{"record":{"id":"887affba3e3bb503","repo":"rustdesk/rustdesk","slug":"webrtc-peer-identity-could-not-be-verified-refusi","errorCode":null,"errorMessage":"WebRTC peer identity could not be verified (refusing unbound channel)","messagePattern":"WebRTC peer identity could not be verified \\(refusing unbound channel\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/client.rs","lineNumber":1678,"sourceCode":"                                    create_symmetric_key_msg(their_pk_b);\n                                let mut msg_out = Message::new();\n                                msg_out.set_public_key(PublicKey {\n                                    asymmetric_value,\n                                    symmetric_value,\n                                    ..Default::default()\n                                });\n                                timeout(CONNECT_TIMEOUT, conn.send(&msg_out)).await??;\n                                conn.set_key(key);\n                            } else {\n                                if is_webrtc {\n                                    bail!(\"WebRTC handshake id mismatch (possible MITM)\");\n                                }\n                                log::error!(\"Handshake failed: sign failure\");\n                                conn.send(&Message::new()).await?;\n                            }\n                        } else {\n                            if is_webrtc {\n                                bail!(\"WebRTC peer identity could not be verified (refusing unbound channel)\");\n                            }\n                            // fall back to non-secure connection in case pk mismatch\n                            log::info!(\"pk mismatch, fall back to non-secure\");\n                            let mut msg_out = Message::new();\n                            msg_out.set_public_key(PublicKey::new());\n                            conn.send(&msg_out).await?;\n                        }\n                    } else {\n                        if is_webrtc {\n                            bail!(\"WebRTC handshake received an unexpected message type\");\n                        }\n                        log::error!(\"Handshake failed: invalid message type\");\n                        conn.send(&Message::new()).await?;\n                    }\n                } else {\n                    if is_webrtc {\n                        bail!(\"WebRTC handshake received a malformed message\");\n                    }","sourceCodeStart":1660,"sourceCodeEnd":1696,"githubUrl":"https://github.com/rustdesk/rustdesk/blob/91c9fccbb0f7bfe5f11644d5fbdec9b23fa10540/src/client.rs#L1660-L1696","documentation":"In secure_connection(), if the SignedId payload cannot be decoded/verified under the trusted signing key (the outer `else` of the decode), a non-WebRTC transport falls back to a non-secure connection. A WebRTC transport cannot safely do that without identity binding, so it refuses the unbound channel and raises this error instead.","triggerScenarios":"`is_webrtc` is true and `decode_id_pk_dtls(&si.id, &sign_pk)` failed (or an earlier arm left identity unverified) — the peer's signed identity blob did not verify under the configured rs_pk/sign_pk.","commonSituations":"Client key mismatch with the server's signing key; corrupted SignedId payload from a relay; peer running incompatible crypto or a tampered server; MITM replacing the SignedId blob.","solutions":["Align the client's configured `key` with the server's actual signing public key","Upgrade the remote peer/client to compatible versions so SignedId verifies","Verify rendezvous/relay infrastructure integrity (tampering produces unverifiable blobs)","Retry after server key rotation completes on both ends"],"exampleFix":"// before\n--key <stale-key>\n// after\n--key <current server signing key> // SignedId then verifies and WebRTC channel is bound","handlingStrategy":"try-catch","validationCode":"// pre-check that a signing key is configured so SignedId can verify\nif get_rs_pk(key).is_none() {\n    eprintln!(\"No valid signing key: WebRTC identity verification will refuse the channel\");\n}","typeGuard":null,"tryCatchPattern":"match Client::connect(...).await {\n    Err(e) if e.to_string().contains(\"peer identity could not be verified\") => {\n        // fix key config / versions before retrying\n    }\n    r => r?,\n}","preventionTips":["Keep the client `key` equal to the server's signing public key","Upgrade both endpoints in lockstep to keep crypto compatible","Audit relay infrastructure for tampering if failures persist"],"tags":["security","webrtc","handshake","verification"],"backgroundTag":"authentication-required","analyzedSha":"91c9fccbb0f7bfe5f11644d5fbdec9b23fa10540","analyzedAt":"2026-09-10T19:53:44.083Z","contentChangedAt":"2026-09-10T19:53:44.083Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}