element-hq / element-hq/synapse
Reject attempts to change the device keys of an existing device
Open
A-E2EE
A-Performance
good first issue
O-Occasional
T-Enhancement
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
Synapse allows clients to change the Ed25519 and Curve25519 keys of an existing device via `/keys/upload`. I don't think this has a legitimate usecase; indeed matrix-sdk-crypto [ignores](https://github.com/matrix-org/matrix-rust-sdk/blob/c6e55c1a366c242fb65d7138ee425969dceb175a/crates/matrix-sdk-crypto/src/identities/device.rs#L862-L866) any attempt to change the Ed25519 key.
And it's not great for performance, especially if you have a couple of clients fighting over the "correct" key.
[Note that resetting your cross-signing keys requires changing the *signature* on the device keys, but not the keys themselves.]
Contributor guide
Assessment
This issue has not been assessed yet.