If app fails to store the E2E encryption keys the public key should be deleted from the server

[ardevd]

Currently, the public key is posted to the E2E server side app and stored there for the user before the Android app tries to store the associated keys locally. If this fails, the user is prompted to create a new key the next time they try to go through the encryption process. This will then always fail because the server will return a 409 error as a public key already exists. I think the correct behavior would be to send a DELETE request to the E2E API to remove the uploaded public key.

Furthermore, the private key needs to be removed as well.

[AndyScherzinger]

Calling Mr e2e @tobiasKaminsky :)

[ardevd]

I gave it some thought during the night and how about we store the keys locally first before pushing them to the server. If the server returns 200 OK then all is good, if not then we can simply delete the keys locally instead of sending another request to the server.

Or perhaps we should do both.

[tobiasKaminsky]

@ardevd I created a PR with some context, how I resolved it: #2158
Do you think this is enough?

[ardevd]

Looks fine, shouldnt you also attempt to delete the private key?

[tobiasKaminsky]

The private key is stored after the public key.
If the private key fails, we delete public key.
If the private key storage suceeds, we store both locally.

Why (and where) would you try to delete the private key?

[ardevd]

That's fine I think as long as server side returns the proper error if the private key somehow already exists.