Improving the security of the federation protocol (matrix-conf-2025)

The federation protocol is how Matrix homeservers communicate between each other. In private federations this isn't particularly challenging as the network is trusted but in the public federation this isn't true. This talk dives into what protocol improvements are in the works to make the public federation more secure against Byzantine actors, particularly against "state resets": an unintended rollback of room state. We'll explore why this problem is hard, what some of the failure modes are, and how we are working on addressing them. The federation protocol, in particular state resolution, is one of the most important parts of Matrix. In the current algorithm, the output from the algorithm can be counter-intuitive, and multiple people have tried to explain how it works (including a talk from me at FOSDEM this year!) with varying degrees of success. This behaviour sometimes rears its ugly head when your room state has rolled back to an earlier point in time for no good reason: a "state reset". Fixing these issues is hard, partly because the current algorithm is so tricky - so over the course of 2025 we’ve been working on improving and (eventually) simplifying it. Along the way, we've developed tooling to help us observe and replay room state in the form of TARDIS: Time Agnostic Room DAG Inspection Service. This tool has been critical for us to produce minimal working examples of state resets and to experiment with algorithmic changes to fix the underlying issues. We'll explore some of these scenarios in TARDIS during the talk. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://cfp.2025.matrix.org/matrix-conf-2025/talk/YK9F38/