element-hq / element-hq/element-ios
[Reset Cross-signing] When resetting Cross-signing on iOS, I couldn't verify with the Security Key on the Web afterward
- Dominant language
- Swift
- Stars
- 1.8k
- Forks
- 544
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
1. On iOS -> User settings -> Security -> CROSS-SIGNING -> Reset
2. Then log in to this account on the Web, I can't verify with the Security Key (the Security Key is correct) as shown in the image attached below.
3. Everything is fine if I reset cross-signing on Web
The issue looks similar in the ticket https://github.com/element-hq/element-web/issues/26243 was reported on Web repository
### Outcome
#### What did you expect?
Why I couldn't verify with the Security Key on the Web afterward?
It seems to be an issue that is seriously affecting users
#### What happened instead?
When I debug on my home server, I see some discrepancies between Web and Mobile when resetting Cross-Signing:
- On the Web side, when resetting Cross-signing, there is an API call to upload keys including: m.cross_signing.user_signing
m.cross_signing.self_signing,
m.cross_signing.master
- But on iOS, after Cross-signing was completed, I checked the database and did not see any updates to the keys:m.cross_signing.user_signing, m.cross_signing.self_signing, m.cross_signing.master
- On code iOS, I see when resetting Cross-signing only updates "device_signing/upload" and "signatures/upload"
`extension MXCryptoMachine: MXCryptoCrossSigning {
......
func bootstrapCrossSigning(authParams: [AnyHashable: Any]) async throws {
let result = try machine.bootstrapCrossSigning()
let _ = try await [
requests.uploadSigningKeys(request: result.uploadSigningKeysRequest, authParams: authParams),
requests.uploadSignatures(request: result.signatureRequest)
]
}
....`
Is the iOS side missing code for "m.cross_signing.user_signing, m.cross_signing.self_signing, m.cross_signing.master"?
### Your phone model
IPhone 12
### Operating system version
17.3.1
### Application version
Element 1.11.7
### Homeserver
matrix-client.matrix.org
### Will you send logs?
Yes
Contributor guide
Research direction
Start in MXCryptoMachine.bootstrapCrossSigning(authParams:) and inspect the uploadSigningKeysRequest, requests.uploadSigningKeys, and requests.uploadSignatures calls. Compare the iOS reset flow with the reported Web behavior; done means resetting cross-signing uploads m.cross_signing.user_signing, m.cross_signing.self_signing, and m.cross_signing.master so Web Security Key verification succeeds afterward.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100