element-hq / element-hq/element-ios

Crypto: key reshare does not work if there was a device change

Open
#4,782 1 comment 0 reactions 0 assignees View on GitHub
A-E2EE T-Defect
Dominant language
Swift
Stars
1.8k
Forks
544
PR merge metrics
PR metrics pending

Description

Steps to reproduce:
- Alice and Bob with devices Alice1 and Bob1 are in an encrypted room
- Alice sends a message
- Bob logs in with device Bob2
- If Bob1 makes a reshare request to Alice1 for the key of the message, Alice1 will reject it with the error `[MXMegolmEncryption] reshareKey: ERROR: Never shared megolm key with this device`

There is an issue in the implementation of the crypto store at https://github.com/matrix-org/matrix-ios-sdk/blob/v0.19.8/MatrixSDK/Crypto/Data/Store/MXRealmCryptoStore/MXRealmCryptoStore.m#L646.

With this "delete all" action, all existing references to those `MXRealmDeviceInfo` objects are set to null by RealmDB.
So, a `MXRealmSharedOutboundSession` object that depends on it will be reset like this:
```
MXRealmSharedOutboundSession {
roomId = !ROOwNxCLjNICmOoaMy:localhost:8480;
sessionId = xQVT9qTT4yVurxg8bgHqz9rHz1So/jetZ4FgLlf1C6Q;
device = (null);
messageIndex = 0;
}
```

Next time we will try to check if we already shared a session toBob1 by querying `MXRealmSharedOutboundSession` objects by device id at this [line](MXRealmSharedOutboundSession), we will find nothing.

Contributor guide

Open the contributing guide

Research direction

Start in MatrixSDK/Crypto/Data/Store/MXRealmCryptoStore/MXRealmCryptoStore.m around line 646 and inspect how the delete-all action affects MXRealmDeviceInfo and MXRealmSharedOutboundSession references. Reproduce the Alice1/Bob1/Bob2 device-change scenario and verify that Bob1 can receive a reshare request for the existing message key after the device change.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
cryptography, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.