element-hq / element-hq/element-android

Prioritising Recovery key over Recovery passphrase

Open
#1,463 1 comment 0 reactions 1 assignee Claimed by @BillCarsonFr View on GitHub
A-E2EE-Cross-Signing
Dominant language
Kotlin
Stars
3.7k
Forks
917
PR merge metrics
No merged PRs in 30d

Description

## After registration

Bootstrap the cross-signing in background during the registration flow. The operation will be invisible to the end user.
This means:
- [x] Create cross-signing keys (MSK, USK, SSK) and store them locally.
- [x] Upload their public parts to the HS. This requires auth but we have all credentials during this flow.
- [ ] Support bootstrap with SSO.
- [ ] TBD: Create proactively the key backup key and store it locally.
Doing it before it is actually needed will allow to share it (via secret sharing) to new user's devices before the user creates a recovery key. This is to avoid unsync behavior for this key.

## For regular login (or app update)

- [ ] If the user has not set up cross-signing yet, we need to ask them to do so.
The plan is to use a banner and security settings. This is will require to request account password (that would be great to think how to manage SSO as well).

Design: https://www.figma.com/file/wwqBo5oAFfk8XKmtd2YaIs/Cross-signing?node-id=5050%3A31796.

## Ref

Design: https://github.com/matrix-org/riot-artwork/issues/36

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.