MSC4263: Preventing MXID enumeration via key queries#4263
MSC4263: Preventing MXID enumeration via key queries#4263Johennes wants to merge 1 commit intomatrix-org:mainfrom
Conversation
3175c4e to
df66664
Compare
There was a problem hiding this comment.
Implementation requirements:
- Server
There was a problem hiding this comment.
| When processing [`/_matrix/client/v3/keys/query`] requests, homeservers MUST at | ||
| a minimum consider users who share a room with the requesting user or are a | ||
| member of a public room. This is regardless of the concrete membership value of | ||
| the queried users in those room. |
There was a problem hiding this comment.
The problem you will run into with this, is that currently you can encrypt for a user you have only invited. In theory an invite can also enumerate mxids, since if the invite succeeds, the user likely exists. But that can be restricted using policies on a server currently. However not being able to query keys for a user, that is already invited to a room will prevent them from being able to decrypt those messages.
Additionally some clients currently use key queries to enable encryption for a room. This might not be possible anymore with this change, leading to those rooms not supporting encryption anymore. Clients could change that to always enable encryption without checking if encryption is possible, but that likely will need a transition period?
There was a problem hiding this comment.
The problem you will run into with this, is that currently you can encrypt for a user you have only invited. In theory an invite can also enumerate mxids, since if the invite succeeds, the user likely exists. But that can be restricted using policies on a server currently. However not being able to query keys for a user, that is already invited to a room will prevent them from being able to decrypt those messages.
I think this should be covered by the "regardless of the concrete membership value of the queried users" clause. Though maybe this should be further restricted to just join and ìnvite`?
Additionally some clients currently use key queries to enable encryption for a room. This might not be possible anymore with this change, leading to those rooms not supporting encryption anymore. Clients could change that to always enable encryption without checking if encryption is possible, but that likely will need a transition period?
Oh, I haven't heard of this before. 😮
This is before room creation when you already have a list of members to be invited and the client is checking upfront if you can encrypt to these users based on their published keys?
…#18180) This implements matrix-org/matrix-spec-proposals#4263. ### Pull Request Checklist <!-- Please read https://element-hq.github.io/synapse/latest/development/contributing_guide.html before submitting your pull request --> * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters)) --------- Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>
Builds on NetBSD 10 amd64, and builds/tests-ok on NetBSD 9 amd64 using dependencies from 2025Q2. NB: A security update to synapse is scheduled for July 22. Consult https://matrix.org/blog/2025/07/security-predisclosure/ for further details. Those running synapse in production may wish to update to 1.134.0 to reduce the magnitude of change when updating to the July 22 version (although that will be a big update regardless). Note that the usual pkgsrc pre-commit test is upgrading from the current pkgsrc version and briefly checking operation. Therefore, not upgrading has a theoretical risk of encountering a 1.127.1 to 1.135.0 update bug when 1.127.1 to 134.0 and 1.134.0 to 1.135.0 are ok. # Synapse 1.134.0 (2025-07-15) - Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via` query param for hierarchy endpoint. Contributed by Krishan (@kfiven). ([\#18070](element-hq/synapse#18070)) - Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\#18196](element-hq/synapse#18196)) - Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\#18241](element-hq/synapse#18241)) # Synapse 1.133.0 (2025-07-01) - Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\#18120](element-hq/synapse#18120)) # Synapse 1.132.0 (2025-06-17) - Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\#18288](element-hq/synapse#18288)) - Add experimental `user_may_send_state_event` module API callback. ([\#18455](element-hq/synapse#18455)) - Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size. ([\#18457](element-hq/synapse#18457)) - Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\#18458](element-hq/synapse#18458)) - Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\#18486](element-hq/synapse#18486)) - Support configuration of default and extra user types. ([\#18456](element-hq/synapse#18456)) - Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\#18521](element-hq/synapse#18521)) - Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`. ([\#18513](element-hq/synapse#18513)) # Synapse 1.131.0 (2025-06-03) - Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263). ([\#18180](element-hq/synapse#18180)) - Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\#18262](element-hq/synapse#18262)) - Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms). ([\#18318](element-hq/synapse#18318)) - Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam. ([\#18387](element-hq/synapse#18387)) # Synapse 1.130.0 (2025-05-20) - Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` to fetch scheduled tasks. ([\#18214](element-hq/synapse#18214)) - Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\#18300](element-hq/synapse#18300)) - Add support for handling `GET /devices/` on workers. ([\#18355](element-hq/synapse#18355)) # Synapse 1.129.0 (2025-05-06) - Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\#18232](element-hq/synapse#18232)) - Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\#18260](element-hq/synapse#18260)) # Synapse 1.128.0 (2025-04-08) - Add an access token introspection cache to make Matrix Authentication Service integration ([MSC3861](matrix-org/matrix-spec-proposals#3861)) more efficient. ([\#18231](element-hq/synapse#18231)) - Add background job to clear unreferenced state groups. ([\#18254](element-hq/synapse#18254)) - Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. ([\#18277](element-hq/synapse#18277), [\#18302](element-hq/synapse#18302), [\#18296](element-hq/synapse#18296))
chat/matrix-synapse: Update package in anticipation of security fix
Revisions pulled up:
- chat/matrix-synapse/Makefile 1.112
- chat/matrix-synapse/PLIST 1.59
- chat/matrix-synapse/cargo-depends.mk 1.27
- chat/matrix-synapse/distinfo 1.80
---
Module Name: pkgsrc
Committed By: gdt
Date: Thu Jul 17 11:24:44 UTC 2025
Modified Files:
pkgsrc/chat/matrix-synapse: Makefile PLIST cargo-depends.mk distinfo
Log Message:
chat/matrix-synapse: Update to 1.134.0
Builds on NetBSD 10 amd64, and builds/tests-ok on NetBSD 9 amd64 using
dependencies from 2025Q2.
NB: A security update to synapse is scheduled for July 22. Consult
https://matrix.org/blog/2025/07/security-predisclosure/
for further details.
Those running synapse in production may wish to update to 1.134.0 to
reduce the magnitude of change when updating to the July 22 version
(although that will be a big update regardless). Note that the usual
pkgsrc pre-commit test is upgrading from the current pkgsrc version
and briefly checking operation. Therefore, not upgrading has a
theoretical risk of encountering a 1.127.1 to 1.135.0 update bug when
1.127.1 to 134.0 and 1.134.0 to 1.135.0 are ok.
# Synapse 1.134.0 (2025-07-15)
- Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via` query param for hierarchy endpoint. Contributed by Krishan (@kfiven).
([\#18070](element-hq/synapse#18070))
- Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\#18196](element-hq/synapse#18196))
- Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\#18241](element-hq/synapse#18241))
# Synapse 1.133.0 (2025-07-01)
- Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\#18120](element-hq/synapse#18120))
# Synapse 1.132.0 (2025-06-17)
- Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\#18288](element-hq/synapse#18288))
- Add experimental `user_may_send_state_event` module API callback. ([\#18455](element-hq/synapse#18455))
- Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size.
([\#18457](element-hq/synapse#18457))
- Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\#18458](element-hq/synapse#18458))
- Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\#18486](element-hq/synapse#18486))
- Support configuration of default and extra user types. ([\#18456](element-hq/synapse#18456))
- Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\#18521](element-hq/synapse#18521))
- Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`.
([\#18513](element-hq/synapse#18513))
# Synapse 1.131.0 (2025-06-03)
- Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263).
([\#18180](element-hq/synapse#18180))
- Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\#18262](element-hq/synapse#18262))
- Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms).
([\#18318](element-hq/synapse#18318))
- Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam.
([\#18387](element-hq/synapse#18387))
# Synapse 1.130.0 (2025-05-20)
- Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` to fetch scheduled tasks. ([\#18214](element-hq/synapse#18214))
- Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\#18300](element-hq/synapse#18300))
- Add support for handling `GET /devices/` on workers. ([\#18355](element-hq/synapse#18355))
# Synapse 1.129.0 (2025-05-06)
- Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\#18232](element-hq/synapse#18232))
- Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\#18260](element-hq/synapse#18260))
# Synapse 1.128.0 (2025-04-08)
- Add an access token introspection cache to make Matrix Authentication Service integration ([MSC3861](matrix-org/matrix-spec-proposals#3861)) more efficient.
([\#18231](element-hq/synapse#18231))
- Add background job to clear unreferenced state groups. ([\#18254](element-hq/synapse#18254))
- Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. ([\#18277](element-hq/synapse#18277),
[\#18302](element-hq/synapse#18302), [\#18296](element-hq/synapse#18296))
chat/matrix-synapse: Update package in anticipation of security fix
Revisions pulled up:
- chat/matrix-synapse/Makefile 1.112
- chat/matrix-synapse/PLIST 1.59
- chat/matrix-synapse/cargo-depends.mk 1.27
- chat/matrix-synapse/distinfo 1.80
---
Module Name: pkgsrc
Committed By: gdt
Date: Thu Jul 17 11:24:44 UTC 2025
Modified Files:
pkgsrc/chat/matrix-synapse: Makefile PLIST cargo-depends.mk distinfo
Log Message:
chat/matrix-synapse: Update to 1.134.0
Builds on NetBSD 10 amd64, and builds/tests-ok on NetBSD 9 amd64 using
dependencies from 2025Q2.
NB: A security update to synapse is scheduled for July 22. Consult
https://matrix.org/blog/2025/07/security-predisclosure/
for further details.
Those running synapse in production may wish to update to 1.134.0 to
reduce the magnitude of change when updating to the July 22 version
(although that will be a big update regardless). Note that the usual
pkgsrc pre-commit test is upgrading from the current pkgsrc version
and briefly checking operation. Therefore, not upgrading has a
theoretical risk of encountering a 1.127.1 to 1.135.0 update bug when
1.127.1 to 134.0 and 1.134.0 to 1.135.0 are ok.
# Synapse 1.134.0 (2025-07-15)
- Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via` query param for hierarchy endpoint. Contributed by Krishan (@kfiven).
([\#18070](element-hq/synapse#18070))
- Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\#18196](element-hq/synapse#18196))
- Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\#18241](element-hq/synapse#18241))
# Synapse 1.133.0 (2025-07-01)
- Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\#18120](element-hq/synapse#18120))
# Synapse 1.132.0 (2025-06-17)
- Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\#18288](element-hq/synapse#18288))
- Add experimental `user_may_send_state_event` module API callback. ([\#18455](element-hq/synapse#18455))
- Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size.
([\#18457](element-hq/synapse#18457))
- Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\#18458](element-hq/synapse#18458))
- Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\#18486](element-hq/synapse#18486))
- Support configuration of default and extra user types. ([\#18456](element-hq/synapse#18456))
- Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\#18521](element-hq/synapse#18521))
- Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`.
([\#18513](element-hq/synapse#18513))
# Synapse 1.131.0 (2025-06-03)
- Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263).
([\#18180](element-hq/synapse#18180))
- Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\#18262](element-hq/synapse#18262))
- Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms).
([\#18318](element-hq/synapse#18318))
- Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam.
([\#18387](element-hq/synapse#18387))
# Synapse 1.130.0 (2025-05-20)
- Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` to fetch scheduled tasks. ([\#18214](element-hq/synapse#18214))
- Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\#18300](element-hq/synapse#18300))
- Add support for handling `GET /devices/` on workers. ([\#18355](element-hq/synapse#18355))
# Synapse 1.129.0 (2025-05-06)
- Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\#18232](element-hq/synapse#18232))
- Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\#18260](element-hq/synapse#18260))
# Synapse 1.128.0 (2025-04-08)
- Add an access token introspection cache to make Matrix Authentication Service integration ([MSC3861](matrix-org/matrix-spec-proposals#3861)) more efficient.
([\#18231](element-hq/synapse#18231))
- Add background job to clear unreferenced state groups. ([\#18254](element-hq/synapse#18254))
- Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. ([\#18277](element-hq/synapse#18277),
[\#18302](element-hq/synapse#18302), [\#18296](element-hq/synapse#18296))
chat/matrix-synapse: Update package in anticipation of security fix
Revisions pulled up:
- chat/matrix-synapse/Makefile 1.112
- chat/matrix-synapse/PLIST 1.59
- chat/matrix-synapse/cargo-depends.mk 1.27
- chat/matrix-synapse/distinfo 1.80
---
Module Name: pkgsrc
Committed By: gdt
Date: Thu Jul 17 11:24:44 UTC 2025
Modified Files:
pkgsrc/chat/matrix-synapse: Makefile PLIST cargo-depends.mk distinfo
Log Message:
chat/matrix-synapse: Update to 1.134.0
Builds on NetBSD 10 amd64, and builds/tests-ok on NetBSD 9 amd64 using
dependencies from 2025Q2.
NB: A security update to synapse is scheduled for July 22. Consult
https://matrix.org/blog/2025/07/security-predisclosure/
for further details.
Those running synapse in production may wish to update to 1.134.0 to
reduce the magnitude of change when updating to the July 22 version
(although that will be a big update regardless). Note that the usual
pkgsrc pre-commit test is upgrading from the current pkgsrc version
and briefly checking operation. Therefore, not upgrading has a
theoretical risk of encountering a 1.127.1 to 1.135.0 update bug when
1.127.1 to 134.0 and 1.134.0 to 1.135.0 are ok.
# Synapse 1.134.0 (2025-07-15)
- Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via` query param for hierarchy endpoint. Contributed by Krishan (@kfiven).
([\#18070](element-hq/synapse#18070))
- Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\#18196](element-hq/synapse#18196))
- Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\#18241](element-hq/synapse#18241))
# Synapse 1.133.0 (2025-07-01)
- Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\#18120](element-hq/synapse#18120))
# Synapse 1.132.0 (2025-06-17)
- Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\#18288](element-hq/synapse#18288))
- Add experimental `user_may_send_state_event` module API callback. ([\#18455](element-hq/synapse#18455))
- Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size.
([\#18457](element-hq/synapse#18457))
- Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\#18458](element-hq/synapse#18458))
- Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\#18486](element-hq/synapse#18486))
- Support configuration of default and extra user types. ([\#18456](element-hq/synapse#18456))
- Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\#18521](element-hq/synapse#18521))
- Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`.
([\#18513](element-hq/synapse#18513))
# Synapse 1.131.0 (2025-06-03)
- Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263).
([\#18180](element-hq/synapse#18180))
- Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\#18262](element-hq/synapse#18262))
- Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms).
([\#18318](element-hq/synapse#18318))
- Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam.
([\#18387](element-hq/synapse#18387))
# Synapse 1.130.0 (2025-05-20)
- Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` to fetch scheduled tasks. ([\#18214](element-hq/synapse#18214))
- Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\#18300](element-hq/synapse#18300))
- Add support for handling `GET /devices/` on workers. ([\#18355](element-hq/synapse#18355))
# Synapse 1.129.0 (2025-05-06)
- Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\#18232](element-hq/synapse#18232))
- Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\#18260](element-hq/synapse#18260))
# Synapse 1.128.0 (2025-04-08)
- Add an access token introspection cache to make Matrix Authentication Service integration ([MSC3861](matrix-org/matrix-spec-proposals#3861)) more efficient.
([\#18231](element-hq/synapse#18231))
- Add background job to clear unreferenced state groups. ([\#18254](element-hq/synapse#18254))
- Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. ([\#18277](element-hq/synapse#18277),
[\#18302](element-hq/synapse#18302), [\#18296](element-hq/synapse#18296))
Rendered
In line with matrix-org/matrix-spec#1700, the following disclosure applies:
I am a Systems Architect at gematik, Software Engineer at Unomed, Matrix community member and former Element employee. This proposal was written and published with my gematik hat on.