feature request: Implement fallback keys to improve E2EE reliability #1228

New issue

Open

opened 2025-12-18 20:11:20 +00:00 by nex · 0 comments

nex commented

2025-12-18 20:11:20 +00:00

Owner

Fallback keys were added in spec v1.2, and they allow devices to continue receiving new encrypted messages even when their one time keys are exhausted, with the added risk of replay attacks. Synapse currently supports this, and I believe Tuwunel added support for them recently.

We should implement support for uploading and replacing fallback keys, as well as serving them to consumers where needed. This will likely greatly improve the reliability of encryption when people don't spend every waking moment on matrix.

Right now continuwuity only supports one-time keys, however, if a device is offline for a long time, its one time key pool may become exhausted, and further attempts to send messages to that device will result in unable-to-decrypt errors, which may end up being unrecoverable under some circumstances. [Fallback keys](https://spec.matrix.org/v1.17/client-server-api/#one-time-and-fallback-keys) were added in spec v1.2, and they allow devices to continue receiving new encrypted messages even when their one time keys are exhausted, with the added risk of replay attacks. Synapse currently supports this, and I believe Tuwunel added support for them recently. We should implement support for uploading and replacing fallback keys, as well as serving them to consumers where needed. This will likely greatly improve the reliability of encryption when people don't spend every waking moment on matrix.