matrix-org / matrix-org/matrix-rust-sdk
MSC3834: Opportunistic user key pinning (TOFU)
- Dominant language
- Rust
- Stars
- 2.3k
- Forks
- 500
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 106
Description
Part of https://github.com/element-hq/element-meta/issues/764.
Establish a TOFU-style mechanism where users' signing keys are pinned when they're first encountered; internally, this will look similar to user verification, but will require no action on either user's part, and correspondingly will not be considered as high a level of trust.
As per MSC3834.
Contributor guide
Research direction
Start by reading MSC3834 and the linked element-meta issue 764 to understand the intended TOFU-style key-pinning behavior. Trace the existing user-verification flow in the Rust SDK and determine the appropriate integration point. Done means users' signing keys are pinned on first encounter without user action and represented as lower trust than verification.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100