Should we kill device IDs, replacing them with hashes of your e2e device identity key?

matrix-org / matrix-spec

The Matrix protocol specification

Apache License 2.0

197 stars 97 forks source link

Should we kill device IDs, replacing them with hashes of your e2e device identity key? #622

Open ara4n opened 4 years ago

ara4n commented 4 years ago

Rather than having yet another ID to worry about and keep in sync with E2E etc, perhaps we should just make your device ID the same as your E2E public identity key now that we have E2E by default. (thanks to @Gargron & @jcgruenhage for the idea)

bwindels commented 4 years ago

Could raise the bar of entry for non-e2ee clients if they need to be able to create a keypair and upload the pubkey, to then never use it.

This is in fact how we detect whether a given session supports E2EE today.

uhoreg commented 4 years ago

One issue with this is that now your device is tied to a certain key using a certain algorithm. If we need to switch wholesale to a different algo (e.g. something post-quantum), then do you change device IDs?