Skip to content

Commit a5ebedc

Browse files
uhoreguhoreg
committed
apply suggestions from review
1 parent c8e816d commit a5ebedc

File tree

4 files changed

+48
-39
lines changed

4 files changed

+48
-39
lines changed

‎api/client-server/cross_signing.yaml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -107,19 +107,28 @@ paths:
107107
example: {}
108108
400:
109109
description: |-
110-
The input was invalid in some way. This can include one of the
110+
The input was invalid in some way. This can include one of the
111111
following error codes:
112112
113-
* ``M_INVALID_SIGNATURE``: The self-signing or user-signing key
114-
had an incorrect signature
115-
* ``M_FORBIDDEN``: The public key of one of the keys is the same as
116-
one of the user\'s device IDs.
113+
* ``M_INVALID_SIGNATURE``: For example, the self-signing or
114+
user-signing key had an incorrect signature.
115+
* ``M_MISSING_PARAM``: No master key is available.
117116
schema:
118117
type: object
119118
example: {
120119
"errcode": "M_INVALID_SIGNATURE",
121120
"error": "Invalid signature"
122121
}
122+
403:
123+
description: |-
124+
The public key of one of the keys is the same as one of the user\'s
125+
device IDs or the request is unauthorized.
126+
schema:
127+
type: object
128+
example: {
129+
"errcode": "M_FORBIDDEN",
130+
"error": "Key ID in use"
131+
}
123132
"/keys/signatures/upload":
124133
post:
125134
summary: Upload cross-signing signatures.

‎api/client-server/login.yaml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,10 @@ paths:
123123
type: string
124124
description: |-
125125
ID of the client device. If this does not correspond to a
126-
known client device, a new device will be created. The server
127-
will auto-generate a device_id if this is not specified.
126+
known client device, a new device will be created. The given
127+
device ID must not be the same as a `cross-signing key ID
128+
<#cross-signing>`_. The server will auto-generate a device_id
129+
if this is not specified.
128130
initial_device_display_name:
129131
type: string
130132
description: |-
@@ -195,7 +197,9 @@ paths:
195197
403:
196198
description: |-
197199
The login attempt failed. This can include one of the following error codes:
198-
* ``M_FORBIDDEN``: The provided authentication data was incorrect.
200+
* ``M_FORBIDDEN``: The provided authentication data was incorrect
201+
or the requested device ID is the same as a cross-signing key
202+
ID.
199203
* ``M_USER_DEACTIVATED``: The user has been deactivated.
200204
examples:
201205
application/json: {

‎api/server-server/definitions/event-schemas/m.signing_key_update.yaml‎

Lines changed: 20 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -37,32 +37,28 @@ allOf:
3737
example: "@alice:example.com"
3838
master_key:
3939
type: object
40-
allOf:
41-
- $ref: ../../../client-server/definitions/cross_signing_key.yaml
42-
# FIXME: why isn't the doc generator picking up this example?
43-
- example: {
44-
"user_id": "@alice:example.com",
45-
"usage": ["self_signing"],
46-
"keys": {
47-
"ed25519:base64+self+signing+public+key": "base64+self+signing+master+public+key",
48-
},
49-
"signatures": {
50-
"@alice:example.com": {
51-
"ed25519:base64+master+public+key": "signature+of+self+signing+key"
52-
}
53-
}
54-
}
40+
$ref: ../../../client-server/definitions/cross_signing_key.yaml
41+
example: {
42+
"user_id": "@alice:example.com",
43+
"usage": ["master"],
44+
"keys": {
45+
"ed25519:base64+master+public+key": "base64+master+public+key",
46+
}
47+
}
5548
self_signing_key:
5649
type: object
57-
allOf:
58-
- $ref: ../../../client-server/definitions/cross_signing_key.yaml
59-
# FIXME: why isn't the doc generator picking up this example?
60-
- example: {
61-
"user_id": "@alice:example.com",
62-
"usage": ["master"],
63-
"keys": {
64-
"ed25519:base64+master+public+key": "base64+master+public+key",
65-
}
50+
$ref: ../../../client-server/definitions/cross_signing_key.yaml
51+
example: {
52+
"user_id": "@alice:example.com",
53+
"usage": ["self_signing"],
54+
"keys": {
55+
"ed25519:base64+self+signing+public+key": "base64+self+signing+master+public+key",
56+
},
57+
"signatures": {
58+
"@alice:example.com": {
59+
"ed25519:base64+master+public+key": "signature+of+self+signing+key"
6660
}
61+
}
62+
}
6763
required:
6864
- user_id

‎specification/modules/end_to_end_encryption.rst‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -848,13 +848,13 @@ that she cannot see:
848848
| +------+ | | +----+ |
849849
+----------------+ +--------------+
850850
851-
Verification methods can be used to verify a user's master key by using the
852-
master public key, encoded using unpadded base64, as the device ID, and
853-
treating it as a normal device. For example, if Alice and Bob verify each other
854-
using SAS, Alice's ``m.key.verification.mac`` message to Bob may include
855-
``"ed25519:alices+master+public+key": "alices+master+public+key"`` in the ``mac``
856-
property. Servers therefore must ensure that device IDs will not collide with
857-
cross-signing public keys.
851+
`Verification methods <#device-verification>`_ can be used to verify a user's
852+
master key by using the master public key, encoded using unpadded base64, as
853+
the device ID, and treating it as a normal device. For example, if Alice and
854+
Bob verify each other using SAS, Alice's ``m.key.verification.mac`` message to
855+
Bob may include ``"ed25519:alices+master+public+key":
856+
"alices+master+public+key"`` in the ``mac`` property. Servers therefore must
857+
ensure that device IDs will not collide with cross-signing public keys.
858858

859859
Key and signature security
860860
<<<<<<<<<<<<<<<<<<<<<<<<<<

0 commit comments

Comments
 (0)