offer to retry failed submission to Attester during setup

[sosnovsky]

I have test user with configured FlowCrypt app (for example user1@test.com).
On Settings -> Keys screen I can see Public Key, and user can send encrypted mails.

But when I try to reply to mail sent by this user I get One or more of your recipients are missing a public key error, because https://flowcrypt.com/attester/pub/user1@test.com responds with 404 error.

@tomholub do you know why it happens? Maybe I'm doing something wrong?

[github-actions]

There were 2 email addresses found in the above comment. Please:

1. Click three dots -> edit to remove the email addresses.
2. Click edited in the comment header, and click on the previous revision of the comment.
3. When viewing the old revision with an email in it, click options -> delete this revision from history.

[sosnovsky]

Or https://flowcrypt.com/attester/pub/.. endpoint works only for ...@flowcrypt.com emails, and I should manually add pub keys for other users?

[tomholub]

Could you share the actual recipient user that you are testing this with? (over email if you don't want to share here)

[sosnovsky]

Could you share the actual recipient user that you are testing this with? (over email if you don't want to share here)

Sent over email

[tomholub]

https://flowcrypt.com/attester/pub/.. generally contains public keys of all FlowCrypt users except enterprise users who use WKD. Additionally, some enterprise users have attester disabled using https://flowcrypt.com/docs/business/org-rules.html disallow_attester_search_for_domains where they either enter domains to disable, or possibly * to disable Attester search altogether.

For example, here is our own org-rules for users on flowcrypt.com domain (which is set up similar to some of our enterprise customers) https://fes.flowcrypt.com/api/v1/client-configuration?domain=flowcrypt.com (we don't happen to use the disallow_attester_search_for_domains at the moment).

But none of that explains the issue you are having.

[tomholub]

Re-reading your original issue, I understood now that the situation is:

1. set up an account A
2. send email to someone
3. someone tries to reply to email A, and cannot find your public key, because it's not on Attester

Here it is clear - there was a (possible) issue in step 1. That user's public key is supposed to be sent to Attester, but it wasn't. So it's not there.

Did you use the iOS app to set that user up? Created a new key during setup?

[sosnovsky]

Yes, I was using iOS app to setup (but it was 3-4 weeks ago), and I think previously it was working well - I was able to send encrypted emails to this account.

[tomholub]

You were most likely in SetupGenerateKeyViewController, here (but the code has changed since a few weeks ago. But the functionality shouldn't have changed):

    func setupAccount(passPhrase: String,
                      storageMethod: StorageMethod,
                      viewController: ViewController) async throws {
        let userId = try getUserId()

        try await viewController.validateAndConfirmNewPassPhraseOrReject(passPhrase: passPhrase)

        let encryptedPrv = try await core.generateKey(
            passphrase: passPhrase,
            variant: .curve25519,
            userIds: [userId]
        )
        try await backupService.backupToInbox(keys: [encryptedPrv.key], for: user)

        keyStorage.addKeys(keyDetails: [encryptedPrv.key],
                           passPhrase: storageMethod == .persistent ? passPhrase: nil,
                           source: .generated,
                           for: user.email)

        if storageMethod == .memory {
            let passPhrase = PassPhrase(
                value: passPhrase,
                fingerprintsOfAssociatedKey: encryptedPrv.key.fingerprints
            )
            passPhraseService.savePassPhrase(with: passPhrase, storageMethod: .memory)
        }

        await submitKeyToAttesterAndShowAlertOnFailure(
            email: userId.email,
            publicKey: encryptedPrv.key.public,
            viewController: viewController
        )

        // sending welcome email is not crucial, so we don't handle errors
        _ = try? await attester.testWelcome(
            email: userId.email,
            pubkey: encryptedPrv.key.public
        )
    }

This is the part that should have happened:

        await submitKeyToAttesterAndShowAlertOnFailure(
            email: userId.email,
            publicKey: encryptedPrv.key.public,
            viewController: viewController
        )

and here

    @discardableResult
    func updateKey(email: String, pubkey: String, token: String?) async throws -> String {
        let httpMethod: HTTPMetod
        let headers: [URLHeader]

        if let value = token {
            httpMethod = .post
            headers = [URLHeader(value: "Bearer \(value)", httpHeaderField: "Authorization")]
        } else {
            httpMethod = .put
            headers = []
        }

        let request = ApiCall.Request(
            apiName: Constants.apiName,
            url: urlPub(emailOrLongid: email),
            method: httpMethod,
            body: pubkey.data(),
            headers: headers
        )
        let res = try await ApiCall.asyncCall(request)
        return res.data.toStr()
    }

[tomholub]

To fix this manually, you can log into that account on browser extension, then go to settings -> additional -> Attester. There, it will allow you to re-submit the public key that's missing on Attester. (iOS app doesn't have this functionality yet)

[tomholub]

Or you could do it here from the mobile device. https://flowcrypt.com/attester/update-public-keys - paste your email and public key in (css is broken, it seems)

[tomholub]

and I think previously it was working well - I was able to send encrypted emails to this account.

I wonder if you had multiple accounts set up on a device that time? Contacts are shared across accounts after all. So if maybe one account saved its own public key into Contacts, then another account (but only on the save device) could have used it when sending?

In general, the app is not supposed to be this manual. It's all supposed to work automatically. So whenever you've followed the default steps as a user, and got yourself into a situation like that, you've likely run into some bug. It's all supposed to work smoothly.

[sosnovsky]

But I signed in with my test account on another simulator and my public key was there.

If there was error during initial public key upload then it shouldn't appear on another device, right? Or it can be stored somewhere else?

[sosnovsky]

I wonder if you had multiple accounts set up on a device that time? Contacts are shared across accounts after all. So if maybe one account saved its own public key into Contacts, then another account (but only on the save device) could have used it when sending?

Yes, I think there was second account configured on the device. Possibly it was on the same simulator where I had issues reading replies from you.

[tomholub]

But I signed in with my test account on another simulator and my public key was there.
If there was error during initial public key upload then it shouldn't appear on another device, right? Or it can be stored somewhere else?

When getting public keys of other users, the sources may be:

• FlowCrypt Attester (most common)
• WKD (if the recipient set it up, not your case)
• Manual import (someone sends you a public key and you manually import it. iOS app doesn't support this yet)
• Company-specific SKS server configured in OrgRules (not your case)

But when you're talking about your own public key, that one can be recreated/extracted from your own private key as well.

When you re-setup the account, it probably asked you for your pass phrase, which must have been the same as before. This is because it found your encrypted private key backup in inbox (we're talking about non-enterprise app behavior now). Once you gave it the pass phrase, it decrypted the private key, and it also extracted the public key from it.

I don't know, if at that point, the app saves your own extracted public key to contacts. If it did, there wouldn't be anything wrong about doing that.

[tomholub]

I don't see any code in the setup controllers that would be extracting your own public key from your private key and setting that in contacts. At least I don't see that on the iOS app. So I'm not sure how it got in your contacts before.