element-hq / element-hq/element-ios

[Reset Cross-signing] When resetting Cross-signing on iOS, I couldn't verify with the Security Key on the Web afterward

Open
#7,759 1 comment 0 reactions 0 assignees View on GitHub
T-Defect
Dominant language
Swift
Stars
1.8k
Forks
544
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

1. On iOS -> User settings -> Security -> CROSS-SIGNING -> Reset

Screenshot 2024-02-23 at 14 01 54

2. Then log in to this account on the Web, I can't verify with the Security Key (the Security Key is correct) as shown in the image attached below.
Screenshot 2024-02-23 at 14 14 01

3. Everything is fine if I reset cross-signing on Web

The issue looks similar in the ticket https://github.com/element-hq/element-web/issues/26243 was reported on Web repository

### Outcome

#### What did you expect?
Why I couldn't verify with the Security Key on the Web afterward?
It seems to be an issue that is seriously affecting users

#### What happened instead?
When I debug on my home server, I see some discrepancies between Web and Mobile when resetting Cross-Signing:

- On the Web side, when resetting Cross-signing, there is an API call to upload keys including: m.cross_signing.user_signing
m.cross_signing.self_signing,
m.cross_signing.master
- But on iOS, after Cross-signing was completed, I checked the database and did not see any updates to the keys:m.cross_signing.user_signing, m.cross_signing.self_signing, m.cross_signing.master
- On code iOS, I see when resetting Cross-signing only updates "device_signing/upload" and "signatures/upload"
`extension MXCryptoMachine: MXCryptoCrossSigning {
......
func bootstrapCrossSigning(authParams: [AnyHashable: Any]) async throws {
let result = try machine.bootstrapCrossSigning()
let _ = try await [
requests.uploadSigningKeys(request: result.uploadSigningKeysRequest, authParams: authParams),
requests.uploadSignatures(request: result.signatureRequest)
]
}
....`

Is the iOS side missing code for "m.cross_signing.user_signing, m.cross_signing.self_signing, m.cross_signing.master"?

### Your phone model

IPhone 12

### Operating system version

17.3.1

### Application version

Element 1.11.7

### Homeserver

matrix-client.matrix.org

### Will you send logs?

Yes

Contributor guide

Open the contributing guide

Research direction

Start in MXCryptoMachine.bootstrapCrossSigning(authParams:) and inspect the uploadSigningKeysRequest, requests.uploadSigningKeys, and requests.uploadSignatures calls. Compare the iOS reset flow with the reported Web behavior; done means resetting cross-signing uploads m.cross_signing.user_signing, m.cross_signing.self_signing, and m.cross_signing.master so Web Security Key verification succeeds afterward.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.