Clarify that the key backup MAC is implemented incorrectly

[sumnerevans]

---

name: Clarify that the key backup MAC is implemented incorrectly
about: Clarify that the key backup MAC is implemented incorrectly
title: Clarify that the key backup MAC is implemented incorrectly
labels: ''
assignees: ''

---

Due to a bug in libolm, all implementations of the
m.megolm_backup.v1.curve25519-aes-sha2 key backup algorithm incorrectly
pass an empty string through HMAC-SHA-256 to generate the mac property
of the session_data.

It was intended for the entire raw encrypted data to be passed through
HMAC-SHA-256, but the issue was caught too late in the process, and thus
we are stuck with this until a new key backup algorithm is introduced.

This commit clarifies the real-world behavior of all current
implementations.

Signed-off-by: Sumner Evans [email protected]

Pull Request Checklist

• Pull request includes a changelog file
• Pull request includes a sign off
• Pull request is classified as 'other changes'

Preview: https://pr1712--matrix-spec-previews.netlify.app

[tulir]

This was found while implementing key backup in mautrix-go (mautrix/go#154)

For reference, this is implemented in matrix-rust-sdk for libolm compatibility: decrypt, encrypt (it never calls update on the hmac). I think the libolm implementation is somewhere around https://gitlab.matrix.org/matrix-org/olm/-/blob/3.2.16/src/pk.cpp#L408-427, but I don't understand C++ well enough to tell why it's wrong.

[sumnerevans]

Specifically, I think that https://gitlab.matrix.org/matrix-org/olm/-/blob/master/src/cipher.cpp#L127 is the line that is incorrect in libolm. I think it should be passing ciphertext, ciphertext_length instead of input, input_length - MAC_LENGTH.

Given the function call that @tulir mentioned: https://gitlab.matrix.org/matrix-org/olm/-/blob/3.2.16/src/pk.cpp#L424, it appears that the MAC key is passed as input, and the MAC_LENGTH is passed as input_length, meaning that when input_length - MAC_LENGTH is 0, and regardless of how long input is, nothing will be hashed.

[uhoreg]

Thanks