Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify that the key backup MAC is implemented incorrectly #1712

Merged
merged 2 commits into from
Jan 16, 2024
Merged

Clarify that the key backup MAC is implemented incorrectly #1712

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
77b2879
Clarify that the key backup MAC is implemented incorrectly
sumnerevans Jan 16, 2024
0b741e3
Fix formatting of warning
sumnerevans Jan 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelogs/client_server/newsfragments/1712.clarification
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Clarify that the key backup MAC is implemented incorrectly and does not pass the ciphertext through HMAC-SHA-256.
16 changes: 12 additions & 4 deletions content/client-server-api/modules/end_to_end_encryption.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1364,10 +1364,18 @@ The `session_data` field in the backups is constructed as follows:
PKCS\#7 padding. This encrypted data, encoded using unpadded base64,
becomes the `ciphertext` property of the `session_data`.

5. Pass the raw encrypted data (prior to base64 encoding) through
HMAC-SHA-256 using the MAC key generated above. The first 8 bytes of
the resulting MAC are base64-encoded, and become the `mac` property
of the `session_data`.
5. Pass an empty string through HMAC-SHA-256 using the MAC key generated above.
The first 8 bytes of the resulting MAC are base64-encoded, and become the
`mac` property of the `session_data`.

{{% boxes/warning %}}
Step 5 was intended to pass the raw encrypted data, but due to a bug in libolm,
all implementations have since passed an empty string instead.

Future versions of the spec will fix this problem. See
[MSC4048](https://github.com/matrix-org/matrix-spec-proposals/pull/4048) for a
potential new key backup algorithm version that would fix this issue.
{{% /boxes/warning %}}

{{% definition path="api/client-server/definitions/key_backup_session_data" %}}

Expand Down
Loading