Skip to content

MSC1703: encrypting recovery keys for online megolm backups #1703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dbkr wants to merge 10 commits into from
Closed

MSC1703: encrypting recovery keys for online megolm backups #1703

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
7960290
Initial MSC for encrypting recovery keys for online megolm backups
ara4n Sep 26, 2018
8c3e04b
use the right MSC number
ara4n Sep 26, 2018
c53aaee
Fleshed out proposal for passphrased backups.
dbkr Oct 23, 2018
8ab9ece
missed a <sup>-1</sup>
dbkr Oct 31, 2018
f66f0f5
Clarify that a new K is generated
dbkr Oct 31, 2018
3f282af
Add definitions of the various K dirctly in option 3
dbkr Oct 31, 2018
80abfe2
word wrap
dbkr Oct 31, 2018
89e2556
Try & clarify mitigation against dict attacks
dbkr Oct 31, 2018
c26bd4f
Add note saying which we picked.
dbkr Jan 21, 2019
2ffb58c
Fix spec to match what got implemented
dbkr Jan 21, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add definitions of the various K dirctly in option 3 
rather than referring to option 2
  • Loading branch information
@dbkr
dbkr committed Oct 31, 2018
commit 3f282affe307cb1c9e65b660b59e22ff5803235f
2 changes: 1 addition & 1 deletion proposals/1687-encrypted-recovery-keys.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ This option, however, allows the server to obtain K<sup>-1</sup> by obtaining an

### Option 3

The backup encryption private key and a private key, K<sup>-1</sup><sub>p</sub> and K<sup>-1</sup><sub>p</sub>' are generated as above. Another private key, K<sup>-1</sup><sub>r</sub> is generated also by a secure random number generator and encoded to give the recovery key as above. K<sup>-1</sup><sub>r</sub>' is generated by XORing K<sup>-1</sup><sub>r</sub> with K<sup>-1</sup>. Both K<sup>-1</sup><sub>p</sub>' and K<sup>-1</sup><sub>r</sub>' are stored in the `private_key` in the backup under keys `passphrase_counterpart` and `recovery_key_counterpart` respectively.
The backup encryption private key, K<sup>-1</sup>, and a private, passphrase-derived key, K<sup>-1</sup><sub>p</sub> are generated as above.The passphrase key counterpart, K<sup>-1</sup><sub>p</sub>', is also generated as above from the K<sup>-1</sup> XOR K<sup>-1</sup><sub>p</sub>. Another private key, K<sup>-1</sup><sub>r</sub> is generated also by a secure random number generator and encoded to give the recovery key as above. K<sup>-1</sup><sub>r</sub>' is generated by XORing K<sup>-1</sup><sub>r</sub> with K<sup>-1</sup>. Both K<sup>-1</sup><sub>p</sub>' and K<sup>-1</sup><sub>r</sub>' are stored in the `private_key` in the backup under keys `passphrase_counterpart` and `recovery_key_counterpart` respectively.

To change the passphrase, the client starts a new backup version as in option 1 (generating a new K<sup>-1</sup>), but additionally computes a new K<sup>-1</sup><sub>r</sub>' by XORing K<sup>-1</sup><sub>r</sub> with the new K<sup>-1</sup>. This refreshes all keys, but allows the user to keep the same recovery key for their backup, on the assumption that the recovery key itself has not been compromised. If it has, the client generates a new backup with a completely fresh recovery key instead.

Expand Down