@@ -234,65 +234,72 @@ class Rendezvous(
234
234
if (verificationResponse?.outcome == Outcome .VERIFIED || verificationResponse?.type == PayloadType .VERIFIED ) {
235
235
val verifyingDeviceId = verificationResponse.verifyingDeviceId
236
236
? : throw RendezvousError (" No verifying device id returned" , RendezvousFailureReason .ProtocolError )
237
- val verifyingDeviceFromServer = crypto.getCryptoDeviceInfo(userId, verifyingDeviceId)
238
- if (verifyingDeviceFromServer?.fingerprint() != verificationResponse.verifyingDeviceKey) {
239
- Timber .tag(TAG ).w(
240
- " Verifying device $verifyingDeviceId key doesn't match: ${
241
- verifyingDeviceFromServer?.fingerprint()
242
- } vs ${verificationResponse.verifyingDeviceKey} )"
243
- )
237
+ handleVerification(session, verifyingDeviceId, verificationResponse.verifyingDeviceKey, verificationResponse.masterKey)
238
+ } else {
239
+ Timber .tag(TAG ).i(" Not doing verification" )
240
+ }
241
+ }
242
+
243
+ @Throws(RendezvousError ::class )
244
+ private suspend fun handleVerification (session : Session , verifyingDeviceId : String , verifyingDeviceKey : String? , masterKey : String? ) {
245
+ var crypto = session.cryptoService()
246
+ var userId = session.myUserId
247
+ val verifyingDeviceFromServer = crypto.getCryptoDeviceInfo(userId, verifyingDeviceId)
248
+ if (verifyingDeviceFromServer?.fingerprint() != verifyingDeviceKey) {
249
+ Timber .tag(TAG ).w(
250
+ " Verifying device $verifyingDeviceId key doesn't match: ${
251
+ verifyingDeviceFromServer?.fingerprint()
252
+ } vs $verifyingDeviceKey )"
253
+ )
254
+ // inform the other side
255
+ if (isUsingV1()) {
256
+ send(Payload (PayloadType .FINISH , outcome = Outcome .E2EE_SECURITY_ERROR ))
257
+ } else {
258
+ send(Payload (PayloadType .FAILURE , reason = FailureReason .E2EE_SECURITY_ERROR ))
259
+ }
260
+ throw RendezvousError (" Key from verifying device doesn't match" , RendezvousFailureReason .E2EESecurityIssue )
261
+ }
262
+
263
+ masterKey?.let { masterKeyFromVerifyingDevice ->
264
+ // verifying device provided us with a master key, so use it to check integrity
265
+
266
+ // see what the homeserver told us
267
+ val localMasterKey = crypto.crossSigningService().getMyCrossSigningKeys()?.masterKey()
268
+
269
+ // n.b. if no local master key this is a problem, as well as it not matching
270
+ if (localMasterKey?.unpaddedBase64PublicKey != masterKeyFromVerifyingDevice) {
271
+ Timber .tag(TAG ).w(" Master key from verifying device doesn't match: $masterKeyFromVerifyingDevice vs $localMasterKey " )
244
272
// inform the other side
245
273
if (isUsingV1()) {
246
274
send(Payload (PayloadType .FINISH , outcome = Outcome .E2EE_SECURITY_ERROR ))
247
275
} else {
248
276
send(Payload (PayloadType .FAILURE , reason = FailureReason .E2EE_SECURITY_ERROR ))
249
277
}
250
- throw RendezvousError (" Key from verifying device doesn't match" , RendezvousFailureReason .E2EESecurityIssue )
278
+ throw RendezvousError (" Master key from verifying device doesn't match" , RendezvousFailureReason .E2EESecurityIssue )
251
279
}
252
280
253
- verificationResponse.masterKey?.let { masterKeyFromVerifyingDevice ->
254
- // verifying device provided us with a master key, so use it to check integrity
255
-
256
- // see what the homeserver told us
257
- val localMasterKey = crypto.crossSigningService().getMyCrossSigningKeys()?.masterKey()
258
-
259
- // n.b. if no local master key this is a problem, as well as it not matching
260
- if (localMasterKey?.unpaddedBase64PublicKey != masterKeyFromVerifyingDevice) {
261
- Timber .tag(TAG ).w(" Master key from verifying device doesn't match: $masterKeyFromVerifyingDevice vs $localMasterKey " )
262
- // inform the other side
263
- if (isUsingV1()) {
264
- send(Payload (PayloadType .FINISH , outcome = Outcome .E2EE_SECURITY_ERROR ))
265
- } else {
266
- send(Payload (PayloadType .FAILURE , reason = FailureReason .E2EE_SECURITY_ERROR ))
267
- }
268
- throw RendezvousError (" Master key from verifying device doesn't match" , RendezvousFailureReason .E2EESecurityIssue )
269
- }
270
-
271
- // set other device as verified
272
- Timber .tag(TAG ).i(" Setting device $verifyingDeviceId as verified" )
273
- crypto.setDeviceVerification(DeviceTrustLevel (locallyVerified = true , crossSigningVerified = false ), userId, verifyingDeviceId)
281
+ // set other device as verified
282
+ Timber .tag(TAG ).i(" Setting device $verifyingDeviceId as verified" )
283
+ crypto.setDeviceVerification(DeviceTrustLevel (locallyVerified = true , crossSigningVerified = false ), userId, verifyingDeviceId)
274
284
275
- Timber .tag(TAG ).i(" Setting master key as trusted" )
276
- crypto.crossSigningService().markMyMasterKeyAsTrusted()
277
- } ? : run {
278
- // set other device as verified anyway
279
- Timber .tag(TAG ).i(" Setting device $verifyingDeviceId as verified" )
280
- crypto.setDeviceVerification(DeviceTrustLevel (locallyVerified = true , crossSigningVerified = false ), userId, verifyingDeviceId)
285
+ Timber .tag(TAG ).i(" Setting master key as trusted" )
286
+ crypto.crossSigningService().markMyMasterKeyAsTrusted()
287
+ } ? : run {
288
+ // set other device as verified anyway
289
+ Timber .tag(TAG ).i(" Setting device $verifyingDeviceId as verified" )
290
+ crypto.setDeviceVerification(DeviceTrustLevel (locallyVerified = true , crossSigningVerified = false ), userId, verifyingDeviceId)
281
291
282
- Timber .tag(TAG ).i(" No master key given by verifying device" )
283
- }
292
+ Timber .tag(TAG ).i(" No master key given by verifying device" )
293
+ }
284
294
285
- // request secrets from the verifying device
286
- Timber .tag(TAG ).i(" Requesting secrets from $verifyingDeviceId " )
295
+ // request secrets from the verifying device
296
+ Timber .tag(TAG ).i(" Requesting secrets from $verifyingDeviceId " )
287
297
288
- session.sharedSecretStorageService().let {
289
- it.requestSecret(MASTER_KEY_SSSS_NAME , verifyingDeviceId)
290
- it.requestSecret(SELF_SIGNING_KEY_SSSS_NAME , verifyingDeviceId)
291
- it.requestSecret(USER_SIGNING_KEY_SSSS_NAME , verifyingDeviceId)
292
- it.requestSecret(KEYBACKUP_SECRET_SSSS_NAME , verifyingDeviceId)
293
- }
294
- } else {
295
- Timber .tag(TAG ).i(" Not doing verification" )
298
+ session.sharedSecretStorageService().let {
299
+ it.requestSecret(MASTER_KEY_SSSS_NAME , verifyingDeviceId)
300
+ it.requestSecret(SELF_SIGNING_KEY_SSSS_NAME , verifyingDeviceId)
301
+ it.requestSecret(USER_SIGNING_KEY_SSSS_NAME , verifyingDeviceId)
302
+ it.requestSecret(KEYBACKUP_SECRET_SSSS_NAME , verifyingDeviceId)
296
303
}
297
304
}
298
305
0 commit comments