UWPX-Client
UWPX-Client copied to clipboard
OMEMO Identity Key Signing does not match the Spec
Description
XEP-0384: OMEMO Encryption requires a EdDSA-compatible signature when signing Identity Keys. UWPX currently performs EdDSA with Curve25519 (Montgomery) based keys and not like mandated here by XEdDSA with Ed25519 (Twisted Edwards) keys.
Expected Behavior
We should use Ed25519 (Twisted Edwards) keys here.
Actual Behavior
https://github.com/UWPX/UWPX-Client/blob/21789901f43e77fc51c3789865f5186cad02d6fe/Omemo/Classes/KeyHelper.cs#L89-L100
Possible Fix
Convert the Curve25519 (Montgomery) based keys to Ed25519 (Twisted Edwards) before signing. This is defined in by the XEdDSA spec inside the calculate_key_pair call.
Steps to Reproduce
- Add an account
- Connect the account
- UWPX will publish an OMEMO bundle with an "invalid" signature.
- Other clients (!= UWPX):💥
Context
We can no send OMEMO encrypted messages to other XMPP clients like Kaidan, that follow the spec.