Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[TSP] Require biometric authentication at time-of-upload when securely sharing TSP-encrypted documents

オープン
  • 何か問題がありますか？
#601 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
25/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
停滞
技術スタック
rust
領域
mobile-dev, security

調査の方向性

Review the existing robius-authentication integration and the upload path described in the issue, then check how rfd support varies across platforms, especially Android. Done means biometric authentication is required before signing or uploading TSP-encrypted documents, with document attachment support available on the target platforms.

索引モデルが issue の本文から書いたものです。

説明

blocked-on-robius tsp

"Biometric authentication as a time-of-use check when sending sensitive wallet contents/documents to a room".

Example usage scenario: onboarding workflow

  • A new user (with their own TSP ID) wants to set up access to an existing project
  • They must communicate with an existing administrator or project maintainer in order to set up their privileged access to said project
  • The admin wants to be able to securely verify the new user's identity
  • The admin may also require the new user to sign an agreement, terms of use, or another form of document, e.g., a Developer Certificate of Origin (DCO)
    • Existing approaches for this are just a signature with an account, e.g., DocuSign, or even worse, a scanned image of a physical ink signature.
    • There is no real guarantee that the user who "signed" the agreement/document is actually the person they say they are
  • Key Challenge: The user must be able to provide and attach proof along with the signed document that they are (1) who they say they are, and (2) they are the one who signed the document, all without a centralized authority.
    1. This is where TSP comes in: the TSP ID is algorithmically verifiable and authentic.
    2. Use local biometric authentication (provided by the platform, e.g., FaceID, TouchID/fingerprints) before allowing the user to actually sign the document locally.
    • This is analogous to going to a public notary to sign a document in person under their supervision.
      • In this case, TSP + the platform together act as the notary to verify the user's actual identity and that they were the signatory.
  • Thus, by virtue of the user sending TSP-signed messages in the Matrix room, the admin can be assured that they are who they say they are. Similarly, by virtue of them sending a signed document, the admin can be assured that they are the ones who signed & completed it.
  • TSP + local biometric authentication prevent the attack vector in which your local device is stolen or otherwise compromised.
    • Together, this meets national legal requirements for signatures, similar to public notary services.

Implementation

  • We have a well-tested robius-authentication for this purpose, so it should be relatively straightforward to add this into Robrix.
  • However, uploading actual documents/file content is blocked on Robius's support for rfd on all platforms (currently missing Android).
主要言語
Rust
スター
489
フォーク
71
平均マージ
1時間 27分
マージ済み PR（30日）
72

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

project-robius/robrix のほかの issue

project-robius/robrix の issue をすべて見る

似ている issue

Rust の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。