From b441fde2130e9a15d0f9faedae4a4d5b0d2ad080 Mon Sep 17 00:00:00 2001 From: Ravi Khadiwala Date: Mon, 27 Apr 2026 18:55:10 -0500 Subject: [PATCH] Enforce key-ids fit in a positive signed 32-bit int --- .../org/whispersystems/textsecuregcm/storage/KeyIdUtil.java | 2 +- service/src/main/proto/org/signal/chat/common.proto | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/storage/KeyIdUtil.java b/service/src/main/java/org/whispersystems/textsecuregcm/storage/KeyIdUtil.java index d83ed5767..1fd3c8324 100644 --- a/service/src/main/java/org/whispersystems/textsecuregcm/storage/KeyIdUtil.java +++ b/service/src/main/java/org/whispersystems/textsecuregcm/storage/KeyIdUtil.java @@ -5,7 +5,7 @@ package org.whispersystems.textsecuregcm.storage; public class KeyIdUtil { - public static final long MAX_KEY_ID = (1L << 32) - 1; + public static final long MAX_KEY_ID = (1L << 31) - 1; public static final long MIN_KEY_ID = 0; private KeyIdUtil(){} diff --git a/service/src/main/proto/org/signal/chat/common.proto b/service/src/main/proto/org/signal/chat/common.proto index 21981c49a..dcd34af3b 100644 --- a/service/src/main/proto/org/signal/chat/common.proto +++ b/service/src/main/proto/org/signal/chat/common.proto @@ -41,7 +41,7 @@ message EcPreKey { // A locally-unique identifier for this key, which will be provided by // peers using this key to encrypt messages so the private key can be looked // up. - uint32 key_id = 1; + int32 key_id = 1 [(require.range).min = 0]; // The public key, serialized in libsignal's elliptic-curve public key format. bytes public_key = 2 [(require.nonEmpty) = true]; @@ -51,7 +51,7 @@ message EcSignedPreKey { // A locally-unique identifier for this key, which will be provided by // peers using this key to encrypt messages so the private key can be looked // up. - uint32 key_id = 1; + int32 key_id = 1 [(require.range).min = 0]; // The public key, serialized in libsignal's elliptic-curve public key format. bytes public_key = 2 [(require.nonEmpty) = true]; @@ -64,7 +64,7 @@ message EcSignedPreKey { message KemSignedPreKey { // An locally-unique identifier for this key, which will be provided by peers // using this key to encrypt messages so the private key can be looked up. - uint32 key_id = 1; + int32 key_id = 1 [(require.range).min = 0]; // The public key, serialized in libsignal's Kyber1024 public key format. bytes public_key = 2 [(require.nonEmpty) = true];