Implement V2 registration support

.typos.toml

@@ -15,6 +15,7 @@ extend-ignore-re = [
     "(?i)helo_name",
     "Server name sent during.+HELO",
     # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
+    "COSE",
     "COSEKey",
     "COSEAlgorithm",
     # Ignore this specific string as it's valid

Cargo.toml

@@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"
 
 derive_more = { version = "2.1.1", features = [

migrations/mysql/2026-09-20-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/mysql/2026-09-20-120000_user_crypto_v2/up.sql

@@ -0,0 +1,14 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL,
+    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE
+);

migrations/postgresql/2026-09-20-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/postgresql/2026-09-20-120000_user_crypto_v2/up.sql

@@ -0,0 +1,13 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          TIMESTAMP NOT NULL,
+    updated_at          TIMESTAMP NOT NULL
+);

migrations/sqlite/2026-09-20-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/sqlite/2026-09-20-120000_user_crypto_v2/up.sql

@@ -0,0 +1,13 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                TEXT     NOT NULL PRIMARY KEY,
+    user_uuid           TEXT     NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL
+);

src/api/core/accounts.rs

@@ -22,8 +22,8 @@ use crate::{
         models::{
             AuthRequest, AuthRequestId, Cipher, CipherId, Device, DeviceId, DeviceType, DeviceWithAuthRequest,
             EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, KeyId, Membership,
-            MembershipId, OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, User, UserId,
-            UserKdfType,
+            MembershipId, OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, SignatureAlgorithm,
+            User, UserId, UserKdfType, UserSignatureKeyPair,
         },
     },
     mail,
@@ -42,6 +42,7 @@ pub fn routes() -> Vec<rocket::Route> {
         post_profile,
         put_avatar,
         get_public_keys,
+        get_account_public_keys,
         get_keys,
         post_keys,
         post_password,
@@ -104,6 +105,9 @@ pub struct RegisterData {
     #[serde(alias = "userAsymmetricKeys")]
     keys: Option<KeysData>,
 
+    // Supersedes `keys`, and the only way a v2 account can be registered.
+    account_keys: Option<AccountKeysData>,
+
     master_password_hint: Option<String>,
 
     organization_user_id: Option<MembershipId>,
@@ -115,36 +119,6 @@ pub struct RegisterData {
     org_invite_token: Option<String>,
 }
 
-impl RegisterData {
-    fn hash(&self) -> String {
-        self.compat.fold(|rdc| &rdc.master_password_hash, |rdcu| &rdcu.master_password_authentication.hash).to_owned()
-    }
-
-    fn kdf(&self) -> &KDFData {
-        self.compat.fold(|rdc| &rdc.kdf, |rdcu| &rdcu.master_password_authentication.kdf)
-    }
-
-    fn key(&self) -> String {
-        self.compat.fold(|rdc| &rdc.key, |rdcu| &rdcu.master_password_unlock.key).to_owned()
-    }
-
-    // When comparing with salt, email need to be normalized:
-    //  - https://github.com/bitwarden/clients/blob/web-v2026.5.0/libs/common/src/key-management/master-password/services/master-password.service.ts#L171
-    fn unprocessable(&self) -> bool {
-        let mut unprocessable = false;
-        *self.compat.fold(
-            |_| &false,
-            |rdcu| {
-                let email = self.email.trim().to_lowercase();
-                unprocessable = rdcu.master_password_authentication.kdf != rdcu.master_password_unlock.kdf
-                    || rdcu.master_password_authentication.salt != email
-                    || rdcu.master_password_unlock.salt != email;
-                &unprocessable
-            },
-        )
-    }
-}
-
 #[derive(Debug, Deserialize)]
 struct RegisterDataOld {
     #[serde(flatten)]
@@ -184,6 +158,42 @@ impl RegisterDataCompat {
             RegisterDataCompat::RegisterDataCur(rdcu) => fcu(rdcu),
         }
     }
+
+    fn hash(&self) -> String {
+        self.fold(|rdc| &rdc.master_password_hash, |rdcu| &rdcu.master_password_authentication.hash).to_owned()
+    }
+
+    fn kdf(&self) -> &KDFData {
+        self.fold(|rdc| &rdc.kdf, |rdcu| &rdcu.master_password_authentication.kdf)
+    }
+
+    fn key(&self) -> String {
+        self.fold(|rdc| &rdc.key, |rdcu| &rdcu.master_password_unlock.key).to_owned()
+    }
+
+    /// The id of the user key, which only the current format carries.
+    fn key_id(&self) -> Option<KeyId> {
+        match self {
+            RegisterDataCompat::RegisterDataOld(_) => None,
+            RegisterDataCompat::RegisterDataCur(rdcu) => rdcu.master_password_unlock.contained_key_id.clone(),
+        }
+    }
+
+    // When comparing with salt, email need to be normalized:
+    //  - https://github.com/bitwarden/clients/blob/web-v2026.5.0/libs/common/src/key-management/master-password/services/master-password.service.ts#L171
+    fn unprocessable(&self, email: &str) -> bool {
+        let mut unprocessable = false;
+        *self.fold(
+            |_| &false,
+            |rdcu| {
+                let email = email.trim().to_lowercase();
+                unprocessable = rdcu.master_password_authentication.kdf != rdcu.master_password_unlock.kdf
+                    || rdcu.master_password_authentication.salt != email
+                    || rdcu.master_password_unlock.salt != email;
+                &unprocessable
+            },
+        )
+    }
 }
 
 #[derive(Debug, Deserialize)]
@@ -193,6 +203,183 @@ struct KeysData {
     public_key: String,
 }
 
+/// The `accountKeys` payload, which replaces the flat `keys`/`userAsymmetricKeys` object.
+///
+/// It carries either a "v1" state (just the encryption key pair) or a "v2" one, which adds a
+/// signature key pair, a signed public key, and a signed security state. The two deprecated
+/// top-level fields are still sent by the SDK alongside the nested ones and are only used as a
+/// fallback for clients that don't send `publicKeyEncryptionKeyPair` yet.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Api/Request/AccountKeysRequestModel.cs>
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountKeysData {
+    user_key_encrypted_account_private_key: Option<String>,
+    account_public_key: Option<String>,
+
+    public_key_encryption_key_pair: Option<PublicKeyEncryptionKeyPairData>,
+    signature_key_pair: Option<SignatureKeyPairData>,
+    security_state: Option<SecurityStateData>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PublicKeyEncryptionKeyPairData {
+    wrapped_private_key: String,
+    public_key: String,
+    signed_public_key: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SignatureKeyPairData {
+    signature_algorithm: String,
+    wrapped_signing_key: String,
+    verifying_key: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SecurityStateData {
+    security_state: String,
+    security_version: i32,
+}
+
+pub struct ValidatedAccountKeys {
+    private_key: String,
+    public_key: String,
+    v2: Option<ValidatedV2AccountKeys>,
+}
+
+struct ValidatedV2AccountKeys {
+    signed_public_key: String,
+    signing_key: String,
+    verifying_key: String,
+    signature_algorithm: SignatureAlgorithm,
+    security_state: String,
+    security_version: i32,
+}
+
+impl AccountKeysData {
+    /// Checks that the payload describes a complete account cryptographic state.
+    ///
+    /// The v2 fields have to be all present or all absent: a client that receives a COSE-wrapped
+    /// private key without the matching signature key pair and security state refuses to unlock the
+    /// vault, so storing half a state would produce an account nobody can log into.
+    pub fn validate(self) -> ApiResult<ValidatedAccountKeys> {
+        let (private_key, public_key, signed_public_key) = if let Some(key_pair) = self.public_key_encryption_key_pair {
+            (key_pair.wrapped_private_key, key_pair.public_key, key_pair.signed_public_key)
+        // Older clients only send the deprecated top-level fields, which are always v1.
+        } else if let (Some(private_key), Some(public_key)) =
+            (self.user_key_encrypted_account_private_key, self.account_public_key)
+        {
+            (private_key, public_key, None)
+        } else {
+            err!("The account keys are missing an encryption key pair")
+        };
+
+        let v2 = match (signed_public_key, self.signature_key_pair, self.security_state) {
+            (Some(signed_public_key), Some(signature_key_pair), Some(security_state)) => {
+                let Some(signature_algorithm) = SignatureAlgorithm::parse(&signature_key_pair.signature_algorithm)
+                else {
+                    err!(format!(
+                        "Unsupported signature algorithm: {}",
+                        signature_key_pair.signature_algorithm.escape_debug()
+                    ))
+                };
+
+                Some(ValidatedV2AccountKeys {
+                    signed_public_key,
+                    signing_key: signature_key_pair.wrapped_signing_key,
+                    verifying_key: signature_key_pair.verifying_key,
+                    signature_algorithm,
+                    security_state: security_state.security_state,
+                    security_version: security_state.security_version,
+                })
+            }
+            (None, None, None) => None,
+            _ => err!(
+                "Invalid account keys: the signed public key, signature key pair and security state must either all be present or all be absent"
+            ),
+        };
+
+        Ok(ValidatedAccountKeys {
+            private_key,
+            public_key,
+            v2,
+        })
+    }
+}
+
+impl From<KeysData> for ValidatedAccountKeys {
+    fn from(keys: KeysData) -> Self {
+        Self {
+            private_key: keys.encrypted_private_key,
+            public_key: keys.public_key,
+            v2: None,
+        }
+    }
+}
+
+impl ValidatedAccountKeys {
+    /// The keys of a request that may carry either shape. `accountKeys` supersedes the flat `keys`
+    /// object when both are sent.
+    fn from_request(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Option<Self>> {
+        match (account_keys, keys) {
+            (Some(account_keys), _) => account_keys.validate().map(Some),
+            (None, keys) => Ok(keys.map(Self::from)),
+        }
+    }
+
+    fn is_v2(&self) -> bool {
+        self.v2.is_some()
+    }
+
+    /// Writes the parts of the state that live on the user itself. The user still needs saving, and
+    /// [`Self::save_signature_key_pair`] still needs calling once it has been.
+    ///
+    /// Rejects downgrading an account from v2 back to v1.
+    pub fn apply(&self, user: &mut User) -> EmptyResult {
+        if user.is_v2() && self.v2.is_none() {
+            err!("Cannot downgrade an account from v2 to v1 encryption")
+        }
+
+        user.private_key = Some(self.private_key.clone());
+        user.public_key = Some(self.public_key.clone());
+
+        user.signed_public_key = self.v2.as_ref().map(|v2| v2.signed_public_key.clone());
+        user.security_state = self.v2.as_ref().map(|v2| v2.security_state.clone());
+        user.security_version = self.v2.as_ref().map(|v2| v2.security_version);
+
+        Ok(())
+    }
+
+    /// Persists the signature key pair. Separate from [`Self::apply`] because the row has a foreign
+    /// key to the user, so it can only be written once the user exists.
+    pub async fn save_signature_key_pair(&self, user_id: &UserId, conn: &DbConn) -> EmptyResult {
+        // Skip if the account is v1, since v1 accounts don't have a signature key pair.
+        let Some(v2) = &self.v2 else {
+            return Ok(());
+        };
+
+        let mut key_pair = match UserSignatureKeyPair::find_by_user(user_id, conn).await {
+            Some(mut key_pair) => {
+                key_pair.signature_algorithm = v2.signature_algorithm as i32;
+                key_pair.signing_key.clone_from(&v2.signing_key);
+                key_pair.verifying_key.clone_from(&v2.verifying_key);
+                key_pair
+            }
+            None => UserSignatureKeyPair::new(
+                user_id.clone(),
+                v2.signature_algorithm,
+                v2.signing_key.clone(),
+                v2.verifying_key.clone(),
+            ),
+        };
+        key_pair.save(conn).await
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct MasterPasswordAuthentication {
@@ -213,17 +400,19 @@ pub struct MasterPasswordUnlock {
 
     #[serde(alias = "masterKeyWrappedUserKey")]
     key: String,
+    contained_key_id: Option<KeyId>,
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SetPasswordData {
     #[serde(flatten)]
-    kdf: KDFData,
+    compat: RegisterDataCompat,
 
-    key: String,
     keys: Option<KeysData>,
-    master_password_hash: String,
+    // Supersedes `keys`, and the only way a v2 account can be initialized here.
+    account_keys: Option<AccountKeysData>,
+
     master_password_hint: Option<String>,
     org_identifier: Option<String>,
 }
@@ -265,7 +454,7 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     let mut name = None;
     let mut pending_emergency_access = None;
 
-    if data.unprocessable() {
+    if data.compat.unprocessable(&data.email) {
         err_code!("Unexpected RegisterData format", Status::UnprocessableEntity.code);
     }
 
@@ -334,10 +523,11 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
         err!("The field Name must be a string with a maximum length of 50.");
     }
 
-    // Check against the password hint setting here so if it fails, the user
-    // can retry without losing their invitation below.
+    // Check against the password hint setting and the keys here so if they fail,
+    // the user can retry without losing their invitation below.
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
+    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
 
     let mut user = match User::find_by_mail(&email, &conn).await {
         Some(user) => {
@@ -384,9 +574,9 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     // Make sure we don't leave a lingering invitation.
     Invitation::take(&email, &conn).await;
 
-    set_kdf_data(&mut user, data.kdf())?;
+    set_kdf_data(&mut user, data.compat.kdf())?;
 
-    user.set_password(&data.hash(), Some(data.key()), true, None, &conn).await?;
+    user.set_password(&data.compat.hash(), Some(data.compat.key()), true, None, &conn).await?;
     user.password_hint = password_hint;
 
     // Add extra fields if present
@@ -394,9 +584,13 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
         user.name = name;
     }
 
-    if let Some(keys) = data.keys {
-        user.private_key = Some(keys.encrypted_private_key);
-        user.public_key = Some(keys.public_key);
+    if let Some(ref account_keys) = account_keys {
+        account_keys.apply(&mut user)?;
+        // Like upstream, only a v2 registration records the user key id. A v1 account reports it
+        // later, through `user-key-id`.
+        if account_keys.is_v2() {
+            user.key_id = data.compat.key_id();
+        }
     }
 
     if email_verified {
@@ -420,6 +614,10 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
 
     user.save(&conn).await?;
 
+    if let Some(account_keys) = account_keys {
+        account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
+    }
+
     // accept any open emergency access invitations
     if !CONFIG.mail_enabled() && CONFIG.emergency_access_allowed() {
         for mut emergency_invite in EmergencyAccess::find_all_invited_by_grantee_email(&user.email, &conn).await {
@@ -441,16 +639,22 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
         err!("Account already initialized, cannot set password")
     }
 
+    if data.compat.unprocessable(&user.email) {
+        err_code!("Unexpected SetPasswordData format", Status::UnprocessableEntity.code);
+    }
+
     // Check against the password hint setting here so if it fails,
     // the user can retry without losing their invitation below.
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
 
-    set_kdf_data(&mut user, &data.kdf)?;
+    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
+
+    set_kdf_data(&mut user, data.compat.kdf())?;
 
     user.set_password(
-        &data.master_password_hash,
-        Some(data.key),
+        &data.compat.hash(),
+        Some(data.compat.key()),
         false,
         Some(vec![String::from("revision_date")]), // We need to allow revision-date to use the old security_timestamp
         &conn,
@@ -458,9 +662,12 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
     .await?;
     user.password_hint = password_hint;
 
-    if let Some(keys) = data.keys {
-        user.private_key = Some(keys.encrypted_private_key);
-        user.public_key = Some(keys.public_key);
+    if let Some(ref account_keys) = account_keys {
+        account_keys.apply(&mut user)?;
+        // As in `register`, only a v2 account records the user key id here
+        if account_keys.is_v2() {
+            user.key_id = data.compat.key_id();
+        }
     }
 
     if let Some(identifier) = data.org_identifier
@@ -489,6 +696,10 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
 
     user.save(&conn).await?;
 
+    if let Some(account_keys) = account_keys {
+        account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
+    }
+
     Ok(Json(json!({
       "object": "set-password",
     })))
@@ -569,8 +780,19 @@ async fn get_public_keys(user_id: UserId, _headers: Headers, conn: DbConn) -> Js
     })))
 }
 
+#[get("/users/<user_id>/keys")]
+async fn get_account_public_keys(user_id: UserId, _headers: Headers, conn: DbConn) -> JsonResult {
+    let user = match User::find_by_uuid(&user_id, &conn).await {
+        Some(user) if user.public_key.is_some() => user,
+        Some(_) => err_code!("User has no public_key", Status::NotFound.code),
+        None => err_code!("User doesn't exist", Status::NotFound.code),
+    };
+
+    Ok(Json(user.public_keys_json(&conn).await))
+}
+
 #[get("/accounts/keys")]
-fn get_keys(headers: Headers) -> JsonResult {
+async fn get_keys(headers: Headers, conn: DbConn) -> JsonResult {
     let user = headers.user;
 
     // The SDK reads a 404 as the user having no key pair yet
@@ -582,29 +804,59 @@ fn get_keys(headers: Headers) -> JsonResult {
         "key": (!user.akey.is_empty()).then_some(&user.akey),
         "publicKey": user.public_key,
         "privateKey": user.private_key,
-        "accountKeys": user.account_keys_json(),
+        "accountKeys": user.account_keys_json(&conn).await,
         "object": "keys",
     })))
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PostKeysData {
+    #[serde(flatten)]
+    keys: Option<KeysData>,
+    account_keys: Option<AccountKeysData>,
+    // The id of the user key these account keys belong to, only honored for v2 `accountKeys`
+    user_key_id: Option<KeyId>,
+}
+
 #[post("/accounts/keys", data = "<data>")]
-async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: KeysData = data.into_inner();
+async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) -> JsonResult {
+    let data: PostKeysData = data.into_inner();
 
     let mut user = headers.user;
 
+    // This only sets the keys of an account that has none yet. Replacing existing ones is what a key
+    // rotation does, with the checks that go with it.
     if user.private_key.is_some() || user.public_key.is_some() {
         err!("User has existing keypair")
     }
 
-    user.private_key = Some(data.encrypted_private_key);
-    user.public_key = Some(data.public_key);
+    // `accountKeys` supersedes the flat `keys` object when both are sent.
+    let account_keys = match (data.account_keys, data.keys) {
+        (Some(account_keys), _) => {
+            let account_keys = account_keys.validate()?;
+            if !account_keys.is_v2() {
+                err!("AccountKeys are only supported for V2 encryption.")
+            }
+            // A client that predates key ids sends none, and reports it later through `user-key-id`
+            if data.user_key_id.is_some() {
+                user.key_id = data.user_key_id;
+            }
+            account_keys
+        }
+        (None, Some(keys)) => keys.into(),
+        (None, None) => err!("No account keys provided"),
+    };
 
+    account_keys.apply(&mut user)?;
     user.save(&conn).await?;
+    account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
 
     Ok(Json(json!({
+        "key": (!user.akey.is_empty()).then_some(&user.akey),
         "privateKey": user.private_key,
         "publicKey": user.public_key,
+        "accountKeys": user.account_keys_json(&conn).await,
         "object":"keys"
     })))
 }
@@ -952,6 +1204,16 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
         err!("Invalid password")
     }
 
+    // This only rotates the keys of a v1 account. A v2 account's signing key would stay wrapped by the
+    // old user key, and a v1 account can't be upgraded here, since the signature key pair isn't read.
+    // Either would leave an account that can't be unlocked.
+    if headers.user.is_v2() {
+        err!("Key rotation is not supported for v2 accounts")
+    }
+    if !data.account_keys.user_key_encrypted_account_private_key.starts_with("2.") {
+        err!("The provided account private key was not wrapped with AES-256-CBC-HMAC")
+    }
+
     // Validate the import before continuing
     // Bitwarden does not process the import if there is one item invalid.
     // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
@@ -1937,10 +2199,10 @@ mod tests {
         )
         .unwrap();
 
-        assert!(!data.unprocessable());
-        assert_eq!(data.hash(), "hash");
-        assert_eq!(data.key(), "key");
-        assert_eq!(data.kdf().kdf_iterations, 600_000);
+        assert!(!data.compat.unprocessable(&data.email));
+        assert_eq!(data.compat.hash(), "hash");
+        assert_eq!(data.compat.key(), "key");
+        assert_eq!(data.compat.kdf().kdf_iterations, 600_000);
         assert!(data.keys.is_some());
         assert_eq!(data.email_verification_token.as_deref(), Some("token"));
     }
@@ -1962,10 +2224,10 @@ mod tests {
         )
         .unwrap();
 
-        assert!(!data.unprocessable());
-        assert_eq!(data.hash(), "hash");
-        assert_eq!(data.key(), "key");
-        assert_eq!(data.kdf().kdf_iterations, 600_000);
+        assert!(!data.compat.unprocessable(&data.email));
+        assert_eq!(data.compat.hash(), "hash");
+        assert_eq!(data.compat.key(), "key");
+        assert_eq!(data.compat.kdf().kdf_iterations, 600_000);
         assert!(data.keys.is_some());
     }
 }

src/api/identity.rs

@@ -552,18 +552,7 @@ async fn authenticated_response(
         Value::Null
     };
 
-    let account_keys = if user.private_key.is_some() {
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": user.private_key,
-                "publicKey": user.public_key,
-                "Object": "publicKeyEncryptionKeyPair"
-            },
-            "Object": "privateKeys"
-        })
-    } else {
-        Value::Null
-    };
+    let account_keys = user.account_keys_json(conn).await;
 
     let mut result = json!({
         "access_token": auth_tokens.access_token(),
@@ -709,18 +698,7 @@ async fn user_api_key_login(
         Value::Null
     };
 
-    let account_keys = if user.private_key.is_some() {
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": user.private_key,
-                "publicKey": user.public_key,
-                "Object": "publicKeyEncryptionKeyPair"
-            },
-            "Object": "privateKeys"
-        })
-    } else {
-        Value::Null
-    };
+    let account_keys = user.account_keys_json(conn).await;
 
     // Note: No refresh_token is returned. The CLI just repeats the
     // client_credentials login flow when the existing token expires.

src/config.rs

@@ -1424,6 +1424,8 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "ssh-agent-v2",
     // Key Management Team
     "windows-native-credential-sync",
+    "pm-27278-v2-password-registration",
+    "enable-account-encryption-v2-jit-password-registration",
     // Mobile Team
     "pm-34171-card-scanner",
     // Platform Team

src/db/models/mod.rs

@@ -17,6 +17,7 @@ mod two_factor;
 mod two_factor_duo_context;
 mod two_factor_incomplete;
 mod user;
+mod user_signature_key_pair;
 
 pub use self::archive::Archive;
 pub use self::attachment::{Attachment, AttachmentId};
@@ -40,3 +41,4 @@ pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
 pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType, UserStampException};
+pub use self::user_signature_key_pair::{SignatureAlgorithm, UserSignatureKeyPair};

src/db/models/user.rs

@@ -20,6 +20,7 @@ use macros::UuidFromParam;
 
 use super::{
     Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor, TwoFactorIncomplete,
+    UserSignatureKeyPair,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
@@ -71,6 +72,12 @@ pub struct User {
     pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.
 
     pub key_id: Option<KeyId>,
+
+    // "v2" account cryptographic state. Either all of these are set (together with a row in
+    // `user_signature_key_pairs`) or none of them are; see `User::is_v2`.
+    pub signed_public_key: Option<String>,
+    pub security_state: Option<String>,
+    pub security_version: Option<i32>,
 }
 
 #[derive(Identifiable, Queryable, Insertable)]
@@ -158,9 +165,17 @@ impl User {
             external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.
 
             key_id: None,
+
+            signed_public_key: None,
+            security_state: None,
+            security_version: None,
         }
     }
 
+    pub fn is_v2(&self) -> bool {
+        self.signed_public_key.is_some() && self.security_state.is_some() && self.security_version.is_some()
+    }
+
     pub fn check_valid_password(&self, password: &str) -> bool {
         crypto::verify_password_hash(
             password.as_bytes(),
@@ -261,23 +276,55 @@ impl User {
         !CONFIG.mail_enabled() || self.verified_at.is_some()
     }
 
-    /// The `accountKeys` object (upstream's `PrivateKeysResponseModel`), null without a key pair
-    pub fn account_keys_json(&self) -> Value {
-        if self.private_key.is_some() {
-            json!({
-                "publicKeyEncryptionKeyPair": {
-                    "wrappedPrivateKey": self.private_key,
-                    "publicKey": self.public_key,
-                    "signedPublicKey": null,
-                    "object": "publicKeyEncryptionKeyPair",
-                },
-                "securityState": null,
-                "signatureKeyPair": null,
-                "object": "privateKeys"
-            })
-        } else {
-            Value::Null
+    async fn v2_signature_key_pair(&self, conn: &DbConn) -> Option<UserSignatureKeyPair> {
+        if !self.is_v2() {
+            return None;
         }
+        UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
+    }
+
+    pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
+        if self.private_key.is_none() {
+            return Value::Null;
+        }
+
+        let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
+            Some(key_pair) => (
+                json!(self.signed_public_key),
+                key_pair.to_json(),
+                json!({
+                    "securityState": self.security_state,
+                    "securityVersion": self.security_version,
+                }),
+            ),
+            None => (Value::Null, Value::Null, Value::Null),
+        };
+
+        json!({
+            "publicKeyEncryptionKeyPair": {
+                "wrappedPrivateKey": self.private_key,
+                "publicKey": self.public_key,
+                "signedPublicKey": signed_public_key,
+                "object": "publicKeyEncryptionKeyPair",
+            },
+            "signatureKeyPair": signature_key_pair,
+            "securityState": security_state,
+            "object": "privateKeys"
+        })
+    }
+
+    pub async fn public_keys_json(&self, conn: &DbConn) -> Value {
+        let (signed_public_key, verifying_key) = match self.v2_signature_key_pair(conn).await {
+            Some(key_pair) => (json!(self.signed_public_key), json!(key_pair.verifying_key)),
+            None => (Value::Null, Value::Null),
+        };
+
+        json!({
+            "publicKey": self.public_key,
+            "signedPublicKey": signed_public_key,
+            "verifyingKey": verifying_key,
+            "object": "publicKeys"
+        })
     }
 
     pub async fn to_json(&self, conn: &DbConn) -> Value {
@@ -300,7 +347,7 @@ impl User {
             UserStatus::Enabled
         };
 
-        let account_keys = self.account_keys_json();
+        let account_keys = self.account_keys_json(conn).await;
 
         json!({
             "_status": status as i32,
@@ -376,6 +423,7 @@ impl User {
         Device::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactor::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactorIncomplete::delete_all_by_user(&self.uuid, conn).await?;
+        UserSignatureKeyPair::delete_all_by_user(&self.uuid, conn).await?;
         Invitation::take(&self.email, conn).await; // Delete invitation if any
 
         conn.run(move |conn| {

src/db/models/user_signature_key_pair.rs

@@ -0,0 +1,137 @@
+use chrono::{NaiveDateTime, Utc};
+use derive_more::{AsRef, Deref, Display, From};
+use diesel::prelude::*;
+use serde_json::Value;
+
+use crate::{
+    api::EmptyResult,
+    db::{DbConn, schema::user_signature_key_pairs},
+    error::MapResult,
+    util::get_uuid,
+};
+
+use super::UserId;
+
+/// A user's signature key pair, part of the "v2" account cryptographic state.
+///
+/// Upstream keeps this in its own table rather than as columns on the user, with a unique index on
+/// the user id. The stated intent is to eventually keep superseded key pairs around (an `active`
+/// flag was sketched but not shipped), which is why this is modelled as a row with its own identity
+/// instead of a set of user attributes.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql>
+#[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
+#[diesel(table_name = user_signature_key_pairs)]
+#[diesel(treat_none_as_null = true)]
+#[diesel(primary_key(uuid))]
+pub struct UserSignatureKeyPair {
+    pub uuid: UserSignatureKeyPairId,
+    pub user_uuid: UserId,
+
+    pub signature_algorithm: i32,
+    /// The signing (private) key, wrapped by the user key.
+    pub signing_key: String,
+    /// The COSE-encoded public verifying key.
+    pub verifying_key: String,
+
+    pub created_at: NaiveDateTime,
+    pub updated_at: NaiveDateTime,
+}
+
+/// https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SignatureAlgorithm {
+    Ed25519 = 0,
+    MlDsa44 = 1,
+}
+
+impl SignatureAlgorithm {
+    pub fn parse(algorithm: &str) -> Option<Self> {
+        match algorithm {
+            "ed25519" => Some(Self::Ed25519),
+            "mldsa44" => Some(Self::MlDsa44),
+            _ => None,
+        }
+    }
+}
+
+/// Local methods
+impl UserSignatureKeyPair {
+    pub fn new(
+        user_uuid: UserId,
+        signature_algorithm: SignatureAlgorithm,
+        signing_key: String,
+        verifying_key: String,
+    ) -> Self {
+        let now = Utc::now().naive_utc();
+
+        Self {
+            uuid: UserSignatureKeyPairId(get_uuid()),
+            user_uuid,
+            signature_algorithm: signature_algorithm as i32,
+            signing_key,
+            verifying_key,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+
+    pub fn to_json(&self) -> Value {
+        json!({
+            "wrappedSigningKey": self.signing_key,
+            "verifyingKey": self.verifying_key,
+            "object": "signatureKeyPair",
+        })
+    }
+}
+
+/// Database methods
+impl UserSignatureKeyPair {
+    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+        self.updated_at = Utc::now().naive_utc();
+
+        db_run! { conn:
+            mysql {
+                diesel::insert_into(user_signature_key_pairs::table)
+                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
+                    .execute(conn)
+                    .map_res("Error saving user signature key pair")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(user_signature_key_pairs::table)
+                    .values(&*self)
+                    .on_conflict(user_signature_key_pairs::user_uuid)
+                    .do_update()
+                    .set(&*self)
+                    .execute(conn)
+                    .map_res("Error saving user signature key pair")
+            }
+        }
+    }
+
+    /// The user's key pair. There is at most one, enforced by a unique index on `user_uuid`.
+    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
+        conn.run(move |conn| {
+            user_signature_key_pairs::table
+                .filter(user_signature_key_pairs::user_uuid.eq(user_uuid))
+                .first::<Self>(conn)
+                .ok()
+        })
+        .await
+    }
+
+    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
+        conn.run(move |conn| {
+            diesel::delete(user_signature_key_pairs::table.filter(user_signature_key_pairs::user_uuid.eq(user_uuid)))
+                .execute(conn)
+                .map_res("Error deleting user signature key pairs")
+        })
+        .await
+    }
+}
+
+#[derive(Clone, Debug, AsRef, Deref, DieselNewType, Display, From, Hash, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UserSignatureKeyPairId(String);

src/db/schema.rs

@@ -218,6 +218,21 @@ table! {
         avatar_color -> Nullable<Text>,
         external_id -> Nullable<Text>,
         key_id -> Nullable<Text>,
+        signed_public_key -> Nullable<Text>,
+        security_state -> Nullable<Text>,
+        security_version -> Nullable<Integer>,
+    }
+}
+
+table! {
+    user_signature_key_pairs (uuid) {
+        uuid -> Text,
+        user_uuid -> Text,
+        signature_algorithm -> Integer,
+        signing_key -> Text,
+        verifying_key -> Text,
+        created_at -> Timestamp,
+        updated_at -> Timestamp,
     }
 }
 
@@ -383,6 +398,7 @@ joinable!(collections_groups -> groups (groups_uuid));
 joinable!(event -> users_organizations (uuid));
 joinable!(auth_requests -> users (user_uuid));
 joinable!(sso_users -> users (user_uuid));
+joinable!(user_signature_key_pairs -> users (user_uuid));
 
 allow_tables_to_appear_in_same_query!(
     archives,
@@ -409,4 +425,5 @@ allow_tables_to_appear_in_same_query!(
     collections_groups,
     event,
     auth_requests,
+    user_signature_key_pairs,
 );