add ability to sign yourself based on ssss
This commit is contained in:
parent
e4e4386178
commit
aefe029c0a
|
|
@ -27,6 +27,31 @@ class CrossSigning {
|
||||||
(await client.ssss.getCached(USER_SIGNING_KEY)) != null;
|
(await client.ssss.getCached(USER_SIGNING_KEY)) != null;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Future<void> selfSign({String password, String recoveryKey}) async {
|
||||||
|
final handle = client.ssss.open(MASTER_KEY);
|
||||||
|
await handle.unlock(password: password, recoveryKey: recoveryKey);
|
||||||
|
await handle.maybeCacheAll();
|
||||||
|
final masterPrivateKey = base64.decode(await handle.getStored(MASTER_KEY));
|
||||||
|
final keyObj = olm.PkSigning();
|
||||||
|
String masterPubkey;
|
||||||
|
try {
|
||||||
|
masterPubkey = keyObj.init_with_seed(masterPrivateKey);
|
||||||
|
} finally {
|
||||||
|
keyObj.free();
|
||||||
|
}
|
||||||
|
if (masterPubkey == null || !client.userDeviceKeys.containsKey(client.userID) || !client.userDeviceKeys[client.userID].deviceKeys.containsKey(client.deviceID)) {
|
||||||
|
throw 'Master or user keys not found';
|
||||||
|
}
|
||||||
|
final masterKey = client.userDeviceKeys[client.userID].masterKey;
|
||||||
|
if (masterKey == null || masterKey.ed25519Key != masterPubkey) {
|
||||||
|
throw 'Master pubkey key doesn\'t match';
|
||||||
|
}
|
||||||
|
// master key is valid, set it to verified
|
||||||
|
masterKey.setVerified(true, false);
|
||||||
|
// and now sign bout our own key and our master key
|
||||||
|
await sign([masterKey, client.userDeviceKeys[client.userID].deviceKeys[client.deviceID]]);
|
||||||
|
}
|
||||||
|
|
||||||
bool signable(List<SignedKey> keys) {
|
bool signable(List<SignedKey> keys) {
|
||||||
for (final key in keys) {
|
for (final key in keys) {
|
||||||
if (key is CrossSigningKey && key.usage.contains('master')) {
|
if (key is CrossSigningKey && key.usage.contains('master')) {
|
||||||
|
|
@ -86,7 +111,7 @@ class CrossSigning {
|
||||||
signature);
|
signature);
|
||||||
}
|
}
|
||||||
// we don't care about signing other cross-signing keys
|
// we don't care about signing other cross-signing keys
|
||||||
} else if (key.identifier != client.deviceID) {
|
} else {
|
||||||
// okay, we'll sign a device key with our self signing key
|
// okay, we'll sign a device key with our self signing key
|
||||||
selfSigningKey ??= base64
|
selfSigningKey ??= base64
|
||||||
.decode(await client.ssss.getCached(SELF_SIGNING_KEY) ?? '');
|
.decode(await client.ssss.getCached(SELF_SIGNING_KEY) ?? '');
|
||||||
|
|
@ -119,8 +144,8 @@ class CrossSigning {
|
||||||
|
|
||||||
String _sign(String canonicalJson, Uint8List key) {
|
String _sign(String canonicalJson, Uint8List key) {
|
||||||
final keyObj = olm.PkSigning();
|
final keyObj = olm.PkSigning();
|
||||||
keyObj.init_with_seed(key);
|
|
||||||
try {
|
try {
|
||||||
|
keyObj.init_with_seed(key);
|
||||||
return keyObj.sign(canonicalJson);
|
return keyObj.sign(canonicalJson);
|
||||||
} finally {
|
} finally {
|
||||||
keyObj.free();
|
keyObj.free();
|
||||||
|
|
|
||||||
|
|
@ -213,7 +213,11 @@ class SSSS {
|
||||||
for (final type in CACHE_TYPES) {
|
for (final type in CACHE_TYPES) {
|
||||||
final secret = await getCached(type);
|
final secret = await getCached(type);
|
||||||
if (secret == null) {
|
if (secret == null) {
|
||||||
await getStored(type, keyId, key);
|
try {
|
||||||
|
await getStored(type, keyId, key);
|
||||||
|
} catch (_) {
|
||||||
|
// the entry wasn't stored, just ignore it
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -168,7 +168,7 @@ abstract class SignedKey {
|
||||||
return valid;
|
return valid;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool hasValidSignatureChain({bool verfiedOnly = true, Set<String> visited}) {
|
bool hasValidSignatureChain({bool verifiedOnly = true, Set<String> visited}) {
|
||||||
visited ??= <String>{};
|
visited ??= <String>{};
|
||||||
final setKey = '${userId};${identifier}';
|
final setKey = '${userId};${identifier}';
|
||||||
if (visited.contains(setKey)) {
|
if (visited.contains(setKey)) {
|
||||||
|
|
@ -228,15 +228,15 @@ abstract class SignedKey {
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((verifiedOnly && key.directVerified) ||
|
if ((verifiedOnly && key.directVerified) ||
|
||||||
(key is SignedKey &&
|
(key is CrossSigningKey &&
|
||||||
key.usage.includes('master') &&
|
key.usage.contains('master') &&
|
||||||
key.directVerified &&
|
key.directVerified &&
|
||||||
key.userId == client.userID)) {
|
key.userId == client.userID)) {
|
||||||
return true; // we verified this key and it is valid...all checks out!
|
return true; // we verified this key and it is valid...all checks out!
|
||||||
}
|
}
|
||||||
// or else we just recurse into that key and chack if it works out
|
// or else we just recurse into that key and chack if it works out
|
||||||
final haveChain = key.hasValidSignatureChain(
|
final haveChain = key.hasValidSignatureChain(
|
||||||
verfiedOnly: verfiedOnly, visited: visited);
|
verifiedOnly: verifiedOnly, visited: visited);
|
||||||
if (haveChain) {
|
if (haveChain) {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue