Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resending a message that was rejected with 401/403 should re-encrypt the message #1106

Closed
liliakai opened this issue Mar 25, 2017 · 0 comments

Comments

@liliakai
Copy link
Contributor

Currently, a 401 or 403 response when sending a message is treated similarly to network disruption. The resend link is presented, but and the ciphertext is saved for re-transmission. If the client was re-linked in the meantime, then that ciphertext is encrypted with stale/deleted session data.

https://gist.github.com/anonymous/67b8bebf25b4651675c3b4cc8e4ebcfc#file-debuglog-txt-L168

reading from the top of the log:
alice installs a fresh desktop and links it
alice and bob message each other establishing sessions between all devices involved.
alice unlinks (or reinstalls and re-registers)
alice desktop attempts to send a message while unlinked, gets a 401 and offers an option to resend

after reinstall/relink, alice-desktop clears the session store. this is evidenced by the fact that it attempts to get new keys for alice's ios device in order to request contact sync (which returns the first 413 error).

then alice clicks resend on the 401'd message, which re-transmits the stale encrypted non-prekey message. if bob and alice ios devices exchanged messages between unlink and relink, bob has probably already trashed the old session upon accepting alice's new identity.

then alice tries to message bob normally again (not a resend but a new message) and does attempt to fetch new keys, again getting a 413 in this case. Several minutes later she tries again and succeeds. life proceeds as normal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

3 participants