element-hq / element-hq/element-meta
[Prep] Support for encrypting Rust stores with key data.
- Dominant language
- No language data
- Stars
- 112
- Forks
- 25
- Avg merge
- 6h 6m
- Merged PRs (30d)
- 4
Description
### Description
Currently the Rust SDK expects a passphrase to encrypt the stores when creating a client. This string is run through password based key derivation (PBKDF2, with 200k iterations or so) to get a 256bits key which is fine, but for EX clients we can generate that key directly, and as pbkdf is slow by design this hurts the performance when opening the stores. Ideally we should add an API to pass the key directly.
(Related web issue: https://github.com/element-hq/element-web/issues/26821)
EXI and EXA are about to implement database encryption with the passphrase for Nightly users, but we would prefer not to roll this out to everyone until the API accepts key data, otherwise we'll have to deal with 2 different types of keys going forward (we're happy for Nightly users to be signed out at some point).
# Acceptance criteria
- EXI and EXA can pass a key directly to the SDK instead of converting it to a string first.
# Size estimate
M (might be small, but looking through the Rust code, there appears to be a lot of levels involved to me)
# Dependencies
- None
# Out of scope
-
# Subtasks
```[tasklist]
### Android
- [ ] Adopt the new database encryption key API, requiring anyone using the old one to login again.
```
```[tasklist]
### iOS
- [ ] Adopt the new database encryption key API, requiring anyone using the old one to login again.
```
```[tasklist]
### Rust
- [ ] Add support for supplying database key data as an alternative to a passphrase.
```
```[tasklist]
### Other
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in the Rust SDK path that creates encrypted stores and derives keys from passphrases, then trace how the client API reaches that code. Review the related Element Web issue and the Android/iOS subtasks for compatibility expectations. Done means EXI and EXA can supply key data directly through the SDK instead of converting it to a string.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- api, databases, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100