Skip to content

Commit

Permalink
crypto: withhold outgoing messages to unsigned dehydrated devices
Browse files Browse the repository at this point in the history 
Per #4313, we should not
send outgoing messages to dehydrated devices that are not signed by the current
pinned/verified identity.
  • Loading branch information
@richvdh
richvdh committed Jan 21, 2025
1 parent b9da107 commit 919f073
Show file tree
Hide file tree
Showing 7 changed files with 757 additions and 17 deletions.
7 changes: 6 additions & 1 deletion crates/matrix-sdk-crypto/src/identities/device.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -481,7 +481,7 @@ impl Device {

/// Whether or not the device is a dehydrated device.
pub fn is_dehydrated(&self) -> bool {
self.inner.device_keys.dehydrated.unwrap_or(false)
self.inner.is_dehydrated()
}
}

Expand Down Expand Up @@ -966,6 +966,11 @@ impl DeviceData {
pub fn first_time_seen_ts(&self) -> MilliSecondsSinceUnixEpoch {
self.first_time_seen_ts
}

/// True if this device is an MSC3814 dehydrated device.
pub fn is_dehydrated(&self) -> bool {
self.device_keys.dehydrated.unwrap_or(false)
}
}

impl TryFrom<&DeviceKeys> for DeviceData {
Expand Down
383 changes: 367 additions & 16 deletions crates/matrix-sdk-crypto/src/session_manager/group_sessions/share_strategy.rs
View file

Large diffs are not rendered by default.

76 changes: 76 additions & 0 deletions ...rategy__tests__dehydrated_device__should_not_share_with_unverified_dehydrated_device.snap
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
---
source: crates/matrix-sdk-crypto/src/session_manager/group_sessions/share_strategy.rs
expression: ruma_response_to_json(keys_query.clone())
---
{
"device_keys": {
"@bob:localhost": {
"DEHYDRATED_DEVICE": {
"algorithms": [
"m.olm.v1.curve25519-aes-sha2",
"m.megolm.v1.aes-sha2"
],
"dehydrated": true,
"device_id": "DEHYDRATED_DEVICE",
"keys": {
"curve25519:DEHYDRATED_DEVICE": "Y3VydmVwdWJjdXJ2ZXB1YmN1cnZlcHViY3VydmVwdWI",
"ed25519:DEHYDRATED_DEVICE": "aXceGe19ufgBArmAjKeIPEEk0eaA4c3yIB6WjkjvYNE"
},
"signatures": {
"@bob:localhost": {
"ed25519:DEHYDRATED_DEVICE": "7diDwtxcBHi6gu3fxy3Yau0vtUrvW9r5gBPUQO6qmuOSGfZCJkqhATmruPd7bCu1N5xRCZOd4bEhM/j/yY1vBQ"
}
},
"user_id": "@bob:localhost"
}
}
},
"master_keys": {
"@bob:localhost": {
"keys": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY"
},
"signatures": {
"@bob:localhost": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "vgFiLvyxYeiVxhpMV81Z4HTvjRhgmZgWn1ScnsLC+HojFwXckA6+/Aa9L/+sA1hzapNZJ4Vrbstl9c4Ep4nbAA"
}
},
"usage": [
"master"
],
"user_id": "@bob:localhost"
}
},
"self_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU": "hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU"
},
"signatures": {
"@bob:localhost": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "xQhtPoTJilhxKrruKAhrpQ1MJFKsCPh77R2WUrWHIB5Mi4sPbxpeU1MZvV/jCCfHrZ5ID40PG2EcEAPtPLYgAQ"
}
},
"usage": [
"self_signing"
],
"user_id": "@bob:localhost"
}
},
"user_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM": "AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM"
},
"signatures": {
"@bob:localhost": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "d9lPdE5nqpl1euENWderCnPJRTClAcH11JMAIlKiPIWObL19U26zxuchBMEgVR4U7UN55ykDiWtPUlDCC7yvAg"
}
},
"usage": [
"user_signing"
],
"user_id": "@bob:localhost"
}
}
}
77 changes: 77 additions & 0 deletions ...ests__dehydrated_device__should_not_share_with_verified_device_of_pin_violation_user.snap
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
---
source: crates/matrix-sdk-crypto/src/session_manager/group_sessions/share_strategy.rs
expression: ruma_response_to_json(keys_query.clone())
---
{
"device_keys": {
"@bob:localhost": {
"DEHYDRATED_DEVICE": {
"algorithms": [
"m.olm.v1.curve25519-aes-sha2",
"m.megolm.v1.aes-sha2"
],
"dehydrated": true,
"device_id": "DEHYDRATED_DEVICE",
"keys": {
"curve25519:DEHYDRATED_DEVICE": "Y3VydmVwdWJjdXJ2ZXB1YmN1cnZlcHViY3VydmVwdWI",
"ed25519:DEHYDRATED_DEVICE": "aXceGe19ufgBArmAjKeIPEEk0eaA4c3yIB6WjkjvYNE"
},
"signatures": {
"@bob:localhost": {
"ed25519:DEHYDRATED_DEVICE": "7diDwtxcBHi6gu3fxy3Yau0vtUrvW9r5gBPUQO6qmuOSGfZCJkqhATmruPd7bCu1N5xRCZOd4bEhM/j/yY1vBQ",
"ed25519:hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU": "lU1441xv6W4WY1d7trmRbdagAcoWwBrwR8D8Lr4VrWn8V0mlL8qSf/zJQ+nh12WcD3NRTEZ6H7rm6ncaBxbKDQ"
}
},
"user_id": "@bob:localhost"
}
}
},
"master_keys": {
"@bob:localhost": {
"keys": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0"
},
"signatures": {
"@bob:localhost": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "MalGqUfgScuZcEzFyBaJV0nXP6cBGaDz6LZtwrWmvAtfn3uDVatym+CX+YkKZmflog7XJogdeYtHuyn733tWBA"
}
},
"usage": [
"master"
],
"user_id": "@bob:localhost"
}
},
"self_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU": "hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU"
},
"signatures": {
"@bob:localhost": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "h1sADa7kifsHyzGc0ZTGckzjEE15s2YVR9Tz6pdyOWoHJUUcOjBDz6aGNbDarcs/OY49rF3nNXUMsRXEW6ZCBA"
}
},
"usage": [
"self_signing"
],
"user_id": "@bob:localhost"
}
},
"user_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM": "AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM"
},
"signatures": {
"@bob:localhost": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "gIfvMruwAbB7l7893w6bR/2dqTGTFM4qfSYWZWJ/i981zZYfTQv+8h91URCMhviKXQlelnVnMRrP6osssS8NAA"
}
},
"usage": [
"user_signing"
],
"user_id": "@bob:localhost"
}
}
}
77 changes: 77 additions & 0 deletions ...ydrated_device__should_not_share_with_verified_device_of_verification_violation_user.snap
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
---
source: crates/matrix-sdk-crypto/src/session_manager/group_sessions/share_strategy.rs
expression: ruma_response_to_json(keys_query.clone())
---
{
"device_keys": {
"@bob:localhost": {
"DEHYDRATED_DEVICE": {
"algorithms": [
"m.olm.v1.curve25519-aes-sha2",
"m.megolm.v1.aes-sha2"
],
"dehydrated": true,
"device_id": "DEHYDRATED_DEVICE",
"keys": {
"curve25519:DEHYDRATED_DEVICE": "Y3VydmVwdWJjdXJ2ZXB1YmN1cnZlcHViY3VydmVwdWI",
"ed25519:DEHYDRATED_DEVICE": "aXceGe19ufgBArmAjKeIPEEk0eaA4c3yIB6WjkjvYNE"
},
"signatures": {
"@bob:localhost": {
"ed25519:DEHYDRATED_DEVICE": "7diDwtxcBHi6gu3fxy3Yau0vtUrvW9r5gBPUQO6qmuOSGfZCJkqhATmruPd7bCu1N5xRCZOd4bEhM/j/yY1vBQ",
"ed25519:hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU": "lU1441xv6W4WY1d7trmRbdagAcoWwBrwR8D8Lr4VrWn8V0mlL8qSf/zJQ+nh12WcD3NRTEZ6H7rm6ncaBxbKDQ"
}
},
"user_id": "@bob:localhost"
}
}
},
"master_keys": {
"@bob:localhost": {
"keys": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0"
},
"signatures": {
"@bob:localhost": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "MalGqUfgScuZcEzFyBaJV0nXP6cBGaDz6LZtwrWmvAtfn3uDVatym+CX+YkKZmflog7XJogdeYtHuyn733tWBA"
}
},
"usage": [
"master"
],
"user_id": "@bob:localhost"
}
},
"self_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU": "hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU"
},
"signatures": {
"@bob:localhost": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "h1sADa7kifsHyzGc0ZTGckzjEE15s2YVR9Tz6pdyOWoHJUUcOjBDz6aGNbDarcs/OY49rF3nNXUMsRXEW6ZCBA"
}
},
"usage": [
"self_signing"
],
"user_id": "@bob:localhost"
}
},
"user_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM": "AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM"
},
"signatures": {
"@bob:localhost": {
"ed25519:QK24BHjZnsDxe8rfCBHieNRG3MDNCcCMjBNhKCfNuC0": "gIfvMruwAbB7l7893w6bR/2dqTGTFM4qfSYWZWJ/i981zZYfTQv+8h91URCMhviKXQlelnVnMRrP6osssS8NAA"
}
},
"usage": [
"user_signing"
],
"user_id": "@bob:localhost"
}
}
}
77 changes: 77 additions & 0 deletions ...are_strategy__tests__dehydrated_device__should_share_with_verified_dehydrated_device.snap
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
---
source: crates/matrix-sdk-crypto/src/session_manager/group_sessions/share_strategy.rs
expression: ruma_response_to_json(keys_query.clone())
---
{
"device_keys": {
"@bob:localhost": {
"DEHYDRATED_DEVICE": {
"algorithms": [
"m.olm.v1.curve25519-aes-sha2",
"m.megolm.v1.aes-sha2"
],
"dehydrated": true,
"device_id": "DEHYDRATED_DEVICE",
"keys": {
"curve25519:DEHYDRATED_DEVICE": "Y3VydmVwdWJjdXJ2ZXB1YmN1cnZlcHViY3VydmVwdWI",
"ed25519:DEHYDRATED_DEVICE": "aXceGe19ufgBArmAjKeIPEEk0eaA4c3yIB6WjkjvYNE"
},
"signatures": {
"@bob:localhost": {
"ed25519:DEHYDRATED_DEVICE": "7diDwtxcBHi6gu3fxy3Yau0vtUrvW9r5gBPUQO6qmuOSGfZCJkqhATmruPd7bCu1N5xRCZOd4bEhM/j/yY1vBQ",
"ed25519:hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU": "lU1441xv6W4WY1d7trmRbdagAcoWwBrwR8D8Lr4VrWn8V0mlL8qSf/zJQ+nh12WcD3NRTEZ6H7rm6ncaBxbKDQ"
}
},
"user_id": "@bob:localhost"
}
}
},
"master_keys": {
"@bob:localhost": {
"keys": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY"
},
"signatures": {
"@bob:localhost": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "vgFiLvyxYeiVxhpMV81Z4HTvjRhgmZgWn1ScnsLC+HojFwXckA6+/Aa9L/+sA1hzapNZJ4Vrbstl9c4Ep4nbAA"
}
},
"usage": [
"master"
],
"user_id": "@bob:localhost"
}
},
"self_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU": "hpK1owolWNIVv/CIximGep0a1dYwHWyhkdJ/t6flFeU"
},
"signatures": {
"@bob:localhost": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "xQhtPoTJilhxKrruKAhrpQ1MJFKsCPh77R2WUrWHIB5Mi4sPbxpeU1MZvV/jCCfHrZ5ID40PG2EcEAPtPLYgAQ"
}
},
"usage": [
"self_signing"
],
"user_id": "@bob:localhost"
}
},
"user_signing_keys": {
"@bob:localhost": {
"keys": {
"ed25519:AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM": "AXFeCsS+P7TpZOkiYvzjMvO1+K6q3Ljf5CHRY3e19MM"
},
"signatures": {
"@bob:localhost": {
"ed25519:B2W5RIPXTnKtRhFATxcvrKzIOWVstpdNLkf2uOQNBOY": "d9lPdE5nqpl1euENWderCnPJRTClAcH11JMAIlKiPIWObL19U26zxuchBMEgVR4U7UN55ykDiWtPUlDCC7yvAg"
}
},
"usage": [
"user_signing"
],
"user_id": "@bob:localhost"
}
}
}
Loading

0 comments on commit 919f073

Please sign in to comment.