matrix-pretix/vendor/maunium.net/go/mautrix/crypto/verification.go

// Copyright (c) 2020 Nikos Filippakis
//
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.

//go:build !nosas
// +build !nosas

package crypto

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"math/rand"
	"sort"
	"strconv"
	"strings"
	"sync"
	"time"

	"maunium.net/go/mautrix"
	"maunium.net/go/mautrix/crypto/canonicaljson"
	"maunium.net/go/mautrix/crypto/olm"
	"maunium.net/go/mautrix/event"
	"maunium.net/go/mautrix/id"
)

var (
	ErrUnknownUserForTransaction = errors.New("unknown user for transaction")
	ErrTransactionAlreadyExists  = errors.New("transaction already exists")
	// ErrUnknownTransaction is returned when a key verification message is received with an unknown transaction ID.
	ErrUnknownTransaction = errors.New("unknown transaction")
	// ErrUnknownVerificationMethod is returned when the verification method in a received m.key.verification.start is unknown.
	ErrUnknownVerificationMethod = errors.New("unknown verification method")
)

type VerificationHooks interface {
	// VerifySASMatch receives the generated SAS and its method, as well as the device that is being verified.
	// It returns whether the given SAS match with the SAS displayed on other device.
	VerifySASMatch(otherDevice *DeviceIdentity, sas SASData) bool
	// VerificationMethods returns the list of supported verification methods in order of preference.
	// It must contain at least the decimal method.
	VerificationMethods() []VerificationMethod
	OnCancel(cancelledByUs bool, reason string, reasonCode event.VerificationCancelCode)
	OnSuccess()
}

type VerificationRequestResponse int

const (
	AcceptRequest VerificationRequestResponse = iota
	RejectRequest
	IgnoreRequest
)

// sendToOneDevice sends a to-device event to a single device.
func (mach *OlmMachine) sendToOneDevice(userID id.UserID, deviceID id.DeviceID, eventType event.Type, content interface{}) error {
	_, err := mach.Client.SendToDevice(eventType, &mautrix.ReqSendToDevice{
		Messages: map[id.UserID]map[id.DeviceID]*event.Content{
			userID: {
				deviceID: {
					Parsed: content,
				},
			},
		},
	})

	return err
}

func (mach *OlmMachine) getPKAndKeysMAC(sas *olm.SAS, sendingUser id.UserID, sendingDevice id.DeviceID, receivingUser id.UserID, receivingDevice id.DeviceID,
	transactionID string, signingKey id.SigningKey, mainKeyID id.KeyID, keys map[id.KeyID]string) (string, string, error) {
	sasInfo := "MATRIX_KEY_VERIFICATION_MAC" +
		sendingUser.String() + sendingDevice.String() +
		receivingUser.String() + receivingDevice.String() +
		transactionID

	// get key IDs from key map
	keyIDStrings := make([]string, len(keys))
	i := 0
	for keyID := range keys {
		keyIDStrings[i] = keyID.String()
		i++
	}
	sort.Sort(sort.StringSlice(keyIDStrings))
	keyIDString := strings.Join(keyIDStrings, ",")

	pubKeyMac, err := sas.CalculateMAC([]byte(signingKey), []byte(sasInfo+mainKeyID.String()))
	if err != nil {
		return "", "", err
	}
	mach.Log.Trace("sas.CalculateMAC(\"%s\", \"%s\") -> \"%s\"", signingKey, sasInfo+mainKeyID.String(), string(pubKeyMac))

	keysMac, err := sas.CalculateMAC([]byte(keyIDString), []byte(sasInfo+"KEY_IDS"))
	if err != nil {
		return "", "", err
	}
	mach.Log.Trace("sas.CalculateMAC(\"%s\", \"%s\") -> \"%s\"", keyIDString, sasInfo+"KEY_IDS", string(keysMac))

	return string(pubKeyMac), string(keysMac), nil
}

// verificationState holds all the information needed for the state of a SAS verification with another device.
type verificationState struct {
	sas                 *olm.SAS
	otherDevice         *DeviceIdentity
	initiatedByUs       bool
	verificationStarted bool
	keyReceived         bool
	sasMatched          chan bool
	commitment          string
	startEventCanonical string
	chosenSASMethod     VerificationMethod
	hooks               VerificationHooks
	extendTimeout       context.CancelFunc
	inRoomID            id.RoomID
	lock                sync.Mutex
}

// getTransactionState retrieves the given transaction's state, or cancels the transaction if it cannot be found or there is a mismatch.
func (mach *OlmMachine) getTransactionState(transactionID string, userID id.UserID) (*verificationState, error) {
	verStateInterface, ok := mach.keyVerificationTransactionState.Load(userID.String() + ":" + transactionID)
	if !ok {
		_ = mach.SendSASVerificationCancel(userID, id.DeviceID("*"), transactionID, "Unknown transaction: "+transactionID, event.VerificationCancelUnknownTransaction)
		return nil, ErrUnknownTransaction
	}
	verState := verStateInterface.(*verificationState)
	if verState.otherDevice.UserID != userID {
		reason := fmt.Sprintf("Unknown user for transaction %v: %v", transactionID, userID)
		if verState.inRoomID == "" {
			_ = mach.SendSASVerificationCancel(userID, id.DeviceID("*"), transactionID, reason, event.VerificationCancelUserMismatch)
		} else {
			_ = mach.SendInRoomSASVerificationCancel(verState.inRoomID, userID, transactionID, reason, event.VerificationCancelUserMismatch)
		}
		mach.keyVerificationTransactionState.Delete(userID.String() + ":" + transactionID)
		return nil, fmt.Errorf("%w %s: %s", ErrUnknownUserForTransaction, transactionID, userID)
	}
	return verState, nil
}

// handleVerificationStart handles an incoming m.key.verification.start message.
// It initializes the state for this SAS verification process and stores it.
func (mach *OlmMachine) handleVerificationStart(userID id.UserID, content *event.VerificationStartEventContent, transactionID string, timeout time.Duration, inRoomID id.RoomID) {
	mach.Log.Debug("Received verification start from %v", content.FromDevice)
	otherDevice, err := mach.GetOrFetchDevice(userID, content.FromDevice)
	if err != nil {
		mach.Log.Error("Could not find device %v of user %v", content.FromDevice, userID)
		return
	}
	warnAndCancel := func(logReason, cancelReason string) {
		mach.Log.Warn("Canceling verification transaction %v as it %s", transactionID, logReason)
		if inRoomID == "" {
			_ = mach.SendSASVerificationCancel(otherDevice.UserID, otherDevice.DeviceID, transactionID, cancelReason, event.VerificationCancelUnknownMethod)
		} else {
			_ = mach.SendInRoomSASVerificationCancel(inRoomID, otherDevice.UserID, transactionID, cancelReason, event.VerificationCancelUnknownMethod)
		}
	}
	switch {
	case content.Method != event.VerificationMethodSAS:
		warnAndCancel("is not SAS", "Only SAS method is supported")
	case !content.SupportsKeyAgreementProtocol(event.KeyAgreementCurve25519HKDFSHA256):
		warnAndCancel("does not support key agreement protocol curve25519-hkdf-sha256",
			"Only curve25519-hkdf-sha256 key agreement protocol is supported")
	case !content.SupportsHashMethod(event.VerificationHashSHA256):
		warnAndCancel("does not support SHA256 hashing", "Only SHA256 hashing is supported")
	case !content.SupportsMACMethod(event.HKDFHMACSHA256):
		warnAndCancel("does not support MAC method hkdf-hmac-sha256", "Only hkdf-hmac-sha256 MAC method is supported")
	case !content.SupportsSASMethod(event.SASDecimal):
		warnAndCancel("does not support decimal SAS", "Decimal SAS method must be supported")
	default:
		mach.actuallyStartVerification(userID, content, otherDevice, transactionID, timeout, inRoomID)
	}
}

func (mach *OlmMachine) actuallyStartVerification(userID id.UserID, content *event.VerificationStartEventContent, otherDevice *DeviceIdentity, transactionID string, timeout time.Duration, inRoomID id.RoomID) {
	if inRoomID != "" && transactionID != "" {
		verState, err := mach.getTransactionState(transactionID, userID)
		if err != nil {
			mach.Log.Error("Failed to get transaction state for in-room verification %s start: %v", transactionID, err)
			_ = mach.SendInRoomSASVerificationCancel(inRoomID, otherDevice.UserID, transactionID, "Internal state error in gomuks :(", "net.maunium.internal_error")
			return
		}
		mach.timeoutAfter(verState, transactionID, timeout)
		sasMethods := commonSASMethods(verState.hooks, content.ShortAuthenticationString)
		err = mach.SendInRoomSASVerificationAccept(inRoomID, userID, content, transactionID, verState.sas.GetPubkey(), sasMethods)
		if err != nil {
			mach.Log.Error("Error accepting in-room SAS verification: %v", err)
		}
		verState.chosenSASMethod = sasMethods[0]
		verState.verificationStarted = true
		return
	}
	resp, hooks := mach.AcceptVerificationFrom(transactionID, otherDevice, inRoomID)
	if resp == AcceptRequest {
		sasMethods := commonSASMethods(hooks, content.ShortAuthenticationString)
		if len(sasMethods) == 0 {
			mach.Log.Error("No common SAS methods: %v", content.ShortAuthenticationString)
			if inRoomID == "" {
				_ = mach.SendSASVerificationCancel(otherDevice.UserID, otherDevice.DeviceID, transactionID, "No common SAS methods", event.VerificationCancelUnknownMethod)
			} else {
				_ = mach.SendInRoomSASVerificationCancel(inRoomID, otherDevice.UserID, transactionID, "No common SAS methods", event.VerificationCancelUnknownMethod)
			}
			return
		}
		verState := &verificationState{
			sas:                 olm.NewSAS(),
			otherDevice:         otherDevice,
			initiatedByUs:       false,
			verificationStarted: true,
			keyReceived:         false,
			sasMatched:          make(chan bool, 1),
			hooks:               hooks,
			chosenSASMethod:     sasMethods[0],
			inRoomID:            inRoomID,
		}
		verState.lock.Lock()
		defer verState.lock.Unlock()

		_, loaded := mach.keyVerificationTransactionState.LoadOrStore(userID.String()+":"+transactionID, verState)
		if loaded {
			// transaction already exists
			mach.Log.Error("Transaction %v already exists, canceling", transactionID)
			if inRoomID == "" {
				_ = mach.SendSASVerificationCancel(otherDevice.UserID, otherDevice.DeviceID, transactionID, "Transaction already exists", event.VerificationCancelUnexpectedMessage)
			} else {
				_ = mach.SendInRoomSASVerificationCancel(inRoomID, otherDevice.UserID, transactionID, "Transaction already exists", event.VerificationCancelUnexpectedMessage)
			}
			return
		}

		mach.timeoutAfter(verState, transactionID, timeout)

		var err error
		if inRoomID == "" {
			err = mach.SendSASVerificationAccept(userID, content, verState.sas.GetPubkey(), sasMethods)
		} else {
			err = mach.SendInRoomSASVerificationAccept(inRoomID, userID, content, transactionID, verState.sas.GetPubkey(), sasMethods)
		}
		if err != nil {
			mach.Log.Error("Error accepting SAS verification: %v", err)
		}
	} else if resp == RejectRequest {
		mach.Log.Debug("Not accepting SAS verification %v from %v of user %v", transactionID, otherDevice.DeviceID, otherDevice.UserID)
		var err error
		if inRoomID == "" {
			err = mach.SendSASVerificationCancel(otherDevice.UserID, otherDevice.DeviceID, transactionID, "Not accepted by user", event.VerificationCancelByUser)
		} else {
			err = mach.SendInRoomSASVerificationCancel(inRoomID, otherDevice.UserID, transactionID, "Not accepted by user", event.VerificationCancelByUser)
		}
		if err != nil {
			mach.Log.Error("Error canceling SAS verification: %v", err)
		}
	} else {
		mach.Log.Debug("Ignoring SAS verification %v from %v of user %v", transactionID, otherDevice.DeviceID, otherDevice.UserID)
	}
}

func (mach *OlmMachine) timeoutAfter(verState *verificationState, transactionID string, timeout time.Duration) {
	timeoutCtx, timeoutCancel := context.WithTimeout(context.Background(), timeout)
	verState.extendTimeout = timeoutCancel
	go func() {
		mapKey := verState.otherDevice.UserID.String() + ":" + transactionID
		for {
			<-timeoutCtx.Done()
			// when timeout context is done
			verState.lock.Lock()
			// if transaction not active anymore, return
			if _, ok := mach.keyVerificationTransactionState.Load(mapKey); !ok {
				verState.lock.Unlock()
				return
			}
			if timeoutCtx.Err() == context.DeadlineExceeded {
				// if deadline exceeded cancel due to timeout
				mach.keyVerificationTransactionState.Delete(mapKey)
				_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Timed out", event.VerificationCancelByTimeout)
				mach.Log.Warn("Verification transaction %v is canceled due to timing out", transactionID)
				verState.lock.Unlock()
				return
			}
			// otherwise the cancel func was called, so the timeout is reset
			mach.Log.Debug("Extending timeout for transaction %v", transactionID)
			timeoutCtx, timeoutCancel = context.WithTimeout(context.Background(), timeout)
			verState.extendTimeout = timeoutCancel
			verState.lock.Unlock()
		}
	}()
}

// handleVerificationAccept handles an incoming m.key.verification.accept message.
// It continues the SAS verification process by sending the SAS key message to the other device.
func (mach *OlmMachine) handleVerificationAccept(userID id.UserID, content *event.VerificationAcceptEventContent, transactionID string) {
	mach.Log.Debug("Received verification accept for transaction %v", transactionID)
	verState, err := mach.getTransactionState(transactionID, userID)
	if err != nil {
		mach.Log.Error("Error getting transaction state: %v", err)
		return
	}
	verState.lock.Lock()
	defer verState.lock.Unlock()
	verState.extendTimeout()

	if !verState.initiatedByUs || verState.verificationStarted {
		// unexpected accept at this point
		mach.Log.Warn("Unexpected verification accept message for transaction %v", transactionID)
		mach.keyVerificationTransactionState.Delete(userID.String() + ":" + transactionID)
		_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Unexpected accept message", event.VerificationCancelUnexpectedMessage)
		return
	}

	sasMethods := commonSASMethods(verState.hooks, content.ShortAuthenticationString)
	if content.KeyAgreementProtocol != event.KeyAgreementCurve25519HKDFSHA256 ||
		content.Hash != event.VerificationHashSHA256 ||
		content.MessageAuthenticationCode != event.HKDFHMACSHA256 ||
		len(sasMethods) == 0 {

		mach.Log.Warn("Canceling verification transaction %v due to unknown parameter", transactionID)
		mach.keyVerificationTransactionState.Delete(userID.String() + ":" + transactionID)
		_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Verification uses unknown method", event.VerificationCancelUnknownMethod)
		return
	}

	key := verState.sas.GetPubkey()
	verState.commitment = content.Commitment
	verState.chosenSASMethod = sasMethods[0]
	verState.verificationStarted = true

	if verState.inRoomID == "" {
		err = mach.SendSASVerificationKey(userID, verState.otherDevice.DeviceID, transactionID, string(key))
	} else {
		err = mach.SendInRoomSASVerificationKey(verState.inRoomID, userID, transactionID, string(key))
	}
	if err != nil {
		mach.Log.Error("Error sending SAS key to other device: %v", err)
		return
	}
}

// handleVerificationKey handles an incoming m.key.verification.key message.
// It stores the other device's public key in order to acquire the SAS shared secret.
func (mach *OlmMachine) handleVerificationKey(userID id.UserID, content *event.VerificationKeyEventContent, transactionID string) {
	mach.Log.Debug("Got verification key for transaction %v: %v", transactionID, content.Key)
	verState, err := mach.getTransactionState(transactionID, userID)
	if err != nil {
		mach.Log.Error("Error getting transaction state: %v", err)
		return
	}
	verState.lock.Lock()
	defer verState.lock.Unlock()
	verState.extendTimeout()

	device := verState.otherDevice

	if !verState.verificationStarted || verState.keyReceived {
		// unexpected key at this point
		mach.Log.Warn("Unexpected verification key message for transaction %v", transactionID)
		mach.keyVerificationTransactionState.Delete(userID.String() + ":" + transactionID)
		_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Unexpected key message", event.VerificationCancelUnexpectedMessage)
		return
	}

	if err := verState.sas.SetTheirKey([]byte(content.Key)); err != nil {
		mach.Log.Error("Error setting other device's key: %v", err)
		return
	}

	verState.keyReceived = true

	if verState.initiatedByUs {
		// verify commitment string from accept message now
		expectedCommitment := olm.NewUtility().Sha256(content.Key + verState.startEventCanonical)
		mach.Log.Debug("Received commitment: %v Expected: %v", verState.commitment, expectedCommitment)
		if expectedCommitment != verState.commitment {
			mach.Log.Warn("Canceling verification transaction %v due to commitment mismatch", transactionID)
			mach.keyVerificationTransactionState.Delete(userID.String() + ":" + transactionID)
			_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Commitment mismatch", event.VerificationCancelCommitmentMismatch)
			return
		}
	} else {
		// if verification was initiated by other device, send out our key now
		key := verState.sas.GetPubkey()

		if verState.inRoomID == "" {
			err = mach.SendSASVerificationKey(userID, device.DeviceID, transactionID, string(key))
		} else {
			err = mach.SendInRoomSASVerificationKey(verState.inRoomID, userID, transactionID, string(key))
		}
		if err != nil {
			mach.Log.Error("Error sending SAS key to other device: %v", err)
			return
		}
	}

	// compare the SAS keys in a new goroutine and, when the verification is complete, send out the MAC
	var initUserID, acceptUserID id.UserID
	var initDeviceID, acceptDeviceID id.DeviceID
	var initKey, acceptKey string
	if verState.initiatedByUs {
		initUserID = mach.Client.UserID
		initDeviceID = mach.Client.DeviceID
		initKey = string(verState.sas.GetPubkey())
		acceptUserID = device.UserID
		acceptDeviceID = device.DeviceID
		acceptKey = content.Key
	} else {
		initUserID = device.UserID
		initDeviceID = device.DeviceID
		initKey = content.Key
		acceptUserID = mach.Client.UserID
		acceptDeviceID = mach.Client.DeviceID
		acceptKey = string(verState.sas.GetPubkey())
	}
	// use the prefered SAS method to generate a SAS
	sasMethod := verState.chosenSASMethod
	sas, err := sasMethod.GetVerificationSAS(initUserID, initDeviceID, initKey, acceptUserID, acceptDeviceID, acceptKey, transactionID, verState.sas)
	if err != nil {
		mach.Log.Error("Error generating SAS (method %v): %v", sasMethod.Type(), err)
		return
	}
	mach.Log.Debug("Generated SAS (%v): %v", sasMethod.Type(), sas)
	go func() {
		result := verState.hooks.VerifySASMatch(device, sas)
		mach.sasCompared(result, transactionID, verState)
	}()
}

// sasCompared is called asynchronously. It waits for the SAS to be compared for the verification to proceed.
// If the SAS match, then our MAC is sent out. Otherwise the transaction is canceled.
func (mach *OlmMachine) sasCompared(didMatch bool, transactionID string, verState *verificationState) {
	verState.lock.Lock()
	defer verState.lock.Unlock()
	verState.extendTimeout()
	if didMatch {
		verState.sasMatched <- true
		var err error
		if verState.inRoomID == "" {
			err = mach.SendSASVerificationMAC(verState.otherDevice.UserID, verState.otherDevice.DeviceID, transactionID, verState.sas)
		} else {
			err = mach.SendInRoomSASVerificationMAC(verState.inRoomID, verState.otherDevice.UserID, verState.otherDevice.DeviceID, transactionID, verState.sas)
		}
		if err != nil {
			mach.Log.Error("Error sending verification MAC to other device: %v", err)
		}
	} else {
		verState.sasMatched <- false
	}
}

// handleVerificationMAC handles an incoming m.key.verification.mac message.
// It verifies the other device's MAC and if the MAC is valid it marks the device as trusted.
func (mach *OlmMachine) handleVerificationMAC(userID id.UserID, content *event.VerificationMacEventContent, transactionID string) {
	mach.Log.Debug("Got MAC for verification %v: %v, MAC for keys: %v", transactionID, content.Mac, content.Keys)
	verState, err := mach.getTransactionState(transactionID, userID)
	if err != nil {
		mach.Log.Error("Error getting transaction state: %v", err)
		return
	}
	verState.lock.Lock()
	defer verState.lock.Unlock()
	verState.extendTimeout()

	device := verState.otherDevice

	// we are done with this SAS verification in all cases so we forget about it
	mach.keyVerificationTransactionState.Delete(userID.String() + ":" + transactionID)

	if !verState.verificationStarted || !verState.keyReceived {
		// unexpected MAC at this point
		mach.Log.Warn("Unexpected MAC message for transaction %v", transactionID)
		_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Unexpected MAC message", event.VerificationCancelUnexpectedMessage)
		return
	}

	// do this in another goroutine as the match result might take a long time to arrive
	go func() {
		matched := <-verState.sasMatched
		verState.lock.Lock()
		defer verState.lock.Unlock()

		if !matched {
			mach.Log.Warn("SAS do not match! Canceling transaction %v", transactionID)
			_ = mach.callbackAndCancelSASVerification(verState, transactionID, "SAS do not match", event.VerificationCancelSASMismatch)
			return
		}

		keyID := id.NewKeyID(id.KeyAlgorithmEd25519, device.DeviceID.String())

		expectedPKMAC, expectedKeysMAC, err := mach.getPKAndKeysMAC(verState.sas, device.UserID, device.DeviceID,
			mach.Client.UserID, mach.Client.DeviceID, transactionID, device.SigningKey, keyID, content.Mac)
		if err != nil {
			mach.Log.Error("Error generating MAC to match with received MAC: %v", err)
			return
		}

		mach.Log.Debug("Expected %s keys MAC, got %s", expectedKeysMAC, content.Keys)
		if content.Keys != expectedKeysMAC {
			mach.Log.Warn("Canceling verification transaction %v due to mismatched keys MAC", transactionID)
			_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Mismatched keys MACs", event.VerificationCancelKeyMismatch)
			return
		}

		mach.Log.Debug("Expected %s PK MAC, got %s", expectedPKMAC, content.Mac[keyID])
		if content.Mac[keyID] != expectedPKMAC {
			mach.Log.Warn("Canceling verification transaction %v due to mismatched PK MAC", transactionID)
			_ = mach.callbackAndCancelSASVerification(verState, transactionID, "Mismatched PK MACs", event.VerificationCancelKeyMismatch)
			return
		}

		// we can finally trust this device
		device.Trust = TrustStateVerified
		err = mach.CryptoStore.PutDevice(device.UserID, device)
		if err != nil {
			mach.Log.Warn("Failed to put device after verifying: %v", err)
		}

		if mach.CrossSigningKeys != nil {
			if device.UserID == mach.Client.UserID {
				err := mach.SignOwnDevice(device)
				if err != nil {
					mach.Log.Error("Failed to cross-sign own device %s: %v", device.DeviceID, err)
				} else {
					mach.Log.Debug("Cross-signed own device %v after SAS verification", device.DeviceID)
				}
			} else {
				masterKey, err := mach.fetchMasterKey(device, content, verState, transactionID)
				if err != nil {
					mach.Log.Warn("Failed to fetch %s's master key: %v", device.UserID, err)
				} else {
					if err := mach.SignUser(device.UserID, masterKey); err != nil {
						mach.Log.Error("Failed to cross-sign master key of %s: %v", device.UserID, err)
					} else {
						mach.Log.Debug("Cross-signed master key of %v after SAS verification", device.UserID)
					}
				}
			}
		} else {
			// TODO ask user to unlock cross-signing keys?
			mach.Log.Debug("Cross-signing keys not cached, not signing %s/%s", device.UserID, device.DeviceID)
		}

		mach.Log.Debug("Device %v of user %v verified successfully!", device.DeviceID, device.UserID)

		verState.hooks.OnSuccess()
	}()
}

// handleVerificationCancel handles an incoming m.key.verification.cancel message.
// It cancels the verification process for the given reason.
func (mach *OlmMachine) handleVerificationCancel(userID id.UserID, content *event.VerificationCancelEventContent, transactionID string) {
	// make sure to not reply with a cancel to not cause a loop of cancel messages
	// this verification will get canceled even if the senders do not match
	verStateInterface, ok := mach.keyVerificationTransactionState.Load(userID.String() + ":" + transactionID)
	if ok {
		go verStateInterface.(*verificationState).hooks.OnCancel(false, content.Reason, content.Code)
	}

	mach.keyVerificationTransactionState.Delete(userID.String() + ":" + transactionID)
	mach.Log.Warn("SAS verification %v was canceled by %v with reason: %v (%v)",
		transactionID, userID, content.Reason, content.Code)
}

// handleVerificationRequest handles an incoming m.key.verification.request message.
func (mach *OlmMachine) handleVerificationRequest(userID id.UserID, content *event.VerificationRequestEventContent, transactionID string, inRoomID id.RoomID) {
	mach.Log.Debug("Received verification request from %v", content.FromDevice)
	otherDevice, err := mach.GetOrFetchDevice(userID, content.FromDevice)
	if err != nil {
		mach.Log.Error("Could not find device %v of user %v", content.FromDevice, userID)
		return
	}
	if !content.SupportsVerificationMethod(event.VerificationMethodSAS) {
		mach.Log.Warn("Canceling verification transaction %v as SAS is not supported", transactionID)
		if inRoomID == "" {
			_ = mach.SendSASVerificationCancel(otherDevice.UserID, otherDevice.DeviceID, transactionID, "Only SAS method is supported", event.VerificationCancelUnknownMethod)
		} else {
			_ = mach.SendInRoomSASVerificationCancel(inRoomID, otherDevice.UserID, transactionID, "Only SAS method is supported", event.VerificationCancelUnknownMethod)
		}
		return
	}
	resp, hooks := mach.AcceptVerificationFrom(transactionID, otherDevice, inRoomID)
	if resp == AcceptRequest {
		mach.Log.Debug("Accepting SAS verification %v from %v of user %v", transactionID, otherDevice.DeviceID, otherDevice.UserID)
		if inRoomID == "" {
			_, err = mach.NewSASVerificationWith(otherDevice, hooks, transactionID, mach.DefaultSASTimeout)
		} else {
			if err := mach.SendInRoomSASVerificationReady(inRoomID, transactionID); err != nil {
				mach.Log.Error("Error sending in-room SAS verification ready: %v", err)
			}
			if mach.Client.UserID < otherDevice.UserID {
				// up to us to send the start message
				_, err = mach.newInRoomSASVerificationWithInner(inRoomID, otherDevice, hooks, transactionID, mach.DefaultSASTimeout)
			}
		}
		if err != nil {
			mach.Log.Error("Error accepting SAS verification request: %v", err)
		}
	} else if resp == RejectRequest {
		mach.Log.Debug("Rejecting SAS verification %v from %v of user %v", transactionID, otherDevice.DeviceID, otherDevice.UserID)
		if inRoomID == "" {
			_ = mach.SendSASVerificationCancel(otherDevice.UserID, otherDevice.DeviceID, transactionID, "Not accepted by user", event.VerificationCancelByUser)
		} else {
			_ = mach.SendInRoomSASVerificationCancel(inRoomID, otherDevice.UserID, transactionID, "Not accepted by user", event.VerificationCancelByUser)
		}
	} else {
		mach.Log.Debug("Ignoring SAS verification %v from %v of user %v", transactionID, otherDevice.DeviceID, otherDevice.UserID)
	}
}

// NewSimpleSASVerificationWith starts the SAS verification process with another device with a default timeout,
// a generated transaction ID and support for both emoji and decimal SAS methods.
func (mach *OlmMachine) NewSimpleSASVerificationWith(device *DeviceIdentity, hooks VerificationHooks) (string, error) {
	return mach.NewSASVerificationWith(device, hooks, "", mach.DefaultSASTimeout)
}

// NewSASVerificationWith starts the SAS verification process with another device.
// If the other device accepts the verification transaction, the methods in `hooks` will be used to verify the SAS match and to complete the transaction..
// If the transaction ID is empty, a new one is generated.
func (mach *OlmMachine) NewSASVerificationWith(device *DeviceIdentity, hooks VerificationHooks, transactionID string, timeout time.Duration) (string, error) {
	if transactionID == "" {
		transactionID = strconv.Itoa(rand.Int())
	}
	mach.Log.Debug("Starting new verification transaction %v with device %v of user %v", transactionID, device.DeviceID, device.UserID)

	verState := &verificationState{
		sas:                 olm.NewSAS(),
		otherDevice:         device,
		initiatedByUs:       true,
		verificationStarted: false,
		keyReceived:         false,
		sasMatched:          make(chan bool, 1),
		hooks:               hooks,
	}
	verState.lock.Lock()
	defer verState.lock.Unlock()

	startEvent, err := mach.SendSASVerificationStart(device.UserID, device.DeviceID, transactionID, hooks.VerificationMethods())
	if err != nil {
		return "", err
	}

	payload, err := json.Marshal(startEvent)
	if err != nil {
		return "", err
	}
	canonical, err := canonicaljson.CanonicalJSON(payload)
	if err != nil {
		return "", err
	}

	verState.startEventCanonical = string(canonical)
	_, loaded := mach.keyVerificationTransactionState.LoadOrStore(device.UserID.String()+":"+transactionID, verState)
	if loaded {
		return "", ErrTransactionAlreadyExists
	}

	mach.timeoutAfter(verState, transactionID, timeout)

	return transactionID, nil
}

// CancelSASVerification is used by the user to cancel a SAS verification process with the given reason.
func (mach *OlmMachine) CancelSASVerification(userID id.UserID, transactionID, reason string) error {
	mapKey := userID.String() + ":" + transactionID
	verStateInterface, ok := mach.keyVerificationTransactionState.Load(mapKey)
	if !ok {
		return ErrUnknownTransaction
	}
	verState := verStateInterface.(*verificationState)
	verState.lock.Lock()
	defer verState.lock.Unlock()
	mach.Log.Trace("User canceled verification transaction %v with reason: %v", transactionID, reason)
	mach.keyVerificationTransactionState.Delete(mapKey)
	return mach.callbackAndCancelSASVerification(verState, transactionID, reason, event.VerificationCancelByUser)
}

// SendSASVerificationCancel is used to manually send a SAS cancel message process with the given reason and cancellation code.
func (mach *OlmMachine) SendSASVerificationCancel(userID id.UserID, deviceID id.DeviceID, transactionID string, reason string, code event.VerificationCancelCode) error {
	content := &event.VerificationCancelEventContent{
		TransactionID: transactionID,
		Reason:        reason,
		Code:          code,
	}
	return mach.sendToOneDevice(userID, deviceID, event.ToDeviceVerificationCancel, content)
}

// SendSASVerificationStart is used to manually send the SAS verification start message to another device.
func (mach *OlmMachine) SendSASVerificationStart(toUserID id.UserID, toDeviceID id.DeviceID, transactionID string, methods []VerificationMethod) (*event.VerificationStartEventContent, error) {
	sasMethods := make([]event.SASMethod, len(methods))
	for i, method := range methods {
		sasMethods[i] = method.Type()
	}
	content := &event.VerificationStartEventContent{
		FromDevice:                 mach.Client.DeviceID,
		TransactionID:              transactionID,
		Method:                     event.VerificationMethodSAS,
		KeyAgreementProtocols:      []event.KeyAgreementProtocol{event.KeyAgreementCurve25519HKDFSHA256},
		Hashes:                     []event.VerificationHashMethod{event.VerificationHashSHA256},
		MessageAuthenticationCodes: []event.MACMethod{event.HKDFHMACSHA256},
		ShortAuthenticationString:  sasMethods,
	}
	return content, mach.sendToOneDevice(toUserID, toDeviceID, event.ToDeviceVerificationStart, content)
}

// SendSASVerificationAccept is used to manually send an accept for a SAS verification process from a received m.key.verification.start event.
func (mach *OlmMachine) SendSASVerificationAccept(fromUser id.UserID, startEvent *event.VerificationStartEventContent, publicKey []byte, methods []VerificationMethod) error {
	if startEvent.Method != event.VerificationMethodSAS {
		reason := "Unknown verification method: " + string(startEvent.Method)
		if err := mach.SendSASVerificationCancel(fromUser, startEvent.FromDevice, startEvent.TransactionID, reason, event.VerificationCancelUnknownMethod); err != nil {
			return err
		}
		return ErrUnknownVerificationMethod
	}
	payload, err := json.Marshal(startEvent)
	if err != nil {
		return err
	}
	canonical, err := canonicaljson.CanonicalJSON(payload)
	if err != nil {
		return err
	}
	hash := olm.NewUtility().Sha256(string(publicKey) + string(canonical))
	sasMethods := make([]event.SASMethod, len(methods))
	for i, method := range methods {
		sasMethods[i] = method.Type()
	}
	content := &event.VerificationAcceptEventContent{
		TransactionID:             startEvent.TransactionID,
		Method:                    event.VerificationMethodSAS,
		KeyAgreementProtocol:      event.KeyAgreementCurve25519HKDFSHA256,
		Hash:                      event.VerificationHashSHA256,
		MessageAuthenticationCode: event.HKDFHMACSHA256,
		ShortAuthenticationString: sasMethods,
		Commitment:                hash,
	}
	return mach.sendToOneDevice(fromUser, startEvent.FromDevice, event.ToDeviceVerificationAccept, content)
}

func (mach *OlmMachine) callbackAndCancelSASVerification(verState *verificationState, transactionID, reason string, code event.VerificationCancelCode) error {
	go verState.hooks.OnCancel(true, reason, code)
	return mach.SendSASVerificationCancel(verState.otherDevice.UserID, verState.otherDevice.DeviceID, transactionID, reason, code)
}

// SendSASVerificationKey sends the ephemeral public key for a device to the partner device.
func (mach *OlmMachine) SendSASVerificationKey(userID id.UserID, deviceID id.DeviceID, transactionID string, key string) error {
	content := &event.VerificationKeyEventContent{
		TransactionID: transactionID,
		Key:           key,
	}
	return mach.sendToOneDevice(userID, deviceID, event.ToDeviceVerificationKey, content)
}

// SendSASVerificationMAC is use the MAC of a device's key to the partner device.
func (mach *OlmMachine) SendSASVerificationMAC(userID id.UserID, deviceID id.DeviceID, transactionID string, sas *olm.SAS) error {
	keyID := id.NewKeyID(id.KeyAlgorithmEd25519, mach.Client.DeviceID.String())

	signingKey := mach.account.SigningKey()
	keyIDsMap := map[id.KeyID]string{keyID: ""}
	macMap := make(map[id.KeyID]string)

	if mach.CrossSigningKeys != nil {
		masterKey := mach.CrossSigningKeys.MasterKey.PublicKey
		masterKeyID := id.NewKeyID(id.KeyAlgorithmEd25519, masterKey.String())
		// add master key ID to key map
		keyIDsMap[masterKeyID] = ""
		masterKeyMAC, _, err := mach.getPKAndKeysMAC(sas, mach.Client.UserID, mach.Client.DeviceID,
			userID, deviceID, transactionID, masterKey, masterKeyID, keyIDsMap)
		if err != nil {
			mach.Log.Error("Error generating master key MAC: %v", err)
		} else {
			mach.Log.Debug("Generated master key `%v` MAC: %v", masterKey, masterKeyMAC)
			macMap[masterKeyID] = masterKeyMAC
		}
	}

	pubKeyMac, keysMac, err := mach.getPKAndKeysMAC(sas, mach.Client.UserID, mach.Client.DeviceID, userID, deviceID, transactionID, signingKey, keyID, keyIDsMap)
	if err != nil {
		return err
	}
	mach.Log.Debug("MAC of key %s is: %s", signingKey, pubKeyMac)
	mach.Log.Debug("MAC of key ID(s) %s is: %s", keyID, keysMac)
	macMap[keyID] = pubKeyMac

	content := &event.VerificationMacEventContent{
		TransactionID: transactionID,
		Keys:          keysMac,
		Mac:           macMap,
	}

	return mach.sendToOneDevice(userID, deviceID, event.ToDeviceVerificationMAC, content)
}

func commonSASMethods(hooks VerificationHooks, otherDeviceMethods []event.SASMethod) []VerificationMethod {
	methods := make([]VerificationMethod, 0)
	for _, hookMethod := range hooks.VerificationMethods() {
		for _, otherMethod := range otherDeviceMethods {
			if hookMethod.Type() == otherMethod {
				methods = append(methods, hookMethod)
				break
			}
		}
	}
	return methods
}