Encryption

Identity keys (Ed25519) -- long-term, one per device
        |
Ephemeral keys (X25519) -- per-session, forward secrecy
        |
HKDF-SHA256 -- derive session keys
        |
XChaCha20-Poly1305 -- encrypt/decrypt session frames

Host identity:  Ed25519 key pair, persisted in OS keychain
Client identity: Ed25519 key pair, persisted under WebCrypto key

// Host (Node.js)
// Identity is generated automatically by createCrosslinkServer()
// Stored in .crosslink-data/<appId>/ via OS keychain (if available) or encrypted file

// Client (Browser)
// Identity is generated automatically by CrosslinkClient.create()
// Stored in IndexedDB under AES-256-GCM encryption

1. Client sends `sinit`: its static X25519 key, a fresh ephemeral X25519 key,
   a nonce, and an Ed25519 signature over the canonical transcript T0
2. Host looks the device up by id and verifies that signature against the key in
   its own stored record -- never against a key offered on the wire
3. Host replies `sack`: its ephemeral key, a nonce, and a signature over T1
4. Client verifies that signature against the host key it pinned at pairing
5. Both compute ikm = X25519(eph, eph_peer) || X25519(static_x, static_x_peer)
6. Both derive two directional keys from ikm via HKDF-SHA256

Frame format:
+--------+--------+----------------+----------------+
| Nonce  |  Tag   |   Ciphertext   |  Sequence Num  |
| 12 B   | 16 B   |  variable      |  4 B           |
+--------+--------+----------------+----------------+

ikm  = X25519(eph, eph_peer) || X25519(static_x, static_x_peer)
salt = ncC || nh                        (both sides' handshake nonces)
info = "crosslink-session-keys-v1"

okm  = HKDF-SHA256(ikm, salt, info, 64)
kC   = okm[0..32]     client -> host traffic key
kH   = okm[32..64]    host -> client traffic key

Key derivation:
  passphrase = CROSSLINK_SECRET_KEY env var OR machine-bound key
  salt = random (16 bytes)
  key = scrypt(passphrase, salt, N=2^14, r=8, p=1, dkLen=32)

Encryption:
  iv = random (12 bytes)
  ciphertext = AES-256-GCM(key, iv, plaintext)
  stored = { v:1, salt, iv, tag, ciphertext }

Key generation:
  key = crypto.subtle.generateKey(
    { name: "AES-GCM", length: 256 },
    extractable: false,  // <-- critical: cannot be exported
    ["encrypt", "decrypt"]
  )

Encryption:
  iv = crypto.getRandomValues(12)
  ciphertext = crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext)