element-hq / element-hq/synapse
self_signing signatures are not deleted when their device is deleted
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
### Description
Once a device has been signed with the self_signing key (i.e. verified), that signature persists even after the device has been deleted (e.g. forcibly logged out from another client).
If the deleted device id is then reused when logging in a new device*, the old signature will reappear on the new device.
Consequently, any client that performs validation on the new device's signatures will find at least one bad one made by that account's own keys. This can generate warnings, errors, or unexpected verification/trust status indicators targeting the new device. (For example, Nheko logs warnings and leaves an empty space where a shield icon would normally be.)
---
*Note that device id reuse is [explicitly allowed](https://spec.matrix.org/v1.11/client-server-api/#relationship-between-access-tokens-and-devices) by the spec:
> "A client is also free to generate its own device_id or, provided the user remains the same, reuse a device: in either case the client should pass the device_id in the request body."
### Steps to reproduce
- Log in a new device.
- Verify the device. (I'm doing this manually with the `keys/signatures/upload` endpoint. Interactive verification might yield the same results; I haven't checked.)
- Retrieve and save a copy of the device key signatures as reported by the `keys/query` endpoint.
- Use another client to forcibly log that device out. (Having the device log itself out might yield the same results; I haven't checked.)
- Log in another new device, passing the old device's device_id to the `login` endpoint.
- Retrieve its device key signatures as reported by the `keys/query` endpoint.
- Compare the signatures of this device to those of the old one.
Note that the old device's self_signing signature has reappeared in the new device's key/signature data.
### Homeserver
matrix.org
### Synapse Version
1.110.0rc1 (b=matrix-org-hotfixes,ddc46e90a8)
### Installation Method
I don't know
### Database
I don't know; It's the matrix.org server.
### Workers
I don't know
### Platform
I don't know; It's the matrix.org server.
### Configuration
_No response_
### Relevant log output
```shell
I don't have it; It's the matrix.org server.
```
### Anything else that would be useful to know?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.