matrix/matrix-js-sdk
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-js-sdk.git synced 2025-12-05 17:02:07 +03:00
Code Activity

Create key backup with secret storage

Browse Source 
When secret storage is enable, create a random key for encrypting key backups
and store it in SSSS.
This commit is contained in:
J. Ryan Stinnett
2019-12-11 16:28:58 +00:00
parent a626b44bbe
commit 3f448df1d3
2 changed files with 22 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
src/client.js
View File

@@ -53,6 +53,7 @@ import { isCryptoAvailable } from './crypto';
import { decodeRecoveryKey } from './crypto/recoverykey';
import { keyFromAuthData } from './crypto/key_passphrase';
import { randomString } from './randomstring';
import { encodeBase64 } from '../lib/crypto/olmlib';
const SCROLLBACK_DELAY_MS = 3000;
const CRYPTO_ENABLED = isCryptoAvailable();
@@ -1437,7 +1438,7 @@ MatrixClient.prototype.disableKeyBackup = function() {
* when restoring the backup as an alternative to entering the recovery key.
* Optional.
* @param {boolean} [opts.secureSecretStorage = false] Whether to use Secure
* Secret Storage (MSC1946) to store the key encrypting key backups.
* Secret Storage to store the key encrypting key backups.
* Optional, defaults to false.
*
* @returns {Promise<object>} Object that can be passed to createKeyBackupVersion and
@@ -1451,28 +1452,25 @@ MatrixClient.prototype.prepareKeyBackupVersion = async function(
throw new Error("End-to-end encryption disabled");
}
if (secureSecretStorage) {
logger.log("Preparing key backup version with Secure Secret Storage");
// Ensure Secure Secret Storage is ready for use
if (!this.hasSecretStorageKey()) {
throw new Error("Secure Secret Storage has no keys, needs bootstrapping");
}
throw new Error("Not yet implemented");
}
const [keyInfo, encodedPrivateKey] =
const [keyInfo, encodedPrivateKey, privateKey] =
await this.createRecoveryKeyFromPassphrase(password);
if (secureSecretStorage) {
await this.storeSecret("m.megolm_backup.v1", encodeBase64(privateKey));
logger.info("Key backup private key stored in secret storage");
}
// Reshape objects into form expected for key backup
const authData = {
public_key: keyInfo.pubkey,
};
if (keyInfo.passphrase) {
authData.private_key_salt = keyInfo.passphrase.salt;
authData.private_key_iterations = keyInfo.passphrase.iterations;
}
return {
algorithm: olmlib.MEGOLM_BACKUP_ALGORITHM,
auth_data: {
public_key: keyInfo.pubkey,
private_key_salt: keyInfo.passphrase.salt,
private_key_iterations: keyInfo.passphrase.iterations,
},
auth_data: authData,
recovery_key: encodedPrivateKey,
};
};

10
src/crypto/index.js
View File

@@ -296,8 +296,9 @@ Crypto.prototype.init = async function() {
* @param {string} password Passphrase string that can be entered by the user
* when restoring the backup as an alternative to entering the recovery key.
* Optional.
* @returns {Promise<Array>} Array with public key metadata and encoded private
* recovery key which should be disposed of after displaying to the user.
* @returns {Promise<Array>} Array with public key metadata, encoded private
* recovery key which should be disposed of after displaying to the user,
* and raw private key to avoid round tripping if needed.
*/
Crypto.prototype.createRecoveryKeyFromPassphrase = async function(password) {
const decryption = new global.Olm.PkDecryption();
@@ -314,8 +315,9 @@ Crypto.prototype.createRecoveryKeyFromPassphrase = async function(password) {
} else {
keyInfo.pubkey = decryption.generate_key();
}
const encodedPrivateKey = encodeRecoveryKey(decryption.get_private_key());
return [keyInfo, encodedPrivateKey];
const privateKey = decryption.get_private_key();
const encodedPrivateKey = encodeRecoveryKey(privateKey);
return [keyInfo, encodedPrivateKey, privateKey];
} finally {
decryption.free();
}