MSC2211: Identity Servers Storing Threepid Hashes at Rest by anoadragon453 · Pull Request #2211 · matrix-org/matrix-spec-proposals

anoadragon453 · 2019-08-01T15:11:01Z

ara4n · 2019-08-01T15:12:54Z

this looks very very promising :) thanks for splitting it out from #2134

uhoreg · 2019-08-01T16:28:04Z

+
+* [GET /_matrix/identity/api/v1/3pid/getValidated3pid](https://matrix.org/docs/spec/identity_service/unstable#get-matrix-identity-api-v1-3pid-getvalidated3pid)
+
+This endpoint needs to be changed to return a hash instead of `medium` and


Do we need to specify how this is hashed? Do callers of this endpoint depend on it in order to retrieve the 3pid info?

uhoreg · 2019-08-01T16:30:04Z

+
+* [POST /_matrix/identity/api/v1/3pid/unbind](https://matrix.org/docs/spec/identity_service/unstable#post-matrix-identity-api-v1-3pid-unbind)
+
+This endpoint needs to be changed to have `threepid` be a hash instead.


This certainly needs the hash method to be specified, so that the client knows how to hash the threepid to send the correct information. Though I'm not sure that it does need to be changed, since the client can send the information in the clear, and the server can just apply the hash.

uhoreg · 2019-08-01T16:31:22Z

+* [POST /_matrix/identity/api/v1/store-invite](https://matrix.org/docs/spec/identity_service/unstable#post-matrix-identity-api-v1-store-invite) 
+
+This endpoint needs to be changed to remove parameters `medium`, and
+`address`, and instead just have a new field containing a hash value.


I don't think that we can replace medium and address with a hash here, because this endpoint is supposed to send an email to the invited address, and if the address is hashed, then the server doesn't have access to the address.

turt2live

the approach largely seems in the right direction. I have mostly stylistic concerns (diffs should be legible), but would like some of the limitations raised earlier in the proposal text.

turt2live · 2019-08-01T17:51:02Z

+plaintext addresses. Due to protocol endpoints requiring plaintext addresses,
+major implementations have always stored 3PID data as plaintext at rest. An
+example is the [GET
+/_matrix/identity/api/v1/3pid/getValidated3pid](https://matrix.org/docs/spec/identity_service/unstable#get-matrix-identity-api-v1-3pid-getvalidated3pid)


stick this endpoint in a code tag to prevent italics for the rest of the doc please. This is a theme throughout the proposal.

turt2live · 2019-08-01T17:52:26Z

+information.
+
+Storing 3PIDs as hashes at rest can be accomplished with a few protocol
+changes. As recently done with [GET


A link to the MSC would be great here.

turt2live · 2019-08-01T17:55:08Z

+what was done for `/_matrix/identity/v2/lookup` in
+[MSC2134](https://github.com/matrix-org/matrix-doc/pull/2134).
+
+Thus, the new endpoints should be:


while we're here, can we fix the casing to match up with our style doc?

request_token

store_invite

/3pid/validated

turt2live · 2019-08-01T17:57:52Z

+## Potential issues
+
+Another sticking point to consider is identity servers that hook into
+third-party data sources, such as LDAP, may have trouble answering requests


I feel like supporting LDAP is a hard requirement for us to be able to achieve this. I'm not sure how much of this API LDAP-enabled identity servers actually use though - I can imagine they'd just abuse /lookup.

turt2live · 2019-08-01T17:59:00Z

+## Conclusion
+
+With a few endpoint changes, we can enable identity servers to store user
+contact information in a hashed format, thereby reducing the impact of a


There should be a mention somewhere early in this proposal that we want to encourage identity servers to store hashed identifiers, but cannot enforce it. We can't define how implementations store data, but we sure can make it obvious how we want them to work.

erikjohnston · 2019-08-02T09:09:41Z

+These endpoints just take token/session information, so no changes are
+needed. All other endpoints would not need to be changed.
+
+## Tradeoffs


As mentioned in the other PR, how do we rotate hashes?

That should be an implementation detail, no? I can mention it in the doc as such.

I don't see how an IS can rotate hashes if it doesn't have the original 3PID, so I think this would require some funky stuff to happen to make it possible (or to just drop all existing values).

Ah right. This isn't spelled out anywhere but I think the idea was that the server would have a lifetime salt (probably just generated on first-run), and then rotated peppers for lookups.

So clients would have to hash with a salt then with a pepper.

I think the only benefit there would be in the case of MITM, or for storing invites where the sent hash is stored temporarily.

I'm more thinking of the case where we store hashes as SHA-1 then discover that its vulnerable and we need to use SHA-256 instead. What do we do?

Proposal for Identity Servers Storing Threepid Hashes at Rest

943a9ae

anoadragon453 added proposal-in-review proposal A matrix spec change proposal labels Aug 1, 2019

anoadragon453 requested a review from a team August 1, 2019 15:11

Fix title

f7f7fca

fixes

f0256a9

anoadragon453 mentioned this pull request Aug 1, 2019

MSC2134: Identity Hash Lookups #2134

Merged

uhoreg requested changes Aug 1, 2019

View reviewed changes

turt2live self-requested a review August 1, 2019 16:39

turt2live requested changes Aug 1, 2019

View reviewed changes

erikjohnston reviewed Aug 2, 2019

View reviewed changes

turt2live added the kind:maintenance MSC which clarifies/updates existing spec label Apr 20, 2020

turt2live added the needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. label Jun 8, 2021

turt2live force-pushed the old_master branch from e895827 to dca99ee Compare August 30, 2021 22:34

turt2live removed the proposal-in-review label May 5, 2022


		* [GET /_matrix/identity/api/v1/3pid/getValidated3pid](https://matrix.org/docs/spec/identity_service/unstable#get-matrix-identity-api-v1-3pid-getvalidated3pid)

		This endpoint needs to be changed to return a hash instead of `medium` and


		* [POST /_matrix/identity/api/v1/3pid/unbind](https://matrix.org/docs/spec/identity_service/unstable#post-matrix-identity-api-v1-3pid-unbind)

		This endpoint needs to be changed to have `threepid` be a hash instead.

Conversation

anoadragon453 commented Aug 1, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ara4n commented Aug 1, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

turt2live left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

anoadragon453 commented Aug 1, 2019 •

edited

Loading