Max Litruv Boonzaayer
e058165830
Bump Vite 8, matrix-js-sdk, and related deps; fix immer/vanilla-extract imports for new majors. Replace blocking sync error dialog with background recovery on wake/offline, and disable Vite auto-open in dev. Add feature handoff documentation index.
93 lines
2.8 KiB
Markdown
93 lines
2.8 KiB
Markdown
# E2E encryption & devices — handoff
|
|
|
|
## Summary
|
|
|
|
End-to-end encryption support via matrix-js-sdk crypto store: device verification, cross-signing, secret storage, key backup/export, and session management. Critical for secure DM and encrypted rooms.
|
|
|
|
## User-facing behavior
|
|
|
|
- Verify new logins / other sessions
|
|
- Export room keys backup (`paarrot-keys.txt`)
|
|
- Restore backup after verification
|
|
- View and rename devices; logout remote sessions
|
|
- Unverified sessions tab in sidebar
|
|
|
|
## Architecture
|
|
|
|
```
|
|
secretStorageKeys.ts + cryptoCallbacks
|
|
Devices.tsx, Verification.tsx, LocalBackup.tsx
|
|
DeviceVerification.tsx — incoming verification
|
|
BackupRestore.tsx — auto restore on verify
|
|
useSecretStorage, useKeyBackup, useVerificationRequest hooks
|
|
```
|
|
|
|
## Key files
|
|
|
|
| Path | Role |
|
|
|------|------|
|
|
| `cinny/src/client/secretStorageKeys.ts` | SSSS key handling |
|
|
| `cinny/src/app/features/settings/devices/Devices.tsx` | Device list |
|
|
| `cinny/src/app/features/settings/devices/Verification.tsx` | Verification UI |
|
|
| `cinny/src/app/features/settings/devices/LocalBackup.tsx` | Key export |
|
|
| `cinny/src/app/features/settings/devices/OtherDevices.tsx` | Remote sessions |
|
|
| `cinny/src/app/components/DeviceVerification.tsx` | Incoming verify modal |
|
|
| `cinny/src/app/components/BackupRestore.tsx` | Auto restore |
|
|
| `cinny/src/app/components/SecretStorage.tsx` | Passphrase setup |
|
|
| `cinny/src/app/hooks/useSecretStorage.ts` | Secret storage API |
|
|
| `cinny/src/app/hooks/useKeyBackup.ts` | Backup API |
|
|
| `cinny/src/app/pages/client/sidebar/UnverifiedTab.tsx` | Unverified badge |
|
|
|
|
## Data model
|
|
|
|
| Store | Purpose |
|
|
|-------|---------|
|
|
| IndexedDB crypto | Olm account, Megolm sessions |
|
|
| SSSS | Cross-signing keys, backup key |
|
|
| Matrix account data | `m.cross_signing.*`, `m.secret_storage.*` |
|
|
|
|
## Dependencies
|
|
|
|
- matrix-js-sdk crypto module
|
|
- Secure random / Web Crypto
|
|
|
|
## Integration points
|
|
|
|
- **matrix-client**: crypto store init in initMatrix
|
|
- **authentication**: first login bootstrap
|
|
- **user-settings**: devices tab
|
|
|
|
## Testing
|
|
|
|
### Manual
|
|
|
|
1. Login second device; verify via emoji/SAS from first.
|
|
2. Export keys backup; file downloads.
|
|
3. Encrypted room: send message; decrypt on other device.
|
|
4. Logout remote session from devices list.
|
|
|
|
### Automated
|
|
|
|
- None
|
|
|
|
## Known issues & gotchas
|
|
|
|
- `handlingKeyConflict` in initMatrix on duplicate device keys
|
|
- Logout clears crypto store — must re-verify
|
|
- Backup passphrase loss = message history loss
|
|
|
|
## Future work
|
|
|
|
- Dehydrated devices support
|
|
- Better recovery key UX
|
|
|
|
## Related docs
|
|
|
|
- [matrix-client HANDOFF](../matrix-client/HANDOFF.md)
|
|
- [user-settings HANDOFF](../user-settings/HANDOFF.md)
|
|
|
|
## Add your extra things here
|
|
|
|
- Local backup filename: `paarrot-keys.txt` in LocalBackup.tsx
|
|
- `ReceiveSelfDeviceVerification` route component in Router.tsx
|