactCounts.put(c, count + 1);
-			}
 		} finally {
 			lock.unlock();
 		}
@@ -91,23 +84,10 @@ class ConnectionRegistryImpl implements ConnectionRegistry {
 		boolean lastConnection = false;
 		lock.lock();
 		try {
-			Map<ContactId, Integer> m = connections.get(t);
+			Multiset<ContactId> m = connections.get(t);
 			if (m == null) throw new IllegalArgumentException();
-			Integer count = m.remove(c);
+			m.remove(c);
-			if (count == null) throw new IllegalArgumentException();
+			if (contactCounts.remove(c) == 0) lastConnection = true;
-			if (count == 1) {
-				if (m.isEmpty()) connections.remove(t);
-			} else {
-				m.put(c, count - 1);
-			}
-			count = contactCounts.get(c);
-			if (count == null) throw new IllegalArgumentException();
-			if (count == 1) {
-				lastConnection = true;
-				contactCounts.remove(c);
-			} else {
-				contactCounts.put(c, count - 1);
-			}
 		} finally {
 			lock.unlock();
 		}
@@ -122,7 +102,7 @@ class ConnectionRegistryImpl implements ConnectionRegistry {
 	public Collection<ContactId> getConnectedContacts(TransportId t) {
 		lock.lock();
 		try {
-			Map<ContactId, Integer> m = connections.get(t);
+			Multiset<ContactId> m = connections.get(t);
 			if (m == null) return Collections.emptyList();
 			List<ContactId> ids = new ArrayList<>(m.keySet());
 			if (LOG.isLoggable(INFO))
@@ -137,8 +117,8 @@ class ConnectionRegistryImpl implements ConnectionRegistry {
 	public boolean isConnected(ContactId c, TransportId t) {
 		lock.lock();
 		try {
-			Map<ContactId, Integer> m = connections.get(t);
+			Multiset<ContactId> m = connections.get(t);
-			return m != null && m.containsKey(c);
+			return m != null && m.contains(c);
 		} finally {
 			lock.unlock();
 		}
@@ -148,7 +128,7 @@ class ConnectionRegistryImpl implements ConnectionRegistry {
 	public boolean isConnected(ContactId c) {
 		lock.lock();
 		try {
-			return contactCounts.containsKey(c);
+			return contactCounts.contains(c);
 		} finally {
 			lock.unlock();
 		}

bramble-core/src/main/java/org/briarproject/bramble/plugin/bluetooth/BluetoothConnectionManager.java

@@ -0,0 +1,36 @@
+package org.briarproject.bramble.plugin.bluetooth;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
+
+@NotNullByDefault
+interface BluetoothConnectionManager {
+
+	/**
+	 * Returns true if a contact connection can be opened without exceeding
+	 * the connection limit. This method does not need to be called for key
+	 * exchange connections.
+	 */
+	boolean canOpenConnection();
+
+	/**
+	 * Passes a newly opened connection to the manager. The manager may close
+	 * the new connection or another connection to stay within the connection
+	 * limit.
+	 * <p/>
+	 * Returns false if the manager has closed the new connection (this will
+	 * never be the case for key exchange connections).
+	 */
+	boolean connectionOpened(DuplexTransportConnection conn,
+			boolean isForKeyExchange);
+
+	/**
+	 * Informs the manager that the given connection has been closed.
+	 */
+	void connectionClosed(DuplexTransportConnection conn);
+
+	/**
+	 * Informs the manager that all connections have been closed.
+	 */
+	void allConnectionsClosed();
+}

bramble-core/src/main/java/org/briarproject/bramble/plugin/bluetooth/BluetoothConnectionManagerImpl.java

@@ -0,0 +1,88 @@
+package org.briarproject.bramble.plugin.bluetooth;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
+
+import java.io.IOException;
+import java.util.LinkedList;
+import java.util.logging.Logger;
+
+import javax.annotation.concurrent.ThreadSafe;
+
+import static java.util.logging.Level.INFO;
+
+@NotNullByDefault
+@ThreadSafe
+class BluetoothConnectionManagerImpl implements BluetoothConnectionManager {
+
+	private static final int MAX_OPEN_CONNECTIONS = 5;
+
+	private static final Logger LOG =
+			Logger.getLogger(BluetoothConnectionManagerImpl.class.getName());
+
+	private final Object lock = new Object();
+	private final LinkedList<DuplexTransportConnection> connections =
+			new LinkedList<>(); // Locking: lock
+
+	@Override
+	public boolean canOpenConnection() {
+		synchronized (lock) {
+			int open = connections.size();
+			if (LOG.isLoggable(INFO)) LOG.info(open + " open connections");
+			return open < MAX_OPEN_CONNECTIONS;
+		}
+	}
+
+	@Override
+	public boolean connectionOpened(DuplexTransportConnection conn,
+			boolean isForKeyExchange) {
+		DuplexTransportConnection close = null;
+		synchronized (lock) {
+			int open = connections.size();
+			boolean accept = isForKeyExchange || open < MAX_OPEN_CONNECTIONS;
+			if (accept) {
+				if (LOG.isLoggable(INFO))
+					LOG.info("Accepting connection, " + (open + 1) + " open");
+				connections.add(conn);
+				if (open == MAX_OPEN_CONNECTIONS) {
+					LOG.info("Closing old connection to stay within limit");
+					close = connections.poll();
+				}
+			} else {
+				if (LOG.isLoggable(INFO))
+					LOG.info("Refusing connection, " + open + " open");
+				close = conn;
+			}
+		}
+		if (close != null) tryToClose(close);
+		return close != conn;
+	}
+
+	private void tryToClose(DuplexTransportConnection conn) {
+		try {
+			conn.getReader().dispose(false, true);
+			conn.getWriter().dispose(false);
+		} catch (IOException e) {
+			if (LOG.isLoggable(INFO)) LOG.log(INFO, e.toString(), e);
+		}
+	}
+
+	@Override
+	public void connectionClosed(DuplexTransportConnection conn) {
+		synchronized (lock) {
+			connections.remove(conn);
+			if (LOG.isLoggable(INFO)) {
+				int open = connections.size();
+				LOG.info("Connection closed, " + open + " open");
+			}
+		}
+	}
+
+	@Override
+	public void allConnectionsClosed() {
+		synchronized (lock) {
+			connections.clear();
+			LOG.info("All connections closed");
+		}
+	}
+}

bramble-core/src/main/java/org/briarproject/bramble/plugin/bluetooth/BluetoothPlugin.java

@@ -51,6 +51,8 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 	private static final Logger LOG =
 			Logger.getLogger(BluetoothPlugin.class.getName());
 
+	protected final BluetoothConnectionManager connectionManager;
+
 	private final Executor ioExecutor;
 	private final SecureRandom secureRandom;
 	private final Backoff backoff;
@@ -91,8 +93,10 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 	abstract DuplexTransportConnection connectTo(String address, String uuid)
 			throws IOException;
 
-	BluetoothPlugin(Executor ioExecutor, SecureRandom secureRandom,
+	BluetoothPlugin(BluetoothConnectionManager connectionManager,
+			Executor ioExecutor, SecureRandom secureRandom,
 			Backoff backoff, DuplexPluginCallback callback, int maxLatency) {
+		this.connectionManager = connectionManager;
 		this.ioExecutor = ioExecutor;
 		this.secureRandom = secureRandom;
 		this.backoff = backoff;
@@ -110,6 +114,7 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 	void onAdapterDisabled() {
 		LOG.info("Bluetooth disabled");
 		tryToClose(socket);
+		connectionManager.allConnectionsClosed();
 		callback.transportDisabled();
 	}
 
@@ -213,7 +218,8 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 				return;
 			}
 			backoff.reset();
-			callback.incomingConnectionCreated(conn);
+			if (connectionManager.connectionOpened(conn, false))
+				callback.incomingConnectionCreated(conn);
 			if (!running) return;
 		}
 	}
@@ -257,10 +263,15 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 			if (StringUtils.isNullOrEmpty(uuid)) continue;
 			ioExecutor.execute(() -> {
 				if (!isRunning() || !shouldAllowContactConnections()) return;
+				if (!connectionManager.canOpenConnection()) {
+					LOG.info("Not connecting, too many open connections");
+					return;
+				}
 				DuplexTransportConnection conn = connect(address, uuid);
 				if (conn != null) {
 					backoff.reset();
-					callback.outgoingConnectionCreated(c, conn);
+					if (connectionManager.connectionOpened(conn, false))
+						callback.outgoingConnectionCreated(c, conn);
 				}
 			});
 		}
@@ -300,12 +311,19 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 	@Override
 	public DuplexTransportConnection createConnection(ContactId c) {
 		if (!isRunning() || !shouldAllowContactConnections()) return null;
+		if (!connectionManager.canOpenConnection()) {
+			LOG.info("Not connecting, too many open connections");
+			return null;
+		}
 		TransportProperties p = callback.getRemoteProperties(c);
 		String address = p.get(PROP_ADDRESS);
 		if (StringUtils.isNullOrEmpty(address)) return null;
 		String uuid = p.get(PROP_UUID);
 		if (StringUtils.isNullOrEmpty(uuid)) return null;
-		return connect(address, uuid);
+		DuplexTransportConnection conn = connect(address, uuid);
+		if (conn == null) return null;
+		// TODO: Why don't we reset the backoff here?
+		return connectionManager.connectionOpened(conn, false) ? conn : null;
 	}
 
 	@Override
@@ -355,7 +373,10 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 		String uuid = UUID.nameUUIDFromBytes(commitment).toString();
 		if (LOG.isLoggable(INFO))
 			LOG.info("Connecting to key agreement UUID " + uuid);
-		return connect(address, uuid);
+		DuplexTransportConnection conn = connect(address, uuid);
+		// The connection limit doesn't apply to key agreement
+		if (conn != null) connectionManager.connectionOpened(conn, true);
+		return conn;
 	}
 
 	private String parseAddress(BdfList descriptor) throws FormatException {
@@ -408,6 +429,8 @@ abstract class BluetoothPlugin<SS> implements DuplexPlugin, EventListener {
 		public KeyAgreementConnection accept() throws IOException {
 			DuplexTransportConnection conn = acceptConnection(ss);
 			if (LOG.isLoggable(INFO)) LOG.info(ID + ": Incoming connection");
+			// The connection limit doesn't apply to key agreement
+			connectionManager.connectionOpened(conn, true);
 			return new KeyAgreementConnection(conn, ID);
 		}
 

bramble-core/src/main/java/org/briarproject/bramble/plugin/tcp/LanTcpPlugin.java

@@ -241,11 +241,10 @@ class LanTcpPlugin extends TcpPlugin {
 			}
 			return null;
 		}
+		Socket s = new Socket();
 		try {
 			if (LOG.isLoggable(INFO))
 				LOG.info("Connecting to " + scrubSocketAddress(remote));
-			Socket s = createSocket();
-			s.bind(new InetSocketAddress(socket.getInetAddress(), 0));
 			s.connect(remote);
 			s.setSoTimeout(socketTimeout);
 			if (LOG.isLoggable(INFO))

bramble-core/src/main/java/org/briarproject/bramble/plugin/tcp/TcpPlugin.java

@@ -1,6 +1,5 @@
 package org.briarproject.bramble.plugin.tcp;
 
-import org.briarproject.bramble.PoliteExecutor;
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.data.BdfList;
 import org.briarproject.bramble.api.keyagreement.KeyAgreementListener;
@@ -48,7 +47,7 @@ abstract class TcpPlugin implements DuplexPlugin {
 	private static final Logger LOG =
 			Logger.getLogger(TcpPlugin.class.getName());
 
-	protected final Executor ioExecutor, bindExecutor;
+	protected final Executor ioExecutor;
 	protected final Backoff backoff;
 	protected final DuplexPluginCallback callback;
 	protected final int maxLatency, maxIdleTime, socketTimeout;
@@ -91,8 +90,6 @@ abstract class TcpPlugin implements DuplexPlugin {
 		if (maxIdleTime > Integer.MAX_VALUE / 2)
 			socketTimeout = Integer.MAX_VALUE;
 		else socketTimeout = maxIdleTime * 2;
-		// Don't execute more than one bind operation at a time
-		bindExecutor = new PoliteExecutor("TcpPlugin", ioExecutor, 1);
 	}
 
 	@Override
@@ -113,9 +110,8 @@ abstract class TcpPlugin implements DuplexPlugin {
 	}
 
 	protected void bind() {
-		bindExecutor.execute(() -> {
+		ioExecutor.execute(() -> {
 			if (!running) return;
-			if (socket != null && !socket.isClosed()) return;
 			ServerSocket ss = null;
 			for (InetSocketAddress addr : getLocalSocketAddresses()) {
 				try {
@@ -247,11 +243,10 @@ abstract class TcpPlugin implements DuplexPlugin {
 				}
 				continue;
 			}
+			Socket s = new Socket();
 			try {
 				if (LOG.isLoggable(INFO))
 					LOG.info("Connecting to " + scrubSocketAddress(remote));
-				Socket s = createSocket();
-				s.bind(new InetSocketAddress(socket.getInetAddress(), 0));
 				s.connect(remote);
 				s.setSoTimeout(socketTimeout);
 				if (LOG.isLoggable(INFO))
@@ -266,10 +261,6 @@ abstract class TcpPlugin implements DuplexPlugin {
 		return null;
 	}
 
-	protected Socket createSocket() throws IOException {
-		return new Socket();
-	}
-
 	@Nullable
 	InetSocketAddress parseSocketAddress(String ipPort) {
 		if (StringUtils.isNullOrEmpty(ipPort)) return null;

bramble-core/src/main/java/org/briarproject/bramble/properties/TransportPropertyManagerImpl.java

@@ -58,7 +58,8 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 		this.metadataParser = metadataParser;
 		this.contactGroupFactory = contactGroupFactory;
 		this.clock = clock;
-		localGroup = contactGroupFactory.createLocalGroup(CLIENT_ID);
+		localGroup = contactGroupFactory.createLocalGroup(CLIENT_ID,
+				CLIENT_VERSION);
 	}
 
 	@Override
@@ -130,8 +131,7 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 	public Map<TransportId, TransportProperties> getLocalProperties()
 			throws DbException {
 		Map<TransportId, TransportProperties> local;
-		// TODO: Transaction can be read-only when code is simplified
+		Transaction txn = db.startTransaction(true);
-		Transaction txn = db.startTransaction(false);
 		try {
 			local = getLocalProperties(txn);
 			db.commitTransaction(txn);
@@ -166,8 +166,7 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 			throws DbException {
 		try {
 			TransportProperties p = null;
-			// TODO: Transaction can be read-only when code is simplified
+			Transaction txn = db.startTransaction(true);
-			Transaction txn = db.startTransaction(false);
 			try {
 				// Find the latest local update
 				LatestUpdate latest = findLatest(txn, localGroup.getId(), t,
@@ -193,8 +192,7 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 	public Map<ContactId, TransportProperties> getRemoteProperties(
 			TransportId t) throws DbException {
 		Map<ContactId, TransportProperties> remote = new HashMap<>();
-		// TODO: Transaction can be read-only when code is simplified
+		Transaction txn = db.startTransaction(true);
-		Transaction txn = db.startTransaction(false);
 		try {
 			for (Contact c : db.getContacts(txn))
 				remote.put(c.getId(), getRemoteProperties(txn, c, t));
@@ -228,8 +226,7 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 	public TransportProperties getRemoteProperties(ContactId c, TransportId t)
 			throws DbException {
 		TransportProperties p;
-		// TODO: Transaction can be read-only when code is simplified
+		Transaction txn = db.startTransaction(true);
-		Transaction txn = db.startTransaction(false);
 		try {
 			p = getRemoteProperties(txn, db.getContact(txn, c), t);
 			db.commitTransaction(txn);
@@ -292,7 +289,8 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 	}
 
 	private Group getContactGroup(Contact c) {
-		return contactGroupFactory.createContactGroup(CLIENT_ID, c);
+		return contactGroupFactory.createContactGroup(CLIENT_ID,
+				CLIENT_VERSION, c);
 	}
 
 	private void storeMessage(Transaction txn, GroupId g, TransportId t,
@@ -319,7 +317,6 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 
 	private Map<TransportId, LatestUpdate> findLatestLocal(Transaction txn)
 			throws DbException, FormatException {
-		// TODO: This can be simplified before 1.0
 		Map<TransportId, LatestUpdate> latestUpdates = new HashMap<>();
 		Map<MessageId, BdfDictionary> metadata = clientHelper
 				.getMessageMetadataAsDictionary(txn, localGroup.getId());
@@ -327,17 +324,7 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 			BdfDictionary meta = e.getValue();
 			TransportId t = new TransportId(meta.getString("transportId"));
 			long version = meta.getLong("version");
-			LatestUpdate latest = latestUpdates.get(t);
+			latestUpdates.put(t, new LatestUpdate(e.getKey(), version));
-			if (latest == null) {
-				latestUpdates.put(t, new LatestUpdate(e.getKey(), version));
-			} else if (version > latest.version) {
-				// This update is newer - delete the previous one
-				db.removeMessage(txn, latest.messageId);
-				latestUpdates.put(t, new LatestUpdate(e.getKey(), version));
-			} else {
-				// We've already found a newer update - delete this one
-				db.removeMessage(txn, e.getKey());
-			}
 		}
 		return latestUpdates;
 	}
@@ -345,38 +332,16 @@ class TransportPropertyManagerImpl implements TransportPropertyManager,
 	@Nullable
 	private LatestUpdate findLatest(Transaction txn, GroupId g, TransportId t,
 			boolean local) throws DbException, FormatException {
-		// TODO: This can be simplified before 1.0
-		LatestUpdate latest = null;
 		Map<MessageId, BdfDictionary> metadata =
 				clientHelper.getMessageMetadataAsDictionary(txn, g);
 		for (Entry<MessageId, BdfDictionary> e : metadata.entrySet()) {
 			BdfDictionary meta = e.getValue();
 			if (meta.getString("transportId").equals(t.getString())
 					&& meta.getBoolean("local") == local) {
-				long version = meta.getLong("version");
+				return new LatestUpdate(e.getKey(), meta.getLong("version"));
-				if (latest == null) {
-					latest = new LatestUpdate(e.getKey(), version);
-				} else if (version > latest.version) {
-					// This update is newer - delete the previous one
-					if (local) {
-						db.removeMessage(txn, latest.messageId);
-					} else {
-						db.deleteMessage(txn, latest.messageId);
-						db.deleteMessageMetadata(txn, latest.messageId);
-					}
-					latest = new LatestUpdate(e.getKey(), version);
-				} else {
-					// We've already found a newer update - delete this one
-					if (local) {
-						db.removeMessage(txn, e.getKey());
-					} else {
-						db.deleteMessage(txn, e.getKey());
-						db.deleteMessageMetadata(txn, e.getKey());
-					}
-				}
 			}
 		}
-		return latest;
+		return null;
 	}
 
 	private TransportProperties parseProperties(BdfList message)

bramble-core/src/main/java/org/briarproject/bramble/sync/DuplexOutgoingSession.java

@@ -10,7 +10,7 @@ import org.briarproject.bramble.api.event.Event;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.event.EventListener;
 import org.briarproject.bramble.api.lifecycle.IoExecutor;
-import org.briarproject.bramble.api.lifecycle.event.LifecycleEvent;
+import org.briarproject.bramble.api.lifecycle.event.ShutdownEvent;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.Ack;
 import org.briarproject.bramble.api.sync.Offer;
@@ -38,7 +38,6 @@ import javax.annotation.concurrent.ThreadSafe;
 import static java.util.concurrent.TimeUnit.MILLISECONDS;
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.STOPPING;
 import static org.briarproject.bramble.api.sync.SyncConstants.MAX_MESSAGE_IDS;
 import static org.briarproject.bramble.api.sync.SyncConstants.MAX_RECORD_PAYLOAD_LENGTH;
 
@@ -210,9 +209,8 @@ class DuplexOutgoingSession implements SyncSession, EventListener {
 		} else if (e instanceof MessageToRequestEvent) {
 			if (((MessageToRequestEvent) e).getContactId().equals(contactId))
 				generateRequest();
-		} else if (e instanceof LifecycleEvent) {
+		} else if (e instanceof ShutdownEvent) {
-			LifecycleEvent l = (LifecycleEvent) e;
+			interrupt();
-			if (l.getLifecycleState() == STOPPING) interrupt();
 		}
 	}
 

bramble-core/src/main/java/org/briarproject/bramble/sync/GroupFactoryImpl.java

@@ -6,11 +6,16 @@ import org.briarproject.bramble.api.sync.ClientId;
 import org.briarproject.bramble.api.sync.Group;
 import org.briarproject.bramble.api.sync.GroupFactory;
 import org.briarproject.bramble.api.sync.GroupId;
+import org.briarproject.bramble.util.ByteUtils;
 import org.briarproject.bramble.util.StringUtils;
 
 import javax.annotation.concurrent.Immutable;
 import javax.inject.Inject;
 
+import static org.briarproject.bramble.api.sync.GroupId.LABEL;
+import static org.briarproject.bramble.api.sync.SyncConstants.PROTOCOL_VERSION;
+import static org.briarproject.bramble.util.ByteUtils.INT_32_BYTES;
+
 @Immutable
 @NotNullByDefault
 class GroupFactoryImpl implements GroupFactory {
@@ -23,9 +28,12 @@ class GroupFactoryImpl implements GroupFactory {
 	}
 
 	@Override
-	public Group createGroup(ClientId c, byte[] descriptor) {
+	public Group createGroup(ClientId c, int clientVersion, byte[] descriptor) {
-		byte[] hash = crypto.hash(GroupId.LABEL,
+		byte[] clientVersionBytes = new byte[INT_32_BYTES];
-				StringUtils.toUtf8(c.getString()), descriptor);
+		ByteUtils.writeUint32(clientVersion, clientVersionBytes, 0);
+		byte[] hash = crypto.hash(LABEL, new byte[] {PROTOCOL_VERSION},
+				StringUtils.toUtf8(c.getString()), clientVersionBytes,
+				descriptor);
 		return new Group(new GroupId(hash), c, descriptor);
 	}
 }

bramble-core/src/main/java/org/briarproject/bramble/sync/IncomingSession.java

@@ -11,7 +11,7 @@ import org.briarproject.bramble.api.event.Event;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.event.EventListener;
 import org.briarproject.bramble.api.lifecycle.IoExecutor;
-import org.briarproject.bramble.api.lifecycle.event.LifecycleEvent;
+import org.briarproject.bramble.api.lifecycle.event.ShutdownEvent;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.Ack;
 import org.briarproject.bramble.api.sync.Message;
@@ -27,7 +27,6 @@ import java.util.logging.Logger;
 import javax.annotation.concurrent.ThreadSafe;
 
 import static java.util.logging.Level.WARNING;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.STOPPING;
 
 /**
  * An incoming {@link SyncSession}.
@@ -97,9 +96,8 @@ class IncomingSession implements SyncSession, EventListener {
 		if (e instanceof ContactRemovedEvent) {
 			ContactRemovedEvent c = (ContactRemovedEvent) e;
 			if (c.getContactId().equals(contactId)) interrupt();
-		} else if (e instanceof LifecycleEvent) {
+		} else if (e instanceof ShutdownEvent) {
-			LifecycleEvent l = (LifecycleEvent) e;
+			interrupt();
-			if (l.getLifecycleState() == STOPPING) interrupt();
 		}
 	}
 

bramble-core/src/main/java/org/briarproject/bramble/sync/MessageFactoryImpl.java

@@ -12,8 +12,10 @@ import org.briarproject.bramble.util.ByteUtils;
 import javax.annotation.concurrent.Immutable;
 import javax.inject.Inject;
 
+import static org.briarproject.bramble.api.sync.MessageId.LABEL;
 import static org.briarproject.bramble.api.sync.SyncConstants.MAX_MESSAGE_BODY_LENGTH;
 import static org.briarproject.bramble.api.sync.SyncConstants.MESSAGE_HEADER_LENGTH;
+import static org.briarproject.bramble.api.sync.SyncConstants.PROTOCOL_VERSION;
 
 @Immutable
 @NotNullByDefault
@@ -32,9 +34,9 @@ class MessageFactoryImpl implements MessageFactory {
 			throw new IllegalArgumentException();
 		byte[] timeBytes = new byte[ByteUtils.INT_64_BYTES];
 		ByteUtils.writeUint64(timestamp, timeBytes, 0);
-		byte[] idHash =
+		byte[] hash = crypto.hash(LABEL, new byte[] {PROTOCOL_VERSION},
-				crypto.hash(MessageId.LABEL, g.getBytes(), timeBytes, body);
+				g.getBytes(), timeBytes, body);
-		MessageId id = new MessageId(idHash);
+		MessageId id = new MessageId(hash);
 		byte[] raw = new byte[MESSAGE_HEADER_LENGTH + body.length];
 		System.arraycopy(g.getBytes(), 0, raw, 0, UniqueId.LENGTH);
 		ByteUtils.writeUint64(timestamp, raw, UniqueId.LENGTH);

bramble-core/src/main/java/org/briarproject/bramble/sync/SimplexOutgoingSession.java

@@ -10,7 +10,7 @@ import org.briarproject.bramble.api.event.Event;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.event.EventListener;
 import org.briarproject.bramble.api.lifecycle.IoExecutor;
-import org.briarproject.bramble.api.lifecycle.event.LifecycleEvent;
+import org.briarproject.bramble.api.lifecycle.event.ShutdownEvent;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.Ack;
 import org.briarproject.bramble.api.sync.RecordWriter;
@@ -28,7 +28,6 @@ import javax.annotation.concurrent.ThreadSafe;
 
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
-import static org.briarproject.bramble.api.lifecycle.LifecycleManager.LifecycleState.STOPPING;
 import static org.briarproject.bramble.api.sync.SyncConstants.MAX_MESSAGE_IDS;
 import static org.briarproject.bramble.api.sync.SyncConstants.MAX_RECORD_PAYLOAD_LENGTH;
 
@@ -110,9 +109,8 @@ class SimplexOutgoingSession implements SyncSession, EventListener {
 		if (e instanceof ContactRemovedEvent) {
 			ContactRemovedEvent c = (ContactRemovedEvent) e;
 			if (c.getContactId().equals(contactId)) interrupt();
-		} else if (e instanceof LifecycleEvent) {
+		} else if (e instanceof ShutdownEvent) {
-			LifecycleEvent l = (LifecycleEvent) e;
+			interrupt();
-			if (l.getLifecycleState() == STOPPING) interrupt();
 		}
 	}
 

bramble-core/src/main/java/org/briarproject/bramble/sync/ValidationManagerImpl.java

@@ -71,9 +71,11 @@ class ValidationManagerImpl implements ValidationManager, Service,
 	@Override
 	public void startService() {
 		if (used.getAndSet(true)) throw new IllegalStateException();
-		validateOutstandingMessagesAsync();
+		for (ClientId c : validators.keySet()) {
-		deliverOutstandingMessagesAsync();
+			validateOutstandingMessagesAsync(c);
-		shareOutstandingMessagesAsync();
+			deliverOutstandingMessagesAsync(c);
+			shareOutstandingMessagesAsync(c);
+		}
 	}
 
 	@Override
@@ -91,17 +93,17 @@ class ValidationManagerImpl implements ValidationManager, Service,
 		hooks.put(c, hook);
 	}
 
-	private void validateOutstandingMessagesAsync() {
+	private void validateOutstandingMessagesAsync(ClientId c) {
-		dbExecutor.execute(this::validateOutstandingMessages);
+		dbExecutor.execute(() -> validateOutstandingMessages(c));
 	}
 
 	@DatabaseExecutor
-	private void validateOutstandingMessages() {
+	private void validateOutstandingMessages(ClientId c) {
 		try {
 			Queue<MessageId> unvalidated = new LinkedList<>();
 			Transaction txn = db.startTransaction(true);
 			try {
-				unvalidated.addAll(db.getMessagesToValidate(txn));
+				unvalidated.addAll(db.getMessagesToValidate(txn, c));
 				db.commitTransaction(txn);
 			} finally {
 				db.endTransaction(txn);
@@ -146,17 +148,17 @@ class ValidationManagerImpl implements ValidationManager, Service,
 		}
 	}
 
-	private void deliverOutstandingMessagesAsync() {
+	private void deliverOutstandingMessagesAsync(ClientId c) {
-		dbExecutor.execute(this::deliverOutstandingMessages);
+		dbExecutor.execute(() -> deliverOutstandingMessages(c));
 	}
 
 	@DatabaseExecutor
-	private void deliverOutstandingMessages() {
+	private void deliverOutstandingMessages(ClientId c) {
 		try {
 			Queue<MessageId> pending = new LinkedList<>();
 			Transaction txn = db.startTransaction(true);
 			try {
-				pending.addAll(db.getPendingMessages(txn));
+				pending.addAll(db.getPendingMessages(txn, c));
 				db.commitTransaction(txn);
 			} finally {
 				db.endTransaction(txn);
@@ -351,17 +353,17 @@ class ValidationManagerImpl implements ValidationManager, Service,
 		return pending;
 	}
 
-	private void shareOutstandingMessagesAsync() {
+	private void shareOutstandingMessagesAsync(ClientId c) {
-		dbExecutor.execute(this::shareOutstandingMessages);
+		dbExecutor.execute(() -> shareOutstandingMessages(c));
 	}
 
 	@DatabaseExecutor
-	private void shareOutstandingMessages() {
+	private void shareOutstandingMessages(ClientId c) {
 		try {
 			Queue<MessageId> toShare = new LinkedList<>();
 			Transaction txn = db.startTransaction(true);
 			try {
-				toShare.addAll(db.getMessagesToShare(txn));
+				toShare.addAll(db.getMessagesToShare(txn, c));
 				db.commitTransaction(txn);
 			} finally {
 				db.endTransaction(txn);

bramble-core/src/main/java/org/briarproject/bramble/system/SystemModule.java

@@ -4,9 +4,8 @@ import org.briarproject.bramble.api.lifecycle.LifecycleManager;
 import org.briarproject.bramble.api.system.Clock;
 import org.briarproject.bramble.api.system.Scheduler;
 
-import java.util.concurrent.RejectedExecutionHandler;
+import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.ScheduledThreadPoolExecutor;
 
 import javax.inject.Inject;
 import javax.inject.Singleton;
@@ -26,10 +25,7 @@ public class SystemModule {
 	private final ScheduledExecutorService scheduler;
 
 	public SystemModule() {
-		// Discard tasks that are submitted during shutdown
+		scheduler = Executors.newSingleThreadScheduledExecutor();
-		RejectedExecutionHandler policy =
-				new ScheduledThreadPoolExecutor.DiscardPolicy();
-		scheduler = new ScheduledThreadPoolExecutor(1, policy);
 	}
 
 	@Provides

bramble-core/src/main/java/org/briarproject/bramble/transport/TransportKeyManagerFactoryImpl.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.transport;
 
-import org.briarproject.bramble.api.crypto.CryptoComponent;
+import org.briarproject.bramble.api.crypto.TransportCrypto;
 import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.DatabaseExecutor;
 import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
@@ -20,17 +20,18 @@ class TransportKeyManagerFactoryImpl implements
 		TransportKeyManagerFactory {
 
 	private final DatabaseComponent db;
-	private final CryptoComponent crypto;
+	private final TransportCrypto transportCrypto;
 	private final Executor dbExecutor;
 	private final ScheduledExecutorService scheduler;
 	private final Clock clock;
 
 	@Inject
-	TransportKeyManagerFactoryImpl(DatabaseComponent db, CryptoComponent crypto,
+	TransportKeyManagerFactoryImpl(DatabaseComponent db,
+			TransportCrypto transportCrypto,
 			@DatabaseExecutor Executor dbExecutor,
 			@Scheduler ScheduledExecutorService scheduler, Clock clock) {
 		this.db = db;
-		this.crypto = crypto;
+		this.transportCrypto = transportCrypto;
 		this.dbExecutor = dbExecutor;
 		this.scheduler = scheduler;
 		this.clock = clock;
@@ -39,8 +40,8 @@ class TransportKeyManagerFactoryImpl implements
 	@Override
 	public TransportKeyManager createTransportKeyManager(
 			TransportId transportId, long maxLatency) {
-		return new TransportKeyManagerImpl(db, crypto, dbExecutor, scheduler,
+		return new TransportKeyManagerImpl(db, transportCrypto, dbExecutor,
-				clock, transportId, maxLatency);
+				scheduler, clock, transportId, maxLatency);
 	}
 
 }

bramble-core/src/main/java/org/briarproject/bramble/transport/TransportKeyManagerImpl.java

@@ -2,8 +2,8 @@ package org.briarproject.bramble.transport;
 
 import org.briarproject.bramble.api.Bytes;
 import org.briarproject.bramble.api.contact.ContactId;
-import org.briarproject.bramble.api.crypto.CryptoComponent;
 import org.briarproject.bramble.api.crypto.SecretKey;
+import org.briarproject.bramble.api.crypto.TransportCrypto;
 import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Transaction;
@@ -41,7 +41,7 @@ class TransportKeyManagerImpl implements TransportKeyManager {
 			Logger.getLogger(TransportKeyManagerImpl.class.getName());
 
 	private final DatabaseComponent db;
-	private final CryptoComponent crypto;
+	private final TransportCrypto transportCrypto;
 	private final Executor dbExecutor;
 	private final ScheduledExecutorService scheduler;
 	private final Clock clock;
@@ -54,11 +54,12 @@ class TransportKeyManagerImpl implements TransportKeyManager {
 	private final Map<ContactId, MutableOutgoingKeys> outContexts;
 	private final Map<ContactId, MutableTransportKeys> keys;
 
-	TransportKeyManagerImpl(DatabaseComponent db, CryptoComponent crypto,
+	TransportKeyManagerImpl(DatabaseComponent db,
-			Executor dbExecutor, @Scheduler ScheduledExecutorService scheduler,
+			TransportCrypto transportCrypto, Executor dbExecutor,
-			Clock clock, TransportId transportId, long maxLatency) {
+			@Scheduler ScheduledExecutorService scheduler, Clock clock,
+			TransportId transportId, long maxLatency) {
 		this.db = db;
-		this.crypto = crypto;
+		this.transportCrypto = transportCrypto;
 		this.dbExecutor = dbExecutor;
 		this.scheduler = scheduler;
 		this.clock = clock;
@@ -99,7 +100,8 @@ class TransportKeyManagerImpl implements TransportKeyManager {
 		for (Entry<ContactId, TransportKeys> e : keys.entrySet()) {
 			ContactId c = e.getKey();
 			TransportKeys k = e.getValue();
-			TransportKeys k1 = crypto.rotateTransportKeys(k, rotationPeriod);
+			TransportKeys k1 =
+					transportCrypto.rotateTransportKeys(k, rotationPeriod);
 			if (k1.getRotationPeriod() > k.getRotationPeriod())
 				rotationResult.rotated.put(c, k1);
 			rotationResult.current.put(c, k1);
@@ -127,7 +129,7 @@ class TransportKeyManagerImpl implements TransportKeyManager {
 		for (long streamNumber : inKeys.getWindow().getUnseen()) {
 			TagContext tagCtx = new TagContext(c, inKeys, streamNumber);
 			byte[] tag = new byte[TAG_LENGTH];
-			crypto.encodeTag(tag, inKeys.getTagKey(), PROTOCOL_VERSION,
+			transportCrypto.encodeTag(tag, inKeys.getTagKey(), PROTOCOL_VERSION,
 					streamNumber);
 			inContexts.put(new Bytes(tag), tagCtx);
 		}
@@ -162,11 +164,11 @@ class TransportKeyManagerImpl implements TransportKeyManager {
 			// Work out what rotation period the timestamp belongs to
 			long rotationPeriod = timestamp / rotationPeriodLength;
 			// Derive the transport keys
-			TransportKeys k = crypto.deriveTransportKeys(transportId, master,
+			TransportKeys k = transportCrypto.deriveTransportKeys(transportId,
-					rotationPeriod, alice);
+					master, rotationPeriod, alice);
 			// Rotate the keys to the current rotation period if necessary
 			rotationPeriod = clock.currentTimeMillis() / rotationPeriodLength;
-			k = crypto.rotateTransportKeys(k, rotationPeriod);
+			k = transportCrypto.rotateTransportKeys(k, rotationPeriod);
 			// Initialise mutable state for the contact
 			addKeys(c, new MutableTransportKeys(k));
 			// Write the keys back to the DB
@@ -234,8 +236,8 @@ class TransportKeyManagerImpl implements TransportKeyManager {
 			// Add tags for any stream numbers added to the window
 			for (long streamNumber : change.getAdded()) {
 				byte[] addTag = new byte[TAG_LENGTH];
-				crypto.encodeTag(addTag, inKeys.getTagKey(), PROTOCOL_VERSION,
+				transportCrypto.encodeTag(addTag, inKeys.getTagKey(),
-						streamNumber);
+						PROTOCOL_VERSION, streamNumber);
 				inContexts.put(new Bytes(addTag), new TagContext(
 						tagCtx.contactId, inKeys, streamNumber));
 			}
@@ -243,7 +245,7 @@ class TransportKeyManagerImpl implements TransportKeyManager {
 			for (long streamNumber : change.getRemoved()) {
 				if (streamNumber == tagCtx.streamNumber) continue;
 				byte[] removeTag = new byte[TAG_LENGTH];
-				crypto.encodeTag(removeTag, inKeys.getTagKey(),
+				transportCrypto.encodeTag(removeTag, inKeys.getTagKey(),
 						PROTOCOL_VERSION, streamNumber);
 				inContexts.remove(new Bytes(removeTag));
 			}