View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0010044 | Taler | exchange | public | 2025-05-28 12:37 | 2025-08-31 17:09 |
| Reporter | Florian Dold | Assigned To | Christian Grothoff | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | high | Severity | feature | Reproducibility | always |
| Status | closed | Resolution | reopened | ||
| Target Version | 1.0 stretch goals | Fixed in Version | 1.0 stretch goals | ||
| Summary | 0010044: exchange should honor Account-Owner-Pub signature when checking Account-Owner-Signature | ||||
| Description | The wallets now send the additional Account-Owner-Pub header. Instead of just verifying the signature with the target_pub (from the latest KYC auth transfer) and the latest reserve pub, the exchange should check if the Account-Owner-Pub matches any of the past reserve pubs. The header should be treated as optional for backwards compatibility. | ||||
| Tags | No tags attached. | ||||
| Which endpoint is this? GET /kyc-check/? Did you update the spec? | |
| Spec expanded in 2358790a..d74c7cc0 | |
| Fix committed to master branch. | |
| I believe a14ef50b7..ed93a77ce should address this, but didn't test -> feedback. | |
| commit cca3196ed9c61d3e3d92dcd18bea7a97d4526948 (HEAD -> master, origin/master, origin/HEAD) Author: Florian Dold <florian@dold.me> Date: Tue Jun 3 20:29:55 2025 +0200 harness: add test for exchange kyc auth Issue: https://bugs.taler.net/n/10044 | |
| According to my tests, only the last known reserve_pub for a given payto URI is accepted by the exchange as Account-Owner-Pub. Corresponding test: $ taler-harness run-integrationtests exchange-kyc-auth The test does quite a few /kyc-check requests, with and without Account-Owner-Pub. One request fails (we get 403 instead of 202), despite the client specifying an "Account-Owner-Pub" that has an incoming wire transfer. I've checked that the corresponding wire transfer is in reserves_in, so wirewatch ingested those transactions. | |
| ae9b97a43..6c9a0ce92 removes a bad memset() to zero of the account_pub and cleans up the SQL. However, the test still fails, but MUCH later, I think its the test... | |
| Eh, looks like the test is simply failing *earlier*, where the test is checking the implicit KYC auth via the last reserve_in (where the client does *not* explicitly specify the Account-Owner-Pub). | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-05-28 12:37 | Florian Dold | New Issue | |
| 2025-05-28 12:37 | Florian Dold | Status | new => assigned |
| 2025-05-28 12:37 | Florian Dold | Assigned To | => Christian Grothoff |
| 2025-05-28 16:46 | Christian Grothoff | Note Added: 0025037 | |
| 2025-05-28 17:55 | Christian Grothoff | Note Added: 0025039 | |
| 2025-05-28 17:59 | Christian Grothoff | ||
| 2025-05-28 17:59 | Christian Grothoff | Note Added: 0025040 | |
| 2025-05-28 17:59 | Christian Grothoff | Status | assigned => informing |
| 2025-05-28 17:59 | Christian Grothoff | Resolution | open => fixed |
| 2025-05-28 17:59 | Christian Grothoff | Note Added: 0025041 | |
| 2025-05-28 17:59 | Christian Grothoff | Assigned To | Christian Grothoff => Florian Dold |
| 2025-05-28 17:59 | Christian Grothoff | Status | informing => feedback |
| 2025-05-28 17:59 | Christian Grothoff | Resolution | fixed => reopened |
| 2025-06-03 18:30 | Florian Dold | Note Added: 0025111 | |
| 2025-06-03 18:37 | Florian Dold | Note Added: 0025113 | |
| 2025-06-03 18:37 | Florian Dold | Assigned To | Florian Dold => Christian Grothoff |
| 2025-06-03 18:37 | Florian Dold | Status | feedback => assigned |
| 2025-06-03 21:06 | Christian Grothoff | Note Added: 0025121 | |
| 2025-06-03 21:06 | Christian Grothoff | Assigned To | Christian Grothoff => Florian Dold |
| 2025-06-04 20:21 | Florian Dold | Note Added: 0025135 | |
| 2025-06-04 20:21 | Florian Dold | Assigned To | Florian Dold => Christian Grothoff |
| 2025-06-04 20:52 | Christian Grothoff | Status | assigned => informing |
| 2025-06-04 20:52 | Christian Grothoff | Fixed in Version | => 1.0 stretch goals |
| 2025-08-31 17:09 | Christian Grothoff | Status | informing => closed |