Filip/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec synced 2026-03-23 19:44:09 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

sas: clarify ECDH process in step 12

Browse source 
As written, the spec is not clear what Bob's device is supposed to do as
that device does not have Alice's device's private key.

Signed-off-by: Sumner Evans <sumner@beeper.com>
This commit is contained in:
Sumner Evans 2024-01-29 23:32:26 -07:00
parent 9a5cacda90
commit a6b643bbc5
No known key found for this signature in database
GPG key ID: 8904527AB50022FD
2 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelogs/client_server/newsfragments/1720.clarification Normal file
View file

@ -0,0 +1 @@
Clarify how to perform the ECDH exchange in step 12 of the SAS process.

10
content/client-server-api/modules/end_to_end_encryption.md
View file

@ -660,10 +660,12 @@ The process between Alice and Bob verifying each other would be:
11. Alice's device receives Bob's message and verifies the commitment 11. Alice's device receives Bob's message and verifies the commitment
hash from earlier matches the hash of the key Bob's device just sent hash from earlier matches the hash of the key Bob's device just sent
and the content of Alice's `m.key.verification.start` message. and the content of Alice's `m.key.verification.start` message.
12. Both Alice and Bob's devices perform an Elliptic-curve 12. Both Alice and Bob's devices perform an Elliptic-curve Diffie-Hellman using
Diffie-Hellman their private ephemeral key, and the other device's ephemeral public key
(*ECDH(K<sub>A</sub><sup>private</sup>*, *K<sub>B</sub><sup>public</sup>*)), (*ECDH(K<sub>A</sub><sup>private</sup>*, *K<sub>B</sub><sup>public</sup>*)
using the result as the shared secret. for Alice's device and
*ECDH(K<sub>B</sub><sup>private</sup>*, *K<sub>A</sub><sup>public</sup>*)
for Bob's device), using the result as the shared secret.
13. Both Alice and Bob's devices display a SAS to their users, which is 13. Both Alice and Bob's devices display a SAS to their users, which is
derived from the shared key using one of the methods in this derived from the shared key using one of the methods in this
section. If multiple SAS methods are available, clients should allow section. If multiple SAS methods are available, clients should allow