feat: add Pki Environment API #1752

fewerner · 2026-01-16T12:21:35Z

What's new in this PR

This PR adds a new PkiEnvironment to the API and decouples some pki related things from the mls session.

PR Submission Checklist for internal contributors

The PR Title
- conforms to the style of semantic commits messages¹ supported in Wire's Github Workflow²
- contains a reference JIRA issue number like SQPIT-764
- answers the question: If merged, this PR will: ... ³

https://sparkbox.com/foundry/semantic_commit_messages
https://github.com/wireapp/.github#usage
E.g. feat(conversation-list): Sort conversations by most emojis in the title #SQPIT-764.

github-actions · 2026-01-16T12:26:19Z

Bencher Report

Branch	felix/feat/pki-environment
Testbed	ubuntu-latest

⚠️ WARNING: No Threshold found!
Without a Threshold, no Alerts will ever be generated.
Latency (nanoseconds (ns))
Click here to create a new Threshold
For more information, see the Threshold documentation.
To only post results if a Threshold exists, set the --ci-only-thresholds flag.

Click to view all benchmark results

Benchmark	Latency	microseconds (µs)
Commit add f(group size)/cs1/mem/1002	📈 view plot ⚠️ NO THRESHOLD	15,729.00 µs
Commit add f(group size)/cs1/mem/2	📈 view plot ⚠️ NO THRESHOLD	671.58 µs
Commit add f(group size)/cs1/mem/202	📈 view plot ⚠️ NO THRESHOLD	3,895.80 µs
Commit add f(group size)/cs1/mem/402	📈 view plot ⚠️ NO THRESHOLD	6,916.40 µs
Commit add f(group size)/cs1/mem/602	📈 view plot ⚠️ NO THRESHOLD	10,524.00 µs
Commit add f(group size)/cs1/mem/802	📈 view plot ⚠️ NO THRESHOLD	13,071.00 µs
Commit add f(number clients)/cs1/mem/1002	📈 view plot ⚠️ NO THRESHOLD	983,680.00 µs
Commit add f(number clients)/cs1/mem/2	📈 view plot ⚠️ NO THRESHOLD	697.48 µs
Commit add f(number clients)/cs1/mem/202	📈 view plot ⚠️ NO THRESHOLD	79,290.00 µs
Commit add f(number clients)/cs1/mem/402	📈 view plot ⚠️ NO THRESHOLD	216,000.00 µs
Commit add f(number clients)/cs1/mem/602	📈 view plot ⚠️ NO THRESHOLD	422,970.00 µs
Commit add f(number clients)/cs1/mem/802	📈 view plot ⚠️ NO THRESHOLD	677,310.00 µs
Commit pending proposals f(group size)/cs1/mem/1002	📈 view plot ⚠️ NO THRESHOLD	113,510.00 µs
Commit pending proposals f(group size)/cs1/mem/2	📈 view plot ⚠️ NO THRESHOLD	22,634.00 µs
Commit pending proposals f(group size)/cs1/mem/202	📈 view plot ⚠️ NO THRESHOLD	40,990.00 µs
Commit pending proposals f(group size)/cs1/mem/402	📈 view plot ⚠️ NO THRESHOLD	56,439.00 µs
Commit pending proposals f(group size)/cs1/mem/602	📈 view plot ⚠️ NO THRESHOLD	75,572.00 µs
Commit pending proposals f(group size)/cs1/mem/802	📈 view plot ⚠️ NO THRESHOLD	91,966.00 µs
Commit pending proposals f(pending size)/cs1/mem/1	📈 view plot ⚠️ NO THRESHOLD	15,443.00 µs
Commit pending proposals f(pending size)/cs1/mem/101	📈 view plot ⚠️ NO THRESHOLD	112,150.00 µs
Commit pending proposals f(pending size)/cs1/mem/21	📈 view plot ⚠️ NO THRESHOLD	32,745.00 µs
Commit pending proposals f(pending size)/cs1/mem/41	📈 view plot ⚠️ NO THRESHOLD	53,879.00 µs
Commit pending proposals f(pending size)/cs1/mem/61	📈 view plot ⚠️ NO THRESHOLD	73,469.00 µs
Commit pending proposals f(pending size)/cs1/mem/81	📈 view plot ⚠️ NO THRESHOLD	92,843.00 µs
Commit remove f(group size)/cs1/mem/1002	📈 view plot ⚠️ NO THRESHOLD	9,861.20 µs
Commit remove f(group size)/cs1/mem/2	📈 view plot ⚠️ NO THRESHOLD	525.22 µs
Commit remove f(group size)/cs1/mem/202	📈 view plot ⚠️ NO THRESHOLD	1,965.90 µs
Commit remove f(group size)/cs1/mem/402	📈 view plot ⚠️ NO THRESHOLD	3,562.60 µs
Commit remove f(group size)/cs1/mem/602	📈 view plot ⚠️ NO THRESHOLD	5,568.30 µs
Commit remove f(group size)/cs1/mem/802	📈 view plot ⚠️ NO THRESHOLD	7,439.60 µs
Commit remove f(number clients)/cs1/mem/1002	📈 view plot ⚠️ NO THRESHOLD	13,161.00 µs
Commit remove f(number clients)/cs1/mem/2	📈 view plot ⚠️ NO THRESHOLD	134,930.00 µs
Commit remove f(number clients)/cs1/mem/202	📈 view plot ⚠️ NO THRESHOLD	111,150.00 µs
Commit remove f(number clients)/cs1/mem/402	📈 view plot ⚠️ NO THRESHOLD	86,343.00 µs
Commit remove f(number clients)/cs1/mem/602	📈 view plot ⚠️ NO THRESHOLD	62,549.00 µs
Commit remove f(number clients)/cs1/mem/802	📈 view plot ⚠️ NO THRESHOLD	37,584.00 µs
Commit update f(group size)/cs1/mem/1002	📈 view plot ⚠️ NO THRESHOLD	135,310.00 µs
Commit update f(group size)/cs1/mem/2	📈 view plot ⚠️ NO THRESHOLD	681.58 µs
Commit update f(group size)/cs1/mem/202	📈 view plot ⚠️ NO THRESHOLD	27,871.00 µs
Commit update f(group size)/cs1/mem/402	📈 view plot ⚠️ NO THRESHOLD	55,153.00 µs
Commit update f(group size)/cs1/mem/602	📈 view plot ⚠️ NO THRESHOLD	82,744.00 µs
Commit update f(group size)/cs1/mem/802	📈 view plot ⚠️ NO THRESHOLD	108,640.00 µs

🐰 View full continuous benchmarking report in Bencher

fewerner · 2026-01-16T15:46:54Z

Except for vergen making problems with building, this is now only missing the swift test and support for the pki environment constructor in swift.

For that we want to add a db.getLocation() function to the public api, then remove the swift database wrapper.

coriolinus

Lots of comments, but most of them are nits. Great work!

I do think we should discuss whether the database instances can actually be independent or not. If they can't--as I now kind of think--then we might not need to keep track of a separate PKI DB after all. But if they can, then we might need more work in that case also:

a migrate_pki_data_to_new_database to be called once ever to move existing data from the old DB to the new
separate migrations for the new DB

crypto/src/e2e_identity/pki_env.rs

coriolinus · 2026-01-20T08:45:58Z

crypto/src/e2e_identity/pki_env.rs

+    /// Only used to authenticate with the user's identity provider
+    async fn authenticate(&self, idp: String, key_auth: String, acme_aud: String) -> OAuthResponse;
+
+    /// Only used for DPoP challenge
+    async fn fetch_backend_access_token(&self, dpop: String) -> String;


Could you expand on the doc-comments for these methods a little? Could be I just don't have the right mental context right now, but if I were an implementer looking at this documentation I'd have a hard time figuring out what I was supposed to make these methods do.

crypto/src/transaction_context/mod.rs

coriolinus · 2026-01-20T09:32:09Z

crypto/src/transaction_context/e2e_identity/init_certificates.rs

+            "Getting PKI environment from transaction context",
+        ))?;
+
+        let database = pki_environment.database();


I think that even though we've documented that the PKI environment database is theoretically independent of the CC database, it's not, because OpenMLS is still doing PKI things with the CC database. Which means that if we start doing updates to some independent PKI database while OpenMLS is still looking at the CC databse for PKI stuff, everything seems likely to explode.

The simplest resolution to all this is to just remove the documentation that the PKI environment can be an independent database.

crypto-ffi/src/pki_environment.rs

crypto-ffi/src/core_crypto/e2ei/mod.rs

crypto-ffi/bindings/jvm/src/test/kotlin/com/wire/crypto/E2EITest.kt

crypto/src/e2e_identity/pki_env.rs

istankovic · 2026-01-22T10:45:25Z

Commit 6557504 says:

feat: add pki environment to transaction context

When initializing the mls session we need to know if a pki environment
is set.  [...]

Why do we need to know if the PKI env is set during MLS session init?

crypto/src/e2e_identity/pki_environment_hooks.rs

crypto/src/transaction_context/mod.rs

crypto-ffi/src/core_crypto/e2ei/mod.rs

crypto-ffi/src/core_crypto_context/e2ei.rs

crypto-ffi/src/pki_environment.rs

fewerner · 2026-01-22T11:31:59Z

Commit 6557504 says:
feat: add pki environment to transaction context

When initializing the mls session we need to know if a pki environment
is set.  [...]
Why do we need to know if the PKI env is set during MLS session init?

OpenMls requires us to have a PkiEnvironmentProvider as part of the MlsProvider held by the session. For that reason, we share this provider between the new PkiEnvironment type and the sessions MlsProvider so that they both point to the same instance. This sharing happens during construction of the PkiEnvironment or Session, depending on which has been initialized first.

crypto-ffi/src/pki_environment.rs

crypto-ffi/bindings/js/test/wdio/e2ei.test.ts

crypto-ffi/src/pki_environment.rs

When initializing the mls session we need to know if a pki environment is set. If set we need to share the PkiEnvironmentProvider with the session during mlsInit. Therefore, the transaction context needs to know the pki environment.

If a mls session is initalized after a PKI environment was set then we need to get the PkiEnvironmentProvider's reference into the MlsCryptoProvider. If the PKi environment was not set before we will take a default and update it whenever the PKI is set through CC.

Interactions with the pki happen in a transaction context. We need these getters and the update function to alter the pki environment from the transaction context.

This getter allows us to get the pki environment from the inner transaction context assuming it was set before.

Idb doesn't close the database on drop. Since the pki database can be different from the cc database we close it explicitly on cc close. In case it is the same database this call is idempotent.

We still can't fix these without further refactoring. See WPB-22861

This allows us to translate the callback trait between ffi and core similar to mls transport.

If it was possible to include them, we'd like to, but the generated typescript module doesn't export them.

fewerner force-pushed the felix/feat/pki-environment branch from e9881d2 to 0e441d8 Compare January 16, 2026 14:26

fewerner changed the title ~~Felix/feat/pki environment~~ feat: add Pki Environment API Jan 16, 2026

fewerner force-pushed the felix/feat/pki-environment branch from 0e441d8 to a10d72d Compare January 16, 2026 15:05

fewerner force-pushed the felix/feat/pki-environment branch 4 times, most recently from a1eae2c to 1e65cdf Compare January 19, 2026 17:19

fewerner marked this pull request as ready for review January 19, 2026 17:49

fewerner requested a review from a team January 19, 2026 17:49

coriolinus reviewed Jan 20, 2026

View reviewed changes

fewerner force-pushed the felix/feat/pki-environment branch 4 times, most recently from 3427fc5 to 7eaa100 Compare January 21, 2026 11:31

coriolinus reviewed Jan 22, 2026

View reviewed changes

crypto/src/e2e_identity/pki_env.rs Outdated Show resolved Hide resolved

fewerner force-pushed the felix/feat/pki-environment branch 2 times, most recently from 1c5757e to fc0e6fc Compare January 22, 2026 09:40