Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[TSP] Require biometric authentication at time-of-upload when securely sharing TSP-encrypted documents

Abierto
  • ¿Algo no está bien?
#601 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
rust
Área
mobile-dev, security

Línea de trabajo

Review the existing robius-authentication integration and the upload path described in the issue, then check how rfd support varies across platforms, especially Android. Done means biometric authentication is required before signing or uploading TSP-encrypted documents, with document attachment support available on the target platforms.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

blocked-on-robius tsp

"Biometric authentication as a time-of-use check when sending sensitive wallet contents/documents to a room".

Example usage scenario: onboarding workflow

  • A new user (with their own TSP ID) wants to set up access to an existing project
  • They must communicate with an existing administrator or project maintainer in order to set up their privileged access to said project
  • The admin wants to be able to securely verify the new user's identity
  • The admin may also require the new user to sign an agreement, terms of use, or another form of document, e.g., a Developer Certificate of Origin (DCO)
    • Existing approaches for this are just a signature with an account, e.g., DocuSign, or even worse, a scanned image of a physical ink signature.
    • There is no real guarantee that the user who "signed" the agreement/document is actually the person they say they are
  • Key Challenge: The user must be able to provide and attach proof along with the signed document that they are (1) who they say they are, and (2) they are the one who signed the document, all without a centralized authority.
    1. This is where TSP comes in: the TSP ID is algorithmically verifiable and authentic.
    2. Use local biometric authentication (provided by the platform, e.g., FaceID, TouchID/fingerprints) before allowing the user to actually sign the document locally.
    • This is analogous to going to a public notary to sign a document in person under their supervision.
      • In this case, TSP + the platform together act as the notary to verify the user's actual identity and that they were the signatory.
  • Thus, by virtue of the user sending TSP-signed messages in the Matrix room, the admin can be assured that they are who they say they are. Similarly, by virtue of them sending a signed document, the admin can be assured that they are the ones who signed & completed it.
  • TSP + local biometric authentication prevent the attack vector in which your local device is stolen or otherwise compromised.
    • Together, this meets national legal requirements for signatures, similar to public notary services.

Implementation

  • We have a well-tested robius-authentication for this purpose, so it should be relatively straightforward to add this into Robrix.
  • However, uploading actual documents/file content is blocked on Robius's support for rfd on all platforms (currently missing Android).
Lenguaje dominante
Rust
Estrellas
489
Forks
71
Merge medio
1 h 27 min
PR fusionados (30 d)
72

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de project-robius/robrix

Todos los issues de project-robius/robrix

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.