changeset 30150e936a8c in /home/hg/repos/gajim-plugins

author: lovetox forenjunkie@chello.at branches: details:gajim-plugins?cmd=changeset;node=30150e936a8c description: Dont generate new SignedPreKey for every publish

A SignedPreKey should only be generated once at install time A SignedPreKey rotation can be implemented at a later point. To generate a new SignedPreKey for every publish is overkill and there is missing a deletion mechansim for old, not used, SignedPreKeys, which is a potential security risk.

diffstat:

omemo/omemo/liteaxolotlstore.py | 6 ++++++ omemo/omemo/litesignedprekeystore.py | 9 +++++++++ omemo/omemo/state.py | 6 ++---- 3 files changed, 17 insertions(+), 4 deletions(-)

diffs (55 lines):

diff -r f0fc5cb50a8c -r 30150e936a8c omemo/omemo/liteaxolotlstore.py --- a/omemo/omemo/liteaxolotlstore.py Sat Jul 23 02:26:58 2016 +0200 +++ b/omemo/omemo/liteaxolotlstore.py Sat Jul 23 14:10:36 2016 +0200 @@ -41,6 +41,7 @@ except(AttributeError): raise AssertionError('Expected a sqlite3.Connection got ' + str(connection)) + self.identityKeyStore = LiteIdentityKeyStore(connection) self.preKeyStore = LitePreKeyStore(connection) self.signedPreKeyStore = LiteSignedPreKeyStore(connection) @@ -58,6 +59,11 @@ DEFAULT_PREKEY_AMOUNT) self.storeLocalData(registrationId, identityKeyPair)

+ signedPreKey = KeyHelper.generateSignedPreKey( + identityKeyPair, KeyHelper.getRandomSequence(65536)) + + self.store.storeSignedPreKey(signedPreKey.getId(), signedPreKey) + for preKey in preKeys: self.storePreKey(preKey.getId(), preKey)

diff -r f0fc5cb50a8c -r 30150e936a8c omemo/omemo/litesignedprekeystore.py --- a/omemo/omemo/litesignedprekeystore.py Sat Jul 23 02:26:58 2016 +0200 +++ b/omemo/omemo/litesignedprekeystore.py Sat Jul 23 14:10:36 2016 +0200 @@ -75,3 +75,12 @@ cursor = self.dbConn.cursor() cursor.execute(q, (signedPreKeyId, )) self.dbConn.commit() + + def loadCurrentSignedPreKey(self): + q = "SELECT prekey_id FROM signed_prekeys " \ + "WHERE _id = (SELECT MAX(_id) FROM signed_prekeys)" + + cursor = self.dbConn.cursor() + cursor.execute(q) + result = cursor.fetchone() + return result[0] diff -r f0fc5cb50a8c -r 30150e936a8c omemo/omemo/state.py --- a/omemo/omemo/state.py Sat Jul 23 02:26:58 2016 +0200 +++ b/omemo/omemo/state.py Sat Jul 23 14:10:36 2016 +0200 @@ -155,10 +155,8 @@

identityKeyPair = self.store.getIdentityKeyPair()

- signedPreKey = KeyHelper.generateSignedPreKey( - identityKeyPair, KeyHelper.getRandomSequence(65536)) - - self.store.storeSignedPreKey(signedPreKey.getId(), signedPreKey) + signedPreKey = self.store.loadSignedPreKey( + self.store.signedPreKeyStore.loadCurrentSignedPreKey())

result = { 'signedPreKeyId': signedPreKey.getId(),