From 9857ed53e3edf42d9f2ef70d44fc2ac2f7162de7 Mon Sep 17 00:00:00 2001 From: "Timo K." Date: Mon, 17 Aug 2026 11:16:11 +0200 Subject: [PATCH] Add key roatation limit to config.json --- config/config.sample.json | 3 +- package.json | 2 +- pnpm-lock.yaml | 44 +++++++++++++------ src/config/ConfigOptions.ts | 13 ++++++ .../CallViewModel/localMember/LocalMember.ts | 2 + 5 files changed, 48 insertions(+), 16 deletions(-) diff --git a/config/config.sample.json b/config/config.sample.json index 78f9536da..3ff689278 100644 --- a/config/config.sample.json +++ b/config/config.sample.json @@ -18,6 +18,7 @@ "membership_event_expiry_ms": 180000000, "delayed_leave_event_delay_ms": 18000, "delayed_leave_event_restart_ms": 4000, - "network_error_retry_ms": 100 + "network_error_retry_ms": 100, + "key_rotation_participant_limit": 30 } } diff --git a/package.json b/package.json index 2f4faa601..3bec6cd52 100644 --- a/package.json +++ b/package.json @@ -96,7 +96,7 @@ "livekit-client": "^2.18.1", "lodash-es": "^4.17.21", "loglevel": "^1.9.1", - "matrix-js-sdk": "github:matrix-org/matrix-js-sdk#develop", + "matrix-js-sdk": "github:matrix-org/matrix-js-sdk#toger5/add-key-rotation-participant-size", "matrix-widget-api": "^1.18.0", "node-stdlib-browser": "^1.3.1", "normalize.css": "^8.0.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0519571fa..21a907ec4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -191,8 +191,8 @@ importers: specifier: ^1.9.1 version: 1.9.2 matrix-js-sdk: - specifier: github:matrix-org/matrix-js-sdk#develop - version: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/178dc6528ebc6a15e2f6fab38410127f16b500d0 + specifier: github:matrix-org/matrix-js-sdk#toger5/add-key-rotation-participant-size + version: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/f4a278c571bcb4e8e553ef031488ecdabe4e0ede matrix-widget-api: specifier: ^1.18.0 version: 1.18.0 @@ -1191,8 +1191,8 @@ packages: '@types/dom-mediacapture-transform': ^0.1.9 livekit-client: ^1.12.0 || ^2.1.0 - '@matrix-org/matrix-sdk-crypto-wasm@18.4.0': - resolution: {integrity: sha512-osxkU1DQ+05+anGHapjWyvZqdHUb94Id37gy54mCKn1Cq/D7iGT5oEUEhjp4oTnCLo4TOtI6ULJ/LHsapaIptQ==} + '@matrix-org/matrix-sdk-crypto-wasm@18.5.0': + resolution: {integrity: sha512-E826Hy1rG26LanPjtSsOiVRcVoHfSgPgj2r2Xsb5RPScpaKi9XJADQ0u3dNjRCitZPX4oyLNl1FDd5AfDlmIwQ==} engines: {node: '>= 18'} '@mdx-js/react@3.1.1': @@ -3664,8 +3664,8 @@ packages: constants-browserify@1.0.0: resolution: {integrity: sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ==} - content-type@2.0.0: - resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==} + content-type@2.1.0: + resolution: {integrity: sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==} engines: {node: '>=18'} convert-source-map@2.0.0: @@ -4516,6 +4516,10 @@ packages: jsonfile@6.2.0: resolution: {integrity: sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==} + jwt-decode@4.0.0: + resolution: {integrity: sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==} + engines: {node: '>=18'} + keyv@4.5.4: resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==} @@ -4679,9 +4683,9 @@ packages: matrix-events-sdk@0.0.1: resolution: {integrity: sha512-1QEOsXO+bhyCroIe2/A5OwaxHvBm7EsSQ46DEDn8RBIfQwN5HWBpFvyWWR4QY0KHPPnnJdI99wgRiAl7Ad5qaA==} - matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/178dc6528ebc6a15e2f6fab38410127f16b500d0: - resolution: {gitHosted: true, integrity: sha512-UmlkoXs9VMZvNaDeQqBb2k+gLifnIqEZc5cxrLeEwdYEDakQLbRqrFtmvIp4ipUCjdIPkCgtzb7QLlpPBLAwqA==, tarball: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/178dc6528ebc6a15e2f6fab38410127f16b500d0} - version: 42.1.0 + matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/f4a278c571bcb4e8e553ef031488ecdabe4e0ede: + resolution: {gitHosted: true, integrity: sha512-6iaM5Uyr063LCbDcjhDXI1qf5X8q270dMl0iLNb6S/mcOucqdKURw0ySWM6PWHAnbMw2rdkiTx3Mp37+J9F/pg==, tarball: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/f4a278c571bcb4e8e553ef031488ecdabe4e0ede} + version: 41.8.0 engines: {node: '>=22.0.0'} matrix-widget-api@1.18.0: @@ -4823,6 +4827,10 @@ packages: resolution: {integrity: sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==} engines: {node: '>=12.20.0'} + oidc-client-ts@3.5.0: + resolution: {integrity: sha512-l2q8l9CTCTOlbX+AnK4p3M+4CEpKpyQhle6blQkdFhm0IsBqsxm15bYaSa11G7pWdsYr6epdsRZxJpCyCRbT8A==} + engines: {node: '>=18'} + once@1.4.0: resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==} @@ -7096,7 +7104,7 @@ snapshots: '@types/dom-mediacapture-transform': 0.1.11 livekit-client: 2.21.0(@types/dom-mediacapture-record@1.0.22) - '@matrix-org/matrix-sdk-crypto-wasm@18.4.0': {} + '@matrix-org/matrix-sdk-crypto-wasm@18.5.0': {} '@mdx-js/react@3.1.1(@types/react@19.2.17)(react@19.2.8)': dependencies: @@ -9189,7 +9197,7 @@ snapshots: constants-browserify@1.0.0: {} - content-type@2.0.0: {} + content-type@2.1.0: {} convert-source-map@2.0.0: {} @@ -10116,6 +10124,8 @@ snapshots: optionalDependencies: graceful-fs: 4.2.11 + jwt-decode@4.0.0: {} + keyv@4.5.4: dependencies: json-buffer: 3.0.1 @@ -10269,16 +10279,18 @@ snapshots: matrix-events-sdk@0.0.1: {} - matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/178dc6528ebc6a15e2f6fab38410127f16b500d0: + matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/f4a278c571bcb4e8e553ef031488ecdabe4e0ede: dependencies: '@babel/runtime': 8.0.0 - '@matrix-org/matrix-sdk-crypto-wasm': 18.4.0 + '@matrix-org/matrix-sdk-crypto-wasm': 18.5.0 another-json: 0.2.0 bs58: 6.0.0 - content-type: 2.0.0 + content-type: 2.1.0 + jwt-decode: 4.0.0 loglevel: 1.9.2 matrix-events-sdk: 0.0.1 matrix-widget-api: 1.18.0 + oidc-client-ts: 3.5.0 p-retry: 8.0.0 sdp-transform: 3.0.0 unhomoglyph: 1.0.6 @@ -10428,6 +10440,10 @@ snapshots: obug@2.1.4: {} + oidc-client-ts@3.5.0: + dependencies: + jwt-decode: 4.0.0 + once@1.4.0: dependencies: wrappy: 1.0.2 diff --git a/src/config/ConfigOptions.ts b/src/config/ConfigOptions.ts index 75704cfc8..f01477d80 100644 --- a/src/config/ConfigOptions.ts +++ b/src/config/ConfigOptions.ts @@ -229,6 +229,18 @@ export interface ConfigOptions { * This is what goes into the m.rtc.member event expiry field and is typically set to a number of hours. */ membership_event_expiry_ms?: number; + + /** + * The number of participants in the session at which the media encryption key will no longer + * be rotated. + * + * Rotating a key requires sending it to every participant device, so in large sessions the + * cost of rotating on every join/leave becomes prohibitive. At this limit the current key is + * kept and distributed to new joiners; no new keys are generated for joiners/leavers. + * + * Defaults to the js-sdk default (30). + */ + key_rotation_participant_limit?: number; }; } @@ -262,6 +274,7 @@ export interface ResolvedConfigOptions extends ConfigOptions { delayed_leave_event_restart_ms?: number; network_error_retry_ms: number; membership_event_expiry_ms?: number; + key_rotation_participant_limit?: number; }; } diff --git a/src/state/CallViewModel/localMember/LocalMember.ts b/src/state/CallViewModel/localMember/LocalMember.ts index fcc8ed0a6..078c5a036 100644 --- a/src/state/CallViewModel/localMember/LocalMember.ts +++ b/src/state/CallViewModel/localMember/LocalMember.ts @@ -908,6 +908,8 @@ export function enterRTCSession( makeKeyDelay: matrixRtcSessionConfig?.wait_for_key_rotation_ms, membershipEventExpiryMs: matrixRtcSessionConfig?.membership_event_expiry_ms, + keyRotationParticipantLimit: + matrixRtcSessionConfig?.key_rotation_participant_limit, unstableSendStickyEvents: matrixRTCMode === MatrixRTCMode.Matrix_2_0, maximumNetworkErrorRetryCount: maximumNetworkErrorRetryCount, },