Skip to content

MSC4108: Mechanism to allow OAuth 2.0 API sign in and E2EE set up via QR code#4108

Open
hughns wants to merge 92 commits into
mainfrom
element-hq/oidc-qr-login
Open

MSC4108: Mechanism to allow OAuth 2.0 API sign in and E2EE set up via QR code#4108
hughns wants to merge 92 commits into
mainfrom
element-hq/oidc-qr-login

Conversation

@hughns

@hughns hughns commented Feb 22, 2024

Copy link
Copy Markdown
Member

SCT Stuff

MSC Checklist

FCP tickyboxes

Designated reviewers:


Rendered

Dependencies:

Video demos:

New EX scans existing EW
MSC4108 v2025 New EX scans existing EW

Existing EX scans new EW
MSC4108 v2025 Existing EX scans new EW

New EX scans existing EX
MSC4108 v2025 New EX scans existing EX


The authors are employed by Element to write this MSC.


Major revisions

The is an older version of this proposal (referred to as "2024") that has some significant differences from the current proposal.

To help avoid confusion on the status, the following is hopefully helpful:

Version name Status Proposal revision Supported by Encryption scheme Discovery of support Proof-of-MSC implementation status
2025 MSC is feature complete and being reviewed Diff to 2024 version latest No production implementations. Experimental feature in Synapse. HPKE Discovery using GET /_matrix/client/v1/rendezvous Fully implemented (see below)
2024 Feature complete, but will be superseded by a new version 87f8317 Experimental feature in Synapse. Supported by Element Web/Desktop to generate QR. Supported by Element X to scan QR to login. ECIES unstable_features.org.matrix.msc4108 is true in /versions response from homeserver Fully implemented (see below)

Proof-of-MSC implementations

2025 version

Flows implemented

Flow Existing device New device
Existing device generates QR to sign in a new device EW or EX EX
Existing device scans QR to sign in a new device EX EW

2024 version

Implementations for 2024 version:

MSC4108 Element X-Web iOS demo

To-dos

The high-level to-do list for the latest version:

  • Update rendezvous session API to avoid issues with ETags
  • Update rendezvous session API so that stylistically it fits better with C-S API
  • Allow rendezvous session creation to require authentication
  • Replace ECIES with HPKE in secure channel
  • Revisit QR code format
  • Proof-of-MSC implementations for all of above
  • Review thread about sequence of protocol_accepted
  • Provide a discovery mechanism that works once the proposal is stabilised

@hughns hughns changed the title Mechanism to allow OIDC sign in and E2EE set up via QR code MSC4108: Mechanism to allow OIDC sign in and E2EE set up via QR code Feb 22, 2024
@turt2live turt2live added proposal A matrix spec change proposal. Process state. A-Client Server Client-Server API kind:core MSC which is critical to the protocol's success needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. labels Feb 22, 2024
@cyrneko

cyrneko commented Feb 22, 2024

Copy link
Copy Markdown

finally, it is no longer just an idea presented at FOSDEM 🥳

@ara4n

ara4n commented Feb 22, 2024

Copy link
Copy Markdown
Member

tbf there was already MSC3906 - which this will presumably replace, by making it play nice with native OIDC (MSC3861) :)

@hughns hughns force-pushed the element-hq/oidc-qr-login branch from 5cd815f to 177a2db Compare April 3, 2024 15:58
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
@turt2live turt2live added the 00-weekly-pings Tracking for weekly pings in the SCT office. 00 to make it first in the labels list. label May 20, 2026
@turt2live turt2live moved this from Proposed for FCP readiness to Ready for FCP ticks in Spec Core Team Workflow May 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mscbot concern Dependency on MSC4388 outstanding

@mscbot mscbot added the unresolved-concerns This proposal has at least one outstanding concern. Process state. label May 20, 2026

@richvdh richvdh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally this seems like an excellent, well-written proposal. I particularly appreciated the separate "Message reference" section as a way to separate the protocol object definitions from the description of the flow.

Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated

@richvdh richvdh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM other than some minor points of clarification.

Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Comment thread proposals/4108-oidc-qr-login.md Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

00-weekly-pings Tracking for weekly pings in the SCT office. 00 to make it first in the labels list. A-Client Server Client-Server API disposition-merge Process state. kind:core MSC which is critical to the protocol's success proposal A matrix spec change proposal. Process state. proposed-final-comment-period Currently awaiting signoff of a majority of team members in order to enter the FCP. Process state. unresolved-concerns This proposal has at least one outstanding concern. Process state.

Projects

Status: Ready for FCP ticks

Development

Successfully merging this pull request may close these issues.