deblan-mirror/mautrix-go
1
0
Fork 0
mirror of https://mau.dev/mautrix/go.git synced 2026-03-14 14:25:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

crypto/keybackup: log mismatching public keys when verifiying megolm backups (#356)
Some checks failed
Go / Lint (latest) (push) Has been cancelled
Details
Go / Build (old, libolm) (push) Has been cancelled
Details
Go / Build (latest, libolm) (push) Has been cancelled
Details
Go / Build (old, goolm) (push) Has been cancelled
Details
Go / Build (latest, goolm) (push) Has been cancelled
Details

Browse source 
Co-authored-by: Sumner Evans <sumner@beeper.com>
This commit is contained in:
Brad Murray 2025-02-28 09:45:28 -05:00 • committed by GitHub
commit c7cb9ff2a3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
crypto/keybackup.go
View file

@ -54,9 +54,15 @@ func (mach *OlmMachine) GetAndVerifyLatestKeyBackupVersion(ctx context.Context,
// ...by deriving the public key from a private key that it obtained from a trusted source. Trusted sources for the private
// key include the user entering the key, retrieving the key stored in secret storage, or obtaining the key via secret sharing
// from a verified device belonging to the same user."
if megolmBackupKey != nil && versionInfo.AuthData.PublicKey == id.Ed25519(base64.RawStdEncoding.EncodeToString(megolmBackupKey.PublicKey().Bytes())) {
log.Debug().Msg("key backup is trusted based on public key")
megolmBackupDerivedPublicKey := id.Ed25519(base64.RawStdEncoding.EncodeToString(megolmBackupKey.PublicKey().Bytes()))
if megolmBackupKey != nil && versionInfo.AuthData.PublicKey == megolmBackupDerivedPublicKey {
log.Debug().Msg("key backup is trusted based on derived public key")
return versionInfo, nil
} else {
log.Debug().
Stringer("expected_key", megolmBackupDerivedPublicKey).
Stringer("actual_key", versionInfo.AuthData.PublicKey).
Msg("key backup public keys do not match, proceeding to check device signatures")
}
// "...or checking that it is signed by the user’s master cross-signing key or by a verified device belonging to the same user"