element-hq / element-hq/hydrogen-web

Lost olm sessions due to storage being cleared are never replaced with a new one, resulting in UTDs

Open
#628 3 comments 0 reactions 0 assignees View on GitHub
bug e2ee
Dominant language
TypeScript
Stars
714
Forks
131
PR merge metrics
No merged PRs in 30d

Description

One way an olm session can get "wedged" is when indexeddb is cleared by the browser. The olm account is backed (since 77bd0d3f3) up to localstorage (which _usually_ isn't cleared), but the olm sessions are not. So if the olm session is lost and another client sends us a to_device message encrypted with that session, we would see either a `BAD_MESSAGE_KEY_ID` or `OLM_NO_MATCHING_SESSION` error depending on whether we have already sent an olm message from our device to their device or not.

To solve this, we should implement #629, which here would mean setting up a new olm session and sending a `m.dummy` message over it, and then re-request the key with a key sharing using a `m.room.key_request` message.

Contributor guide

Open the contributing guide

Research direction

Start by reading the referenced issue #629 and tracing how lost olm sessions produce BAD_MESSAGE_KEY_ID or OLM_NO_MATCHING_SESSION errors after IndexedDB is cleared. Done means a new olm session is established, an m.dummy message is sent over it, and the key is requested again with m.room.key_request.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.