[A-EDev]

Summary

First step of linked devices on Android: the FLOW-SYNC/2 cryptography, checked byte for byte against the shared vectors from Flow-Tube/flow-sync (the spec all three apps follow). Nothing calls it yet; nothing changes for users.

• New package sync2/crypto:
  • labelled derivation and hashes (reusing FLOW-SYNC/1's HKDF);
  • the box (AES-256-GCM with a per-box key and a key commitment, reusing FLOW-SYNC/1's AES-GCM);
  • Ed25519 with the spec's strict checks, and X25519;
  • HPKE epoch-key wraps, epoch commitments and purpose keys, and the history chain;
  • PADMÉ payloads, snapshot blobs, recovery words and keys, pairing keys and the six-digit code, and the LAN tags and session keys.
• sync2/store/Envelope.kt: the signed object envelope, and the stream rules (replay, gap, prev).
• SyncSerialization.canonicalJson is now public, so FLOW-SYNC/2 reuses the canonical JSON writer instead of a second copy.
• Libraries:
  • HPKE: the Conscrypt 2.6.1 the app already bundles (Conscrypt.newProvider(); the platform has no HPKE before API 34);
  • Ed25519 and X25519: BouncyCastle bcprov-jdk18on 1.86, because Conscrypt's public API can't derive an Ed25519 public key from a seed, which recovery keys need;
  • recovery words: kotlin-bip39 1.0.9 (Electric Coin Co.), the BIP39 English list and checksum.
• Unit tests use Conscrypt's desktop build (conscrypt-openjdk-uber, same version and API, test-only). The Android-only artifact is kept off the JVM test classpath. Robolectric already pulled 2.5.2 of it.
• The vectors are copied unchanged from flow-sync commit cab3979 into app/src/test/resources/sync2/.

The spec's Android row is updated in Flow-Tube/flow-sync#36.

Related issue

Part of #1075 (linked devices).

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• ./gradlew :app:assembleGithubDebug: ok at the top of this stack
• ./gradlew :app:testGithubDebugUnitTest: 4578 passed, 46 skipped, 0 failed on this commit; VectorsTest 11 passed
• ./gradlew :app:assembleFossRelease: universal APK 29,430,087 bytes against 29,415,385 on main (+14,702 bytes for this stack's first two PRs), under the 29,500,000 gate
• ./gradlew ktlintCheck: ok
• I manually tested the affected behavior on an Android device or emulator. (Nothing runs it yet. A check on an API 26 device that the bundled Conscrypt provides HPKE is still to do.)

Test device and Android version: none (JVM tests only)

Risk and compatibility

No migrations, permissions or behavior changes. Three new dependencies, all added in gradle/libs.versions.toml. Note that main itself is already within about 85 KB of the FOSS size gate.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources. (None.)
• Dependency and lockfile changes are intentional and limited to this PR.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented. (None.)