element-hq / element-hq/synapse
Is it correct that Synapse validates cross-signing signatures?
Open
A-E2EE
O-Uncommon
S-Minor
T-Defect
z-cross-signing
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#12548](https://github.com/matrix-org/synapse/issues/12548).
---
When you upload a cross-signing signature, Synapse attempts to validate that signature.
https://spec.matrix.org/v1.2/client-server-api/#cross-signing doesn't seem to require this (though it does document `M_INVALID_SIGNATURE: For example, the self-signing or user-signing key had an incorrect signature`), and it's not obvious it's the homeserver's job to do this validation.
It also means that any future attempt to add new signature algorithms will require updates to the homeserver.
Contributor guide
Assessment
This issue has not been assessed yet.