KGPG editor decrypt fails if > 3 recipients

[LanceHaverkamp]

Binary package hint: kdeutils

If a message encrypted to several recipients is pasted into (or opened in) the KGPG editor; KGPG seems to try only the first 3 keys. It asks for the password for each of the first 3 keys then fails. I believe KGPG should first determine if the the user actually has any secret keys that will decrypt the message, then ask for only the password for the correct key.

Thanks,

Lance

[LanceHaverkamp (lance-thehaverkamps)]

Version: 1.2.2 (using KDE KDE 3.5.3)
Installed from: Ubuntu Packages
OS: Linux

If a message encrypted to several recipients is pasted into (or opened in) the KGPG editor; KGPG seems to try only the first 3 keys. It asks for the password for each of the first 3 keys then fails. When you start clicking cancel to close the multiple password windows the application crashes.

I believe KGPG should first determine if the the user actually has any secret keys that will decrypt the message, then ask for only the password for the correct key.

Thanks,

Lance

[JimmyGilles (jimmygilles)]

Hello,

could you explain how I can reproduce this issue ?

I have gpg 1.4.6 and kgpg 1.2.2

I tried but can't reproduce this problem.
My steps:
- i go to the editor
- i write something
- i click "encrypt"
- i select more than 3 recipients
- there are two cases : the option "Hide user id" is selected or is not selected

First case: "Hide user id" is NOT selected
When I want to decrypt, gpg will automatically detect if I have a secret key that will decrypt the message (because all userid are stored in the encrypted message)
If I have a good key, kgpg asks me to give the password and decrypt the message.
If I don't have any key, kgpg will fail.

Second case: "Hide user id" is selected
When I want to decrypt the message, gpg will try with every secret keys in my keyring until it can decrypt the message.

Thanks

[LanceHaverkamp (lance-thehaverkamps)]

Created attachment 21516
error message

[LanceHaverkamp (lance-thehaverkamps)]

For some reason the message portion of the above attachment was discarded, here is a repost:

The behavior seems to have changed since it was first reported, something must have upgraded. Now it does appear to work sometimes. Other times kgpg correctly identifies the message as having been encrypted to my key & asks for my passphrase 3 times very quickly, without waiting for a reply. When this happens I receive the error message above (MISSING_PASSPHRASE).

When entering passphrase or closing the 3 passphrase windows, kgpg usually crashes.

I suggest you subscribe to the public PGP chat group, http://groups.yahoo.com/group/PGPNET/

You will be able to collect several examples of pgp encrypted messages that are encrypted to well over a dozen people using various OpenPGP programs. You should be able to see that some work in kgpg, but others do not. These are not bad postings...they decrypt using enigmail (and the exact same version of GnuPG).

I don't know enough what to look for, but something is different about some messages. It seems dependent on what software or settings the sender has chosen, as the same senders' messages usually (always?) crash. Certain algorithms? Certain hashes?

Thanks,

Lance

[LanceHaverkamp (lance-thehaverkamps)]

OK,

I think I've got a resolution...You're not gonna believe this:

Normally, plain text following the encrypted message is ignored; it's just left there to be read either before or after the decryption takes place.

For some reason I can't explain, the YahooGroups trailing text crashes kgpg!

the bad text follows this line & starts with some blank lines:

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/PGPNET/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/PGPNET/join
    (Yahoo! ID required)

<*> To change settings via email:
    mailto:<email address hidden>
    mailto:<email address hidden>

<*> To unsubscribe from this group, send an email to:
    <email address hidden>

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/

[JimmyGilles (jimmygilles)]

Hi, i'm not able to crash kgpg. :(

If i copy/past this encrypted message:
http://tech.groups.yahoo.com/group/PGPNET/message/14116
kgpg doesn't crash.

I have tried with some other encrypted messages.

If I add the YahooGroups trailing text, kgpg doesn't crash.

What should i do ?
Thanks :)

[LanceHaverkamp (lance-thehaverkamps)]

Created attachment 21527
this crashes kgpg from clipboard, but not from HD file.

You're right, there is more going on here than just trailing text: This
message I received today (from that same group), crashes kgpg when I click
"decrypt from keyboard" but decrypts fine when saved to hard drive and opened
from there by clicking it.
Some other messages decrypt fine using "decrypt from keyboard". Unfortunately,
I don't know if you can learn anything looking at this file, as it's not
encrypted to your key.

[LanceHaverkamp (lance-thehaverkamps)]

OK,

Regarding the http://tech.groups.yahoo.com/group/PGPNET/message/14116 text:

If save it to desktop and click to open, kgpg properly asks for my passphrase & writes a decrypted version to desktop.

However, if I highlight the message and copy to the clipboard; then right-click kgpg in the tray an choose "Decrypt Clipboard"; kgpg asks 3 times for my passphrase (quickly), then crashes.

Lance

[Jonathan Thomas (echidnaman)]

Is this still an issue in Intrepid?

[LanceHaverkamp (lance-thehaverkamps)]

No idea, haven't switched yet. And since I'm using Kubuntu & don't
trust KDE4 to be very stable yet, I may not upgrade until the next release.

Anyone else on this list know?

Lance

on 11/01/2008 07:52 PM Jonathan Thomas said the following:
> Is this still an issue in Intrepid?
>

--

Thanks!

Lance W. Haverkamp
<email address hidden>
Contact & encryption info:
http://thehaverkamps.net/?Lance:Contact_Me

<*///>< <*///>< <*///><

***
This email has been stamped using Penny Post. Stamping email helps
combat spam.
Find out more about stamping your email at: http://pennypost.sourceforge.net

[Jonathan Thomas (echidnaman)]

If you're using Hardy you could add
deb http://ppa.launchpad.net/kubuntu-members-kde4/ubuntu hardy main

to your /etc/apt/sources.list and then install kgpg-kde4, which will install kgpg-kde4 with the minimum dependencies required to run it. This way we can see if it's still a problem with the latest KDE and you don't have to upgrade your Kubuntu install/KDE.

[LanceHaverkamp (lance-thehaverkamps)]

There was a kgpg-kde4 listed in the hearty repo. I uninstalled kgpg
then installed kgpg-kde4, but every attempt to run the program returned
errors as follows:

$ kgpg-kde4
bash: kgpg-kde4: command not found
$ kgpg
bash: /usr/bin/kgpg: No such file or directory

Is there a trick I don't know?

As for the launchpad repo, That turns-out to be a whole lot of
upgrading...looks like over 20 packages. I really don't want to break
this system--this is my work box.

So, I will install VirtualBox, download the Kubuntu .iso Run it in a VM
and let you know what happens.

Thanks,

Lance

on 11/01/2008 08:20 PM Jonathan Thomas said the following:
> If you're using Hardy you could add
> deb http://ppa.launchpad.net/kubuntu-members-kde4/ubuntu hardy main
>
> to your /etc/apt/sources.list and then install kgpg-kde4, which will
> install kgpg-kde4 with the minimum dependencies required to run it. This
> way we can see if it's still a problem with the latest KDE and you don't
> have to upgrade your Kubuntu install/KDE.
>

--

Thanks!

Lance W. Haverkamp
<email address hidden>
Contact & encryption info:
http://thehaverkamps.net/?Lance:Contact_Me

<*///>< <*///>< <*///><

***
This email has been stamped using Penny Post. Stamping email helps
combat spam.
Find out more about stamping your email at: http://pennypost.sourceforge.net

[LanceHaverkamp (lance-thehaverkamps)]

This is NOT fixed in Ibex...though I'm getting slightly different error messages:

Messages encrypted to a single recipient are decrypted properly.

When I pasted a message encrypted to several people into the kgpg editor I received the following error:

gpg: unknown armor header: Charset: ISO-8859-1 gpg: unknown armor header:
Version: GnuPG v1.4.9 (MingW32) gpg: unknown armor header: Comment:
Encrypted email preferred! gpg: unknown armor header: Comment: Criptografe
seus emails! gpg: unknown armor header: Comment: Using GnuPG with Mozilla
- http://enigmail.mozdev.org gpg: gpg-agent is not available in this
session gpg: Invalid passphrase; please try again ... gpg: Invalid
passphrase; please try again ... gpg: mpi too large for this
implementation (61544 bits) gpg: no valid OpenPGP data found.

Interestingly, if I right-click the tray icon, then click decrypt clipboard, the message formatting (line wrapping) is broken. Causing a different failure.

These are all KGPG errors, as the messages decrypt properly in Thunderbird & the command line.

[Jonathan Thomas (echidnaman)]

Ok, this bug needs to be forwarded to KDE either by you for by one of the Kubuntu bug triagers.

[LanceHaverkamp (lance-thehaverkamps)]

I'll have to look into it, but I think I did way back when, and if I
recall, they marked it fixed when 4.0 released.

I'll try to check later today.

--

Thanks!

Lance W. Haverkamp
<email address hidden>
Contact & encryption info:
http://thehaverkamps.net/?Lance:Contact_Me

<*///>< <*///>< <*///><

***
This email has been stamped using Penny Post. Stamping email helps
combat spam.
Find out more about stamping your email at: http://pennypost.sourceforge.net

[Jonathan Thomas (echidnaman)]

Found the upstream bug. (Which wasn't marked fixed by the way) :)

[Harald Sitter (apachelogger)]

I am closing this report in favor of the one at bugs.kde.org since we cannot fix this kind of issue in Kubuntu alone. Please refer to the KDE bug for further discussion.

Thanks!

[Rolf Eike Beer (kde-opensource)]

Is this issue still present?

[LanceHaverkamp (lance-thehaverkamps)]

Unfortunately I can't answer that:

As most distros have gone to KDE4, I found it unusable on older, smaller video cards like gForce2 or embedded Intel video, which I have. This is compounded by Debian & Ubuntu both ditching proprietary drivers for poor substitutes, like Nouveau, which don't enable hardware acceleration. I've been stuck using gnome, against my will, for about a year now.

[Justin Zobel (justin-zobel)]

Thank you for the bug report.

As this report hasn't seen any changes in 5 years or more, we ask if you can please confirm that the issue still persists.

If this bug is no longer persisting or relevant please change the status to resolved.