Verifying a remote user didn't happen in DM

[ara4n]

• @matthewtest401:matrix.org verified @matthew:arasphere.net
• The verif succeeded
• The DM didn't contain an audit trail.
• matthewtest401 then saw arasphere as green shield
• arasphere saw matthewtest401 as black shield :-/

[bwindels]

I imagine it was falling back to legacy user verification because it could not find the cross-signing keys for the user it was going to verify. Federation bug? Ftr, we don't cross-sign when doing legacy verification because we haven't verified the MSK for the other user, only their device key, which we can't sign.

There is a bug that legacy trust doesn't get counted when aggregating the trust of all devices for a user, which apparently was deemed not a problem. When expanding the session section in user info @ara4n, was the device you verified marked green at least?

[bwindels]

The logs from @matthew:arasphere.net indeed show this right before starting the verification request:

2020-04-16T12:33:49.346Z I got cross-signing keys for @matthewtest401:matrix.org: {}

[bwindels]

When quering keys now (from matrix.org) for @matthewtest401:matrix.org I get a master key of dn699wr2FITbozlGId4YH8vsb+BlhYC/AuJzo34/aCs.

[ara4n]

When expanding the session section in user info @ara4n, was the device you verified marked green at least?

Yes:

[bwindels]

This feels related to #12973 and matrix-org/synapse#7276 then.

[ara4n]

see also #13248

[Thatoo]

I experiment that problem too as I was explaining in here : #13566

My shield is green on his devices but his shield keep being black on my devices (both Riot-desktop and RiotX). I have all his devices verified though (legacy way)... but I can still start a cross-signing verification with him from Riot-desktop (he can't) that won't lead to a better situation. It will say that it succeeded but his shield will remain black.

[bwindels]

@Thatoo can you please file a separate issue and submit your debug logs from "help & about" in the settings?

[Thatoo]

I have done it in here : #13824
Thank you for your help.

[ShadowJonathan]

Can't reproduce, this probably needs a very specific homeserver setup.

This also feels like a cascade of client and server bugs, specifically synapse ones.

[kittykat]

I'm going to close this issue for now as there is no futher information that we could request for debugging at this point due to the age of the issue, we haven't had any more recent reports and the code has changed since it was filed. Please re-open if you are still experiencing it.