matrix-org / matrix-org/matrix-spec
`key/v2/server` example response isn't signed by any of the example verify_keys
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
**Link to problem area**: https://spec.matrix.org/v1.6/server-server-api/#get_matrixkeyv2server
**Issue**
What is wrong? How can we improve?
> signatures: Digital signatures for this object signed using the verify_keys.
The example response claims to be signed by the private key `example.org/ed25519:auto2`. But the example response doesn't include a public key for `example.org/ed25519:auto2`; it only defines `example.org/ed25519:abc123` and `example.org/ed25519:0ldk3y`.
```json
{
"old_verify_keys": {
"ed25519:0ldk3y": {
"expired_ts": 1532645052628,
"key": "VGhpcyBzaG91bGQgYmUgeW91ciBvbGQga2V5J3MgZWQyNTUxOSBwYXlsb2FkLg"
}
},
"server_name": "example.org",
"signatures": {
"example.org": {
"ed25519:auto2": "VGhpcyBzaG91bGQgYWN0dWFsbHkgYmUgYSBzaWduYXR1cmU"
}
},
"valid_until_ts": 1652262000000,
"verify_keys": {
"ed25519:abc123": {
"key": "VGhpcyBzaG91bGQgYmUgYSByZWFsIGVkMjU1MTkgcGF5bG9hZA"
}
}
}
```
Therefore, a recipient processing this response
- cannot conclude that `example.org` controls the private key `ed25519:abc123` (how can it verify the signature?), and
- cannot trust anything else about this response(?)
The fix is presumably `s/auto2/abc123/`?
Contributor guide
Research direction
Open the linked Matrix server-server API section and inspect the `key/v2/server` example response, especially `signatures` and `verify_keys`. Make the example's signing key identifier match one of its listed verification keys, then verify that the rendered specification shows a consistent example.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100