Shows "This contact does not support OMEMO encryption" while it does, with converse.js

[martin21]

Hi!

Thank you very much for Dino!

I have a new contact who currently uses converse.js webchat. When I also use converse.js webchat we can click on the lock symbols to enable encryption. All messages are then shown with a lock. dino-im can monitor the conversation between us and also shows all messages as a lock.

Yet: When I try to enable OMEMO in dino-im 0.1.0-5 in Debian Sid dino.im shows "This contact does not support OMEMO encryption" in small red text below the text input field. Yet, when open the contact details it shows "OMEMO, one device". But it only shows a key as unused inactive key. When I click on it I am asked to verify the finger print. But there it already says "This key is accepted". However when I choose to verify the fingerprint I get asked whether it is right or wrong… when I say it is right, I just get a window with a shield symbol and under it the headline "Verify key" with no option to do anything with it.

Expected results:

I am asked whether I accept the finger print and if I say yes OMEMO encryption works when I enable it.

Or in case I have "accept new keys automatically" switched on, OMEMO encryption works when I enable it.

Even better: dino-im offers me to enable OMEMO encryption if the remote client supports it.

[AltNico]

I also experience this issue, but for us it isn't related to converse.js. My contact uses Gajim and Conversations (in the past he might also used other clients), and while he's sending me all messages encrypted, Dino doesn't allow me to encrypt with OMEMO. Like above, it says "This contact does not support OMEMO encryption" while also showing an unused OMEMO key in the contact's info section.

Is there any debug output I can provide?

[AltNico]

Here's a screenshot showing the problem:

Tracking down this issue in Dino's code, I think it's this line where the if condition needs to be fixed:

if (!(yield omemo_manager.ensure_get_keys_for_jid(conversation.account, conversation.counterpart.bare_jid))) {
        input_status_callback(new Plugins.InputFieldStatus("This contact does not support %s encryption".printf("OMEMO"), Plugins.InputFieldStatus.MessageType.ERROR, Plugins.InputFieldStatus.InputState.NO_SEND));
}

The implementation of omemo_manager.ensure_get_keys_for_jid seems to be here:

    public async bool ensure_get_keys_for_jid(Account account, Jid jid) {
        if (trust_manager.is_known_address(account, jid)) return true;
        XmppStream? stream = stream_interactor.get_stream(account);
        if (stream != null) {
            var device_list = yield stream_interactor.module_manager.get_module(account, StreamModule.IDENTITY).request_user_devicelist(stream, jid);
            return device_list.size > 0;
        }
        return true; // TODO wait for stream?
    }

I didn't quite understand the code, but I think the problem is that at this point device_list.size <= 0, resulting in returning false.

[AltNico]

OK, it turned out that the error wasn't related to Dino, but instead the server of my contact was configured wrong. His server indeed returned a device_list.size of 0 which he could fix trough configuration. Sorry for putting noise into this issue.

[fiaxh]

@martin21

when open the contact details it shows "OMEMO, one device". But it only shows a key as unused inactive key.

Inactive keys are keys that have been on your contact's device list once, but are not advertised by your contact anymore. It is indeed a UI issue that we display "one device" instead of "no devices" there, we should change that.

When I click on it I am asked to verify the finger print.

Verifying an unused key won't help towards encryption, since those keys are not supposed to be used for initiating encrypted sessions anymore.

Your issue is that Dino doesn't see any keys on your contact's device list or that the device list is missing altogether.
There is a good chance that Dino is actually right and your contact indeed does not properly announce their OMEMO support. This doesn't have to be an issue with your contact's client, it can also be an issue with their server.
That you can exchange encrypted messages when using converse.js, doesn't imply that your contacts device list is fine. If you used converse.js already before their device list broke, OMEMO can continue to work between those two clients.

[martin21]

Uhm, that appears to be complex. I mostly got it working these days. Sometimes it helps when the chat buddy or I disable and re-enable OMEMO encryption.