E2E: public keys are not refreshed when new key is generated

[zner0L]

Description

I am trying to verify a device by another user who I already shared some unencrypted rooms with. The key fingerprints, however, don't match and the new verification fails with "key mismatch". The fingerprint seems to match an old public key, the same device (same device ID) used before, as we were able to reconstruct from old messages. Other devices which have seen the user only recently get the correct matching key and are able to verify.
I tried to refresh the public keys, by

• closing and reopening Riot
• closing and reopening the room we share
• closing and reopening the contact page
• blocking and unblocking the device

none of which worked.

Steps to reproduce

It is not particularly clear to us, how the second key got generated, but we suspect:

• create to users that share an unencrypted room using Riot on Firefox
• one user changes their key by:
  • either importing a new one
  • or logging into riot in a private tab, potentially triggering a key generation
• the users try to verify and check the key fingerprints

What happens: There is only one device and the key fingerprints mismatch.
What should happen: There is only one device and the fingerprints match, or there are two devices, one of which matches the fingerprint.

Log: not sent (I don't really know of what process the logs could be interesting)

Version information

For the sending device:

• Browser: Firefox
• URL: vector.cccgoe.de,
  Version of matrix-react-sdk:
  Version of riot-web: 1.1.2-14-gaf697df8-dirty
  Version of olm: 3.1.0

For the receiving device:

• Platform: App
• OS: macOS 10.13.6
• Version: 1.1.2

also tested on the iOS client

[uhoreg]

Yes, it's purposeful that Riot doesn't update the keys, because the keys aren't supposed to change. So the bug is that Riot has changed keys, which is probably due to #9107.

Though it probably is a bug that Riot doesn't alert you when it detects a changed key.

[bwindels]

@zner0L Could you please confirm that Data exists in local storage and crypto is marked as initialised appeared in your logs when this happened, or either submit logs? This way we can confirm @uhoreg 's theory above ^.

[poljar]

This seems to be yet another cleared storage bug, we notify nowadays if this happens: #9109.