[usermaneGermane]

Security fix for the SecretSpace 3 test versions alpha.6 and alpha.7 (the stable 2.x releases are not affected). Needs SecretSpace Server 2.0.0-alpha.5.

The problem

The server stores each member's wrapped copy of a vault key, and the app took whatever copy the server listed. A dishonest server, or someone who broke into it, could wrap a key of its own to a member's public key, call it a new key generation, and read the vault the app uploaded under it at the next sync. A test reproduced this and read a stored password.

The fix

• Every wrapped key is signed by the account that wrapped it (Ed25519 over: vault, key generation, member, the wrapped key, signer). account_sync.key_message, sign_key, check_key.
• A vault the device does not have yet: the key must be signed by its own account, or by another account, whose keys are then remembered on first sight. Such a vault shows as shared by someone "not checked".
• A new key for a vault it already has: the key must be signed by its own account, by whoever signed the key it holds now, or by a contact whose fingerprint the user compared. A name the server could have introduced on its own is not enough.
• Never taken: a key of an older generation, another key at the same generation, or a key with no signature. Each of these raises KeyNotTrusted; nothing is changed and nothing of that vault is uploaded.
• Vaults from alpha.6 / alpha.7 are signed at the next sync by a device that already holds them.
• Older servers: with a server that has no signed-keys, only the Personal vault syncs.

Two smaller fixes from the same review

• Remove and Change key name the members whose fingerprint was never checked on this PC: the new key goes to whatever key the server gives for them.
• An unencrypted http:// address of another machine asks before it is used (connect, sign in, recovery). On such a connection someone on the network could take over the account on the server, though not read a vault.

Tests

• New test_account_key_trust.py: 24 tests. The server's files are edited directly, as a dishonest server would: unsigned key, wrong signature under the owner's name, signature by an unknown account, a two-step attack through a bait vault, an older generation put back, another key at the same generation, an invented vault. Plus what must keep working: key change by the sharing owner, by a second owner after a fingerprint check, a second device, and vaults from before signatures.
• 19 deliberately broken guards, all caught.
• Full suite green locally. Lab flows through the real windows pass: accounts, sync, vaults, sharing, recovery.

tests/sync_server/passman_server.py is server 2.0.0-alpha.5 (Server PRs #14), byte for byte.

🤖 Generated with Claude Code

https://claude.ai/code/session_011ojnyVg7ccsR3pZ64s7aRH