matrix-org / matrix-org/matrix-rust-sdk

MSC3834: Opportunistic user key pinning (TOFU)

Open
#1,528 0 comments 0 reactions 0 assignees View on GitHub
A-Encryption enhancement
Dominant language
Rust
Stars
2.3k
Forks
500
Avg merge
1d 16h
Merged PRs (30d)
106

Description

Part of https://github.com/element-hq/element-meta/issues/764.

Establish a TOFU-style mechanism where users' signing keys are pinned when they're first encountered; internally, this will look similar to user verification, but will require no action on either user's part, and correspondingly will not be considered as high a level of trust.

As per MSC3834.

Contributor guide

Open the contributing guide

Research direction

Start by reading MSC3834 and the linked element-meta issue 764 to understand the intended TOFU-style key-pinning behavior. Trace the existing user-verification flow in the Rust SDK and determine the appropriate integration point. Done means users' signing keys are pinned on first encounter without user action and represented as lower trust than verification.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.