ElementR: Fix missing key check values in 4S key storage

[BillCarsonFr]

Fixes element-hq/element-web#26721

Checklist

• Tests written for new code (and old code if feasible)
• Linter and other CI checks pass
• Sign-off given on the changes (see CONTRIBUTING.md)

---

Here's what your changelog entry will look like:

🚨 BREAKING CHANGES

• ElementR: Fix missing key check values in 4S key storage (#3950). Fixes ElementR: Key Storage | When adding a new key to 4S the key encryption check is not added to the key info element-hq/element-web#26721.

[BillCarsonFr]

This is some legacy field that was used for the deprecated m.secret_storage.v1.curve25519-aes-sha2 algorithm.

[richvdh]

Nit: could be a bit clearer here

Suggested change

	/** Information to generate the key from a passphrase if any. */
	/** If the key was derived from a passphrase, information (algorithm, salt, etc) on that derivation. */

[richvdh]

Nit:

Suggested change

	/** The private key. Will be used to generate the key check values in the key info, it will not be stored on the server */
	/** The private key. Will be used to generate the key check values in the key info; it will not be stored on the server */

[richvdh]

not a new issue, but this documentation is incomplete. This interface is also the return type of CreateSecretStorageOpts.createSecretStorageKey.

[richvdh]

The problem with this change (replacing the optional keyInfo property with an optional passphrase property) is that it means any existing implementation of CreateSecretStorageOpts.createSecretStorageKey (such as the one in matrix-react-sdk) will be incorrect. Worse, it will fail silently because new new property is optional. I think this is very dangerous.

I see two possible ways forward:

• Retain the keyInfo property, but with a reduced structure. This is what I suggested before:

  export interface GeneratedSecretStorageKey {
      keyInfo?: {
          passphrase?: PassphraseInfo;
          name?: string;  // maybe we don't need this?
      },
      privateKey: Uint8Array;
      encodedPrivateKey?: string;
  }

• Define a new interface to replace GeneratedSecretStorageKey (and deprecate the old one). Define a new property in CreateSecretStorageOpts to replace createSecretStorageKey which returns the new interface (and deprecate the old one); allow clients to provide either interface.

The second option ends up being more elegant (once we get rid of the deprecated classes/properties), but seems a lot more work.

[richvdh]

lgtm other than a few wording nits