element-hq/element-web

Element-R: Use the "pickleKey" to encrypt the indexeddb crypto store

richvdh opened this issue · 0 comments

Currently we hardcode "test pass" as the encryption passphrase for the IndexedDB data (see https://github.com/matrix-org/matrix-js-sdk/blob/develop/src/rust-crypto/index.ts#L39-L40).

The react-sdk generates an AES key random string and passes it into the js-sdk as pickleKey. We should use that instead.

(The advantage of this is that the random string is itself encrypted with an AES key, which is generated with extractable set to false, which makes it more difficult to steal someone's entire crypto store via an XSS vulnerability or similar.)