Imp: Famedly: Refactor signature chain verification code to be more explicit

[famedly-bot]

In GitLab by @mrmcoding88 on Nov 24, 2022, 13:44

Description

Currently the hasValidSignatureChain function in the SDK does way more than we need. It automatically looks for any possible chain of signatures, recursing potentially infinitely. Usually we do known what chains we are looking for ahead of time though. Usually we need one of these chains:

our device key -> our master -> our device signing key -> our device key

our device key -> our master -> our user-signing -> their master -> their device signing -> their device key

Additionally we want devices directly verified.

For TOFU:

their master -> their device signing -> their device key

Refactoring the code to explicitly check those chains can make the code more resistent to attacks as well as easier to understand for the developers, which helps making the app more maintainable and secure in the long term.

Service,Platform & Version

FamedlySDK

More information

[famedly-bot]

In GitLab by @Mar-Ga on Feb 2, 2023, 12:32

moved from undefined##undefined