Skip to content

MSC4312: Resetting cross-signing keys in the OAuth world#4312

Merged
turt2live merged 13 commits intomatrix-org:mainfrom
gematik:johannes/x-signing-reset-with-nextgen-auth
Oct 15, 2025
Merged

MSC4312: Resetting cross-signing keys in the OAuth world#4312
turt2live merged 13 commits intomatrix-org:mainfrom
gematik:johannes/x-signing-reset-with-nextgen-auth

Conversation

@Johennes
Copy link
Copy Markdown
Contributor

@Johennes Johennes commented Jul 15, 2025 •
edited by hughns
Loading

@Johennes Johennes changed the title MSCXXXX: Resetting cross-signing keys in the OAuth world MSC4312: Resetting cross-signing keys in the OAuth world Jul 15, 2025
@Johennes
MSC4312: Resetting cross-signing keys in the OAuth world
e78bc09 
Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>
@Johennes Johennes force-pushed the johannes/x-signing-reset-with-nextgen-auth branch from cc0517c to e78bc09 Compare July 15, 2025 08:20
@Johennes Johennes marked this pull request as ready for review July 15, 2025 08:21
@Johennes Johennes mentioned this pull request Jul 15, 2025
Closed
@turt2live turt2live added proposal A matrix spec change proposal client-server Client-Server API kind:maintenance MSC which clarifies/updates existing spec needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. labels Jul 15, 2025
turt2live
turt2live reviewed Jul 15, 2025
View reviewed changes
@richvdh richvdh mentioned this pull request Aug 27, 2025
Open
@hughns
Copy link
Copy Markdown
Member

hughns commented Sep 17, 2025

MAS lists the org.matrix.cross_signing_reset action in the account_management_actions_supported from MSC4191. e.g. in https://account.matrix.org/.well-known/openid-configuration

Does this need to be added to this MSC?

@Johennes
Add org.matrix.cross_signing_reset navigation action
a781be5 
Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>
@Johennes
Copy link
Copy Markdown
Contributor Author

Johennes commented Sep 18, 2025

MAS lists the org.matrix.cross_signing_reset action in the account_management_actions_supported from MSC4191. e.g. in https://account.matrix.org/.well-known/openid-configuration

Does this need to be added to this MSC?

Good point. I hadn't noticed that MSC4191 doesn't list this action. Have added it here with a781be5.

hughns
hughns reviewed Sep 24, 2025
View reviewed changes
proposals/4312-x-signing-reset-with-nextgen-auth.md

Rather than approving cross-signing reset specifically, the authorization server could provide
mechanisms for temporary scope elevation.

Copy link
Copy Markdown
Member

@hughns hughns Sep 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Following a discussion with @erikjohnston earlier it might be helpful to elaborate on this:

Suggested change
An example of a potential mechanism that could help achieve this is the
[RFC 9470 OAuth 2.0 Step Up Authentication Challenge Protocol](https://datatracker.ietf.org/doc/rfc9470/).
Theoretically such a mechanism could act as full replacement for UIA in the CS API
where protection is needed for sensitive actions.
However, the is no proposal on how this would be applied to the CS API and therefore
it is proposed to codify this present mechanism that does allow for the specific
cross-signing reset action.

Copy link
Copy Markdown
Member

@clokep clokep Sep 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This feels like the correct solution?

Copy link
Copy Markdown
Contributor Author

@Johennes Johennes Sep 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, it probably is. This proposal was originally only intended to document the status quo that I found on matrix.org so that it could be reused by other implementations in the interim. It doesn't feel great to add this into the spec. If the good solution is far away though, it might be better than the current situation where the spec renders the OAuth login APIs and cross-signing key reset incompatible.

I applied @hughns suggestion separately with d8649fb but will leave this thread open in case there's further input.

Copy link
Copy Markdown
Contributor Author

@Johennes Johennes Sep 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may not change the plan for this proposal but I have tried to adapt RFC9470 to Matrix in #4363.

Copy link
Copy Markdown
Member

@richvdh richvdh Sep 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that this is already deployed on matrix.org ( 😢 ), and Element-Web implements support for it (cf element-hq/element-meta#2956), I think we had better spec what we have asap and leave the Correct Solution for another time.

turt2live
turt2live approved these changes Sep 24, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@turt2live turt2live left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

otherwise lgtm

@turt2live
Copy link
Copy Markdown
Member

turt2live commented Sep 24, 2025 •
edited
Loading

MSCs proposed for Final Comment Period (FCP) should meet the requirements outlined in the checklist prior to being accepted into the spec. This checklist is a bit long, but aims to reduce the number of follow-on MSCs after a feature lands.

SCT members: please check off things you check for, and raise a concern against FCP if the checklist is incomplete. If an item doesn't apply, prefer to check it rather than remove it. Unchecking items is encouraged where applicable.

MSC authors: feel free to ask in a thread on your MSC or in the#matrix-spec:matrix.org room for clarification of any of these points.

  • Are appropriate implementation(s) specified in the MSC’s PR description?
  • Are all MSCs that this MSC depends on already accepted?
  • For each new endpoint that is introduced:
    • Have authentication requirements been specified?
    • Have rate-limiting requirements been specified?
    • Have guest access requirements been specified?
    • Are error responses specified?
      • Does each error case have a specified errcode (e.g. M_FORBIDDEN) and HTTP status code?
        • If a new errcode is introduced, is it clear that it is new?
  • Will the MSC require a new room version, and if so, has that been made clear?
    • Is the reason for a new room version clearly stated? For example, modifying the set of redacted fields changes how event IDs are calculated, thus requiring a new room version.
  • Are backwards-compatibility concerns appropriately addressed?
  • Are the endpoint conventions honoured?
    • Do HTTP endpoints use_underscores_like_this?
    • Will the endpoint return unbounded data? If so, has pagination been considered?
    • If the endpoint utilises pagination, is it consistent with the appendices?
  • An introduction exists and clearly outlines the problem being solved. Ideally, the first paragraph should be understandable by a non-technical audience.
  • All outstanding threads are resolved
    • All feedback is incorporated into the proposal text itself, either as a fix or noted as an alternative
  • While the exact sections do not need to be present, the details implied by the proposal template are covered. Namely:
    • Introduction
    • Proposal text
    • Potential issues
    • Alternatives
    • Dependencies
  • Stable identifiers are used throughout the proposal, except for the unstable prefix section
    • Unstable prefixes consider the awkward accepted-but-not-merged state
    • Chosen unstable prefixes do not pollute any global namespace (use “org.matrix.mscXXXX”, not “org.matrix”).
  • Changes have applicable Sign Off from all authors/editors/contributors
  • There is a dedicated "Security Considerations" section which detail any possible attacks/vulnerabilities this proposal may introduce, even if this is "None.". See RFC3552 for things to think about, but in particular pay attention to the OWASP Top Ten.

@turt2live turt2live added kind:core MSC which is critical to the protocol's success matrix-2.0 Required for Matrix 2.0 and removed kind:maintenance MSC which clarifies/updates existing spec labels Sep 24, 2025
@github-project-automation github-project-automation bot moved this to Tracking for review in Spec Core Team Workflow Sep 24, 2025
@turt2live
Copy link
Copy Markdown
Member

turt2live commented Sep 24, 2025

@mscbot fcp merge
@mscbot concern Requires evidence that fallback UIA support kinda mostly works well enough
@mscbot concern Include Step Up alternative in proposal

@mscbot
Copy link
Copy Markdown
Collaborator

mscbot commented Sep 24, 2025 •
edited by ara4n
Loading

Team member @mscbot has proposed to merge this. The next step is review by the rest of the tagged people:

Concerns:

  • Requires evidence that fallback UIA support kinda mostly works well enough
  • Include Step Up alternative in proposal
  • Is not documenting the current in-the-wild implementation

Once at least 75% of reviewers approve (and there are no outstanding concerns), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for information about what commands tagged team members can give me.

@mscbot mscbot added proposed-final-comment-period Currently awaiting signoff of a majority of team members in order to enter the final comment period. disposition-merge unresolved-concerns This proposal has at least one outstanding concern labels Sep 24, 2025
@turt2live turt2live moved this from Tracking for review to Ready for FCP ticks in Spec Core Team Workflow Sep 24, 2025
@turt2live turt2live added the 00-weekly-pings Tracking for weekly pings in the SCT office. 00 to make it first in the labels list. label Sep 24, 2025
@mscbot mscbot added final-comment-period This MSC has entered a final comment period in interest to approval, postpone, or delete in 5 days. and removed proposed-final-comment-period Currently awaiting signoff of a majority of team members in order to enter the final comment period. labels Oct 10, 2025
@turt2live turt2live moved this from Ready for FCP ticks to In FCP in Spec Core Team Workflow Oct 14, 2025
@turt2live turt2live removed the 00-weekly-pings Tracking for weekly pings in the SCT office. 00 to make it first in the labels list. label Oct 14, 2025
@mscbot
Copy link
Copy Markdown
Collaborator

mscbot commented Oct 15, 2025

The final comment period, with a disposition to merge, as per the review above, is now complete.

@mscbot mscbot added finished-final-comment-period and removed disposition-merge final-comment-period This MSC has entered a final comment period in interest to approval, postpone, or delete in 5 days. labels Oct 15, 2025
@turt2live turt2live merged commit ea0aef0 into matrix-org:main Oct 15, 2025
1 check passed
@turt2live turt2live added spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec and removed finished-final-comment-period labels Oct 15, 2025
@turt2live turt2live moved this from In FCP to Requires spec writing in Spec Core Team Workflow Oct 15, 2025
@Johennes Johennes mentioned this pull request Oct 17, 2025
Merged
3 tasks
@Johennes
Copy link
Copy Markdown
Contributor Author

Johennes commented Oct 17, 2025

Spec PR: matrix-org/matrix-spec#2234

@Johennes Johennes mentioned this pull request Oct 17, 2025
Merged
7 tasks
@turt2live turt2live added spec-pr-in-review A proposal which has been PR'd against the spec and is in review and removed spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec labels Oct 17, 2025
@turt2live turt2live moved this from Requires spec writing to Requires spec PR review in Spec Core Team Workflow Oct 17, 2025
@turt2live
Copy link
Copy Markdown
Member

turt2live commented Nov 24, 2025

Merged 🎉

@turt2live turt2live added merged A proposal whose PR has merged into the spec! and removed spec-pr-in-review A proposal which has been PR'd against the spec and is in review labels Nov 24, 2025
@turt2live turt2live moved this from Requires spec PR review to Merged in Spec Core Team Workflow Nov 24, 2025
This was referenced Nov 24, 2025
Closed
Merged
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Jan 27, 2026
@alexlebens
chore(deps): update dependency element-hq/synapse to v1.146.0 (#3533)
1612f48 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [element-hq/synapse](https://github.com/element-hq/synapse) | minor | `1.145.0` → `1.146.0` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>element-hq/synapse (element-hq/synapse)</summary>

### [`v1.146.0`](https://github.com/element-hq/synapse/releases/tag/v1.146.0)

[Compare Source](element-hq/synapse@v1.145.0...v1.146.0rc1)

### Synapse 1.146.0 (2026-01-27)

No significant changes since 1.146.0rc1.

#### Deprecations and Removals

- [MSC2697](matrix-org/matrix-spec-proposals#2697) (Dehydrated devices) has been removed, as the MSC is closed. Developers should migrate to [MSC3814](matrix-org/matrix-spec-proposals#3814). ([#&#8203;19346](element-hq/synapse#19346))
- Support for Ubuntu 25.04 (Plucky Puffin) has been dropped. Synapse no longer builds debian packages for Ubuntu 25.04.

### Synapse 1.146.0rc1 (2026-01-20)

#### Features

- Add a new config option [`enable_local_media_storage`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_local_media_storage) which controls whether media is additionally stored locally when using configured `media_storage_providers`. Setting this to `false` allows off-site media storage without a local cache. Contributed by Patrice Brend'amour [@&#8203;dr](https://github.com/dr).allgood. ([#&#8203;19204](element-hq/synapse#19204))
- Stabilise support for [MSC4312](matrix-org/matrix-spec-proposals#4312 `m.oauth` User-Interactive Auth stage for resetting cross-signing identity with the OAuth 2.0 API. The old, unstable name (`org.matrix.cross_signing_reset`) is now deprecated and will be removed in a future release. ([#&#8203;19273](element-hq/synapse#19273))
- Refactor Grafana dashboard to use `server_name` label (instead of `instance`). ([#&#8203;19337](element-hq/synapse#19337))

#### Bugfixes

- Fix joining a restricted v12 room locally when no local room creator is present but local users with sufficient power levels are. Contributed by [@&#8203;nexy7574](https://github.com/nexy7574). ([#&#8203;19321](element-hq/synapse#19321))
- Fixed parallel calls to `/_matrix/media/v1/create` being ratelimited for appservices even if `rate_limited: false` was set in the registration. Contributed by [@&#8203;tulir](https://github.com/tulir) @&#8203; Beeper. ([#&#8203;19335](element-hq/synapse#19335))
- Fix a bug introduced in 1.61.0 where a user's membership in a room was accidentally ignored when considering access to historical state events in rooms with the "shared" history visibility. Contributed by Lukas Tautz. ([#&#8203;19353](element-hq/synapse#19353))
- [MSC4140](matrix-org/matrix-spec-proposals#4140): Store the JSON content of scheduled delayed events as text instead of a byte array. This fixes the inability to schedule a delayed event with non-ASCII characters in its content. ([#&#8203;19360](element-hq/synapse#19360))
- Always rollback database transactions when retrying (avoid orphaned connections). ([#&#8203;19372](element-hq/synapse#19372))
- Fix `InFlightGauge` typing to allow upgrading to `prometheus_client` 0.24. ([#&#8203;19379](element-hq/synapse#19379))

#### Updates to the Docker image

- Add [Prometheus HTTP service discovery](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config) endpoint for easy discovery of all workers when using the `docker/Dockerfile-workers` image (see the [*Metrics* section of our Docker testing docs](docker/README-testing.md#metrics)). ([#&#8203;19336](element-hq/synapse#19336))

#### Improved Documentation

- Remove docs on legacy metric names (no longer in the codebase since 2022-12-06). ([#&#8203;19341](element-hq/synapse#19341))
- Clarify how the estimated value of room complexity is calculated internally. ([#&#8203;19384](element-hq/synapse#19384))

#### Internal Changes

- Add an internal `cancel_task` API to the task scheduler. ([#&#8203;19310](element-hq/synapse#19310))
- Tweak docstrings and signatures of `auth_types_for_event` and `get_catchup_room_event_ids`. ([#&#8203;19320](element-hq/synapse#19320))
- Replace usage of deprecated `assertEquals` with `assertEqual` in unit test code. ([#&#8203;19345](element-hq/synapse#19345))
- Drop support for Ubuntu 25.04 'Plucky Puffin', add support for Ubuntu 25.10 'Questing Quokka'. ([#&#8203;19348](element-hq/synapse#19348))
- Revert "Add an Admin API endpoint for listing quarantined media ([#&#8203;19268](element-hq/synapse#19268))". ([#&#8203;19351](element-hq/synapse#19351))
- Bump `mdbook` from 0.4.17 to 0.5.2 and remove our custom table-of-contents plugin in favour of the new default functionality. ([#&#8203;19356](element-hq/synapse#19356))
- Replace deprecated usage of PyGitHub's `GitRelease.title` with `.name` in release script. ([#&#8203;19358](element-hq/synapse#19358))
- Update the Element logo in Synapse's README to be an absolute URL, allowing it to render on other sites (such as PyPI). ([#&#8203;19368](element-hq/synapse#19368))
- Apply minor tweaks to v1.145.0 changelog. ([#&#8203;19376](element-hq/synapse#19376))
- Update Grafana dashboard syntax to use the latest from importing/exporting with Grafana 12.3.1. ([#&#8203;19381](element-hq/synapse#19381))
- Warn about skipping reactor metrics when using unknown reactor type. ([#&#8203;19383](element-hq/synapse#19383))
- Add support for reactor metrics with the `ProxiedReactor` used in worker Complement tests. ([#&#8203;19385](element-hq/synapse#19385))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42OS4yIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/3533
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This was referenced Jan 29, 2026
Open
Open
This was referenced Feb 5, 2026
Closed
Merged
github-merge-queue bot pushed a commit to famedly/synapse that referenced this pull request Feb 11, 2026
@itsoyou
Famedly release/v1.146 (#236)
050ff7e 
# Famedly Synapse Release v1.146.0_1
depends on: famedly/complement#10

## Famedly additions for v1.146.0_1
- feat: trigger CI actions (that are triggered on PRs) in merge queue
(FrenchGithubUser)

### Notes for Famedly:
#### Deprecations and Removals
- matrix-org/matrix-spec-proposals#2697
(Dehydrated devices) has been removed, as the MSC is closed. Developers
should migrate to
matrix-org/matrix-spec-proposals#3814.
(element-hq/synapse#19346)
- Support for Ubuntu 25.04 (Plucky Puffin) has been dropped. Synapse no
longer builds debian packages for Ubuntu 25.04.
#### Updates to the Docker image
- Add [Prometheus HTTP service
discovery](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config)
endpoint for easy discovery of all workers when using the
docker/Dockerfile-workers image (see the [Metrics section of our Docker
testing
docs](https://github.com/famedly/synapse/pull/docker/README-testing.md#metrics)).
(element-hq/synapse#19336)
#### Features
- Add a new config option
[enable_local_media_storage](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_local_media_storage)
which controls whether media is additionally stored locally when using
configured media_storage_providers. Setting this to false allows
off-site media storage without a local cache. Contributed by Patrice
Brend'amour @dr.allgood.
(element-hq/synapse#19204)
- Stabilise support for
matrix-org/matrix-spec-proposals#4312 m.oauth
User-Interactive Auth stage for resetting cross-signing identity with
the OAuth 2.0 API. The old, unstable name
(org.matrix.cross_signing_reset) is now deprecated and will be removed
in a future release.
(element-hq/synapse#19273)
- Refactor Grafana dashboard to use server_name label (instead of
instance). (element-hq/synapse#19337)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@clokep clokep clokep left review comments

@dbkr dbkr dbkr left review comments

@turt2live turt2live turt2live approved these changes

@richvdh richvdh richvdh approved these changes

@hughns hughns hughns left review comments

Assignees

No one assigned

Labels

client-server Client-Server API kind:core MSC which is critical to the protocol's success matrix-2.0 Required for Matrix 2.0 merged A proposal whose PR has merged into the spec! proposal A matrix spec change proposal

Projects

Spec Core Team Workflow
Status: Merged/Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@Johennes @hughns @turt2live @mscbot @dbkr @clokep @richvdh