matrix-org / matrix-org/matrix-rust-sdk

EX: Inform users when fixing "key storage out of sync" fails

Open
#4,736 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
2.3k
Forks
500
Avg merge
1d 16h
Merged PRs (30d)
106

Description

For example:

1. On a different device:
1. reset cryptographic identity
2. set up recovery
3. using the developer tools, edit the `m.cross_signing.user_signing` account data item to remove the content of the `encrypted` object, thus: `{"encrypted": {} }`
2. Back on the device under test, enter the newly-created recovery key to re-verify
3. Observe "Your key storage is out of sync" toast; click "Continue"
4. Enter recovery key, click "Continue"
5. Back to step 3

In the logs, there is this line:

```
18:14:54.036 I matrix_sdk_crypto::store: Successfully imported the private cross-signing keys status=CrossSigningStatus { has_master: true, has_self_signing: true, has_user_signing: false } | crates/matrix-sdk-crypto/src/store/mod.rs:1321 | spans: recover > import_secrets{self=SecretStore { key: SecretStorageKey { storage_key_info: SecretStorageKeyEventContent { key_id: "JsOhg6wGuD18Qjv235PUioHOXojWNbi7", name: None, algorithm: V1AesHmacSha2(SecretStorageV1AesHmacSha2Properties { iv: Some("kR2sRxtvSEIX4xZWujQkrg"), mac: Some("ESubXhxa3xvA4oUMBfIiiS47U6TO9jdXXF3P4Rry0AI") }), passphrase: None }, .. }, .. } user_id=@af:xps9320.sw1v.org device_id=ZZTJDJERZH}
```

Obviously, the user-signing key is not being imported. The problem is that the process is failing silently.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with crates/matrix-sdk-crypto/src/store/mod.rs around line 1321 and trace the recover and import_secrets flow described in the logs. Reproduce the missing user-signing key scenario using the numbered steps, then inspect how an incomplete import is reported. Done means the failed key-storage repair produces a user-visible error instead of silently returning to the recovery flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.