diff --git a/src/client.js b/src/client.js index 38bf40d96..ee4c85e52 100644 --- a/src/client.js +++ b/src/client.js @@ -1310,7 +1310,6 @@ wrapCryptoFuncs(MatrixClient, [ "bootstrapSecretStorage", "addSecretStorageKey", "hasSecretStorageKey", - "secretStorageKeyNeedsUpgrade", "storeSecret", "getSecret", "isSecretStored", diff --git a/src/crypto/SecretStorage.js b/src/crypto/SecretStorage.js index 3334af1aa..227837a3e 100644 --- a/src/crypto/SecretStorage.js +++ b/src/crypto/SecretStorage.js @@ -24,9 +24,6 @@ import {encodeBase64} from "./olmlib"; export const SECRET_STORAGE_ALGORITHM_V1_AES = "m.secret_storage.v1.aes-hmac-sha2"; -// don't use curve25519 for writing data. -export const SECRET_STORAGE_ALGORITHM_V1_CURVE25519 - = "m.secret_storage.v1.curve25519-aes-sha2"; const ZERO_STR = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"; @@ -193,15 +190,6 @@ export class SecretStorage extends EventEmitter { return !!(await this.getKey(keyId)); } - async keyNeedsUpgrade(keyId) { - const keyInfo = await this.getKey(keyId); - if (keyInfo && keyInfo[1].algorithm === SECRET_STORAGE_ALGORITHM_V1_CURVE25519) { - return true; - } else { - return false; - } - } - /** * Check whether a key matches what we expect based on the key info * @@ -211,9 +199,7 @@ export class SecretStorage extends EventEmitter { * @return {boolean} whether or not the key matches */ async checkKey(key, info) { - switch (info.algorithm) { - case SECRET_STORAGE_ALGORITHM_V1_AES: - { + if (info.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) { if (info.mac) { const {mac} = await SecretStorage._calculateKeyCheck(key, info.iv); return info.mac === mac; @@ -221,22 +207,7 @@ export class SecretStorage extends EventEmitter { // if we have no information, we have to assume the key is right return true; } - } - case SECRET_STORAGE_ALGORITHM_V1_CURVE25519: - { - let decryption = null; - try { - decryption = new global.Olm.PkDecryption(); - const gotPubkey = decryption.init_with_private_key(key); - // make sure it agrees with the given pubkey - return gotPubkey === info.pubkey; - } catch (e) { - return false; - } finally { - if (decryption) decryption.free(); - } - } - default: + } else { throw new Error("Unknown algorithm"); } } @@ -352,24 +323,11 @@ export class SecretStorage extends EventEmitter { "m.secret_storage.key." + keyId, ); const encInfo = secretInfo.encrypted[keyId]; - switch (keyInfo.algorithm) { - case SECRET_STORAGE_ALGORITHM_V1_AES: + // only use keys we understand the encryption algorithm of + if (keyInfo.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) { if (encInfo.iv && encInfo.ciphertext && encInfo.mac) { keys[keyId] = keyInfo; } - break; - case SECRET_STORAGE_ALGORITHM_V1_CURVE25519: - if ( - keyInfo.pubkey && ( - (encInfo.ciphertext && encInfo.mac && encInfo.ephemeral) || - encInfo.passthrough - ) - ) { - keys[keyId] = keyInfo; - } - break; - default: - // do nothing if we don't understand the encryption algorithm } } @@ -445,32 +403,11 @@ export class SecretStorage extends EventEmitter { continue; } - switch (keyInfo.algorithm) { - case SECRET_STORAGE_ALGORITHM_V1_AES: + // only use keys we understand the encryption algorithm of + if (keyInfo.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) { if (encInfo.iv && encInfo.ciphertext && encInfo.mac) { ret[keyId] = keyInfo; } - break; - case SECRET_STORAGE_ALGORITHM_V1_CURVE25519: - if (keyInfo.pubkey && encInfo.ciphertext && encInfo.mac - && encInfo.ephemeral) { - if (checkKey) { - try { - pkVerify( - keyInfo, - this._crossSigningInfo.getId('master'), - this._crossSigningInfo.userId, - ); - } catch (e) { - // not trusted, so move on to the next key - continue; - } - } - ret[keyId] = keyInfo; - } - break; - default: - // do nothing if we don't understand the encryption algorithm } } return Object.keys(ret).length ? ret : null; @@ -674,9 +611,7 @@ export class SecretStorage extends EventEmitter { throw new Error("App returned unknown key from getSecretStorageKey!"); } - switch (keys[keyId].algorithm) { - case SECRET_STORAGE_ALGORITHM_V1_AES: - { + if (keys[keyId].algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) { const decryption = { encrypt: async function(secret) { return await encryptAES(secret, privateKey, name); @@ -686,36 +621,7 @@ export class SecretStorage extends EventEmitter { }, }; return [keyId, decryption]; - } - case SECRET_STORAGE_ALGORITHM_V1_CURVE25519: - { - const pkDecryption = new global.Olm.PkDecryption(); - let pubkey; - try { - pubkey = pkDecryption.init_with_private_key(privateKey); - } catch (e) { - pkDecryption.free(); - throw new Error("getSecretStorageKey callback returned invalid key"); - } - if (pubkey !== keys[keyId].pubkey) { - pkDecryption.free(); - throw new Error( - "getSecretStorageKey callback returned incorrect key", - ); - } - const decryption = { - free: pkDecryption.free.bind(pkDecryption), - decrypt: async function(encInfo) { - return pkDecryption.decrypt( - encInfo.ephemeral, encInfo.mac, encInfo.ciphertext, - ); - }, - // needed for passthrough - get_private_key: pkDecryption.get_private_key.bind(pkDecryption), - }; - return [keyId, decryption]; - } - default: + } else { throw new Error("Unknown key type: " + keys[keyId].algorithm); } } diff --git a/src/crypto/index.js b/src/crypto/index.js index 79b914e30..a66527fd8 100644 --- a/src/crypto/index.js +++ b/src/crypto/index.js @@ -831,10 +831,6 @@ Crypto.prototype.hasSecretStorageKey = function(keyID) { return this._secretStorage.hasKey(keyID); }; -Crypto.prototype.secretStorageKeyNeedsUpgrade = function(keyID) { - return this._secretStorage.keyNeedsUpgrade(keyID); -}; - Crypto.prototype.getSecretStorageKey = function(keyID) { return this._secretStorage.getKey(keyID); };