matrix-org / matrix-org/matrix-spec

`key/v2/server` example response isn't signed by any of the example verify_keys

Open
#1,448 3 comments 0 reactions 0 assignees View on GitHub
A-S2S clarification
Dominant language
HTML
Stars
330
Forks
150
Avg merge
2h 21m
Merged PRs (30d)
3

Description

**Link to problem area**: https://spec.matrix.org/v1.6/server-server-api/#get_matrixkeyv2server

**Issue**
What is wrong? How can we improve?

> signatures: Digital signatures for this object signed using the verify_keys.

The example response claims to be signed by the private key `example.org/ed25519:auto2`. But the example response doesn't include a public key for `example.org/ed25519:auto2`; it only defines `example.org/ed25519:abc123` and `example.org/ed25519:0ldk3y`.

```json
{
"old_verify_keys": {
"ed25519:0ldk3y": {
"expired_ts": 1532645052628,
"key": "VGhpcyBzaG91bGQgYmUgeW91ciBvbGQga2V5J3MgZWQyNTUxOSBwYXlsb2FkLg"
}
},
"server_name": "example.org",
"signatures": {
"example.org": {
"ed25519:auto2": "VGhpcyBzaG91bGQgYWN0dWFsbHkgYmUgYSBzaWduYXR1cmU"
}
},
"valid_until_ts": 1652262000000,
"verify_keys": {
"ed25519:abc123": {
"key": "VGhpcyBzaG91bGQgYmUgYSByZWFsIGVkMjU1MTkgcGF5bG9hZA"
}
}
}
```

Therefore, a recipient processing this response

- cannot conclude that `example.org` controls the private key `ed25519:abc123` (how can it verify the signature?), and
- cannot trust anything else about this response(?)

The fix is presumably `s/auto2/abc123/`?

Contributor guide

Open the contributing guide

Research direction

Open the linked Matrix server-server API section and inspect the `key/v2/server` example response, especially `signatures` and `verify_keys`. Make the example's signing key identifier match one of its listed verification keys, then verify that the rendered specification shows a consistent example.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.