E2E encryption #8
Description
Enable e2e encryption
Guide here: https://matrix.org/docs/matrix-concepts/end-to-end-encryption/
Use the matrix-js-sdk to allow the user to enable e2e encryption for their device.
A user should have an option to enable e2e encryption in specific rooms.
A user should be able to click a button "generate encryption key". This should open a modal where a user will be presented their encryption keys, be told to save them somewhere safe, then "continue" where then will then be asked to re-enter their encryption key.
Be sure to reference the guide from matrix-js-sdk (the following is copy and paste from their readme).
End-to-end encryption support
matrix-js-sdk's end-to-end encryption support is based on the WebAssembly bindings of the Rust matrix-sdk-crypto library.
Initialization
To initialize the end-to-end encryption support in the matrix client:
// Create a new matrix client
const matrixClient = sdk.createClient({
baseUrl: "http://localhost:8008",
accessToken: myAccessToken,
userId: myUserId,
});
// Initialize to enable end-to-end encryption support.
await matrixClient.initRustCrypto();
Note that by default it will attempt to use the Indexed DB provided by the browser as a crypto store. If running outside the browser, you will need to pass an options object which includes useIndexedDB: false, to use an ephemeral in-memory store instead. Note that without a persistent store, you'll need to create a new device on the server side (with MatrixClient.loginRequest) each time your application starts.
After calling initRustCrypto, you can obtain a reference to the CryptoApi interface, which is the main entry point for end-to-end encryption, by calling MatrixClient.getCrypto.
WARNING: the cryptography stack is not thread-safe. Having multiple MatrixClient instances connected to the same Indexed DB will cause data corruption and decryption failures. The application layer is responsible for ensuring that only one MatrixClient issue is instantiated at a time.
Secret storage
You should normally set up secret storage before using the end-to-end encryption. To do this, call CryptoApi.bootstrapSecretStorage. bootstrapSecretStorage can be called unconditionally: it will only set up the secret storage if it is not already set up (unless you use the setupNewSecretStorage parameter).
const matrixClient = sdk.createClient({
...,
cryptoCallbacks: {
getSecretStorageKey: async (keys) => {
// This function should prompt the user to enter their secret storage key.
return mySecretStorageKeys;
},
},
});
matrixClient.getCrypto().bootstrapSecretStorage({
// This function will be called if a new secret storage key (aka recovery key) is needed.
// You should prompt the user to save the key somewhere, because they will need it to unlock secret storage in future.
createSecretStorageKey: async () => {
return mySecretStorageKey;
},
});
The example above will create a new secret storage key if secret storage was not previously set up. The secret storage data will be encrypted using the secret storage key returned in createSecretStorageKey.
We recommend that you prompt the user to re-enter this key when CryptoCallbacks.getSecretStorageKey is called (when the secret storage access is needed).
Set up cross-signing
To set up cross-signing to verify devices and other users, call CryptoApi.bootstrapCrossSigning:
matrixClient.getCrypto().bootstrapCrossSigning({
authUploadDeviceSigningKeys: async (makeRequest) => {
return makeRequest(authDict);
},
});
The authUploadDeviceSigningKeys callback is required in order to upload newly-generated public cross-signing keys to the server.
Key backup
If the user doesn't already have a key backup you should create one:
// Check if we have a key backup.
// If checkKeyBackupAndEnable returns null, there is no key backup.
const hasKeyBackup = (await matrixClient.getCrypto().checkKeyBackupAndEnable()) !== null;
// Create the key backup
await matrixClient.getCrypto().resetKeyBackup();
Verify a new device
Once the cross-signing is set up on one of your devices, you can verify another device with two methods:
Use CryptoApi.bootstrapCrossSigning.
bootstrapCrossSigning will call the [CryptoCallbacks.getSecretStorageKey](https://matrix-org.github.io/matrix-js-sdk/interfaces/crypto_api.CryptoCallbacks.html#getSecretStorageKey) callback. The device is verified with the private cross-signing keys fetched from the secret storage.
Request an interactive verification against existing devices, by calling [CryptoApi.requestOwnUserVerification](https://matrix-org.github.io/matrix-js-sdk/interfaces/crypto_api.CryptoApi.html#requestOwnUserVerification).