Page MenuHome GnuPG
Create Task
Maniphest T1020

Missing secret key for OpenPGP not reported via gpgme
Closed, ResolvedPublic
Actions

Description

If the secret key is missing, this is not reported up to the user
nor the application with OpenPGP. It works with S/MIME.

How to reproduce:

echo Hi there. >hi.txt
a) encrypt towards a key where you do not have the secret key, e.g. with
gpg2 --no-options -e -r DA4A1116 hi.txt
gpgsm --no-options -e -r
9C:F8:E2:A0:0B:1E:E4:BF:02:66:2A:69:3B:85:F7:4F:46:C6:5E:78 hi.txt

hi.txt.smime

("--no-options" is to prevent also using your local key from gpg.conf or so.)

b) Try decrypting on the command line:
LANGUAGE=C gpg2 --decrypt hi.txt.gpg
gpg: encrypted with 2048-bit ELG key, ID [..]
gpg: decryption failed: No secret key

LANGUAGE=C gpgsm --no-options --decrypt hi.txt.smime
gpgsm: error decrypting session key: No such file or directory
gpgsm: decrypting session key failed: No such file or directory
gpgsm: message decryption failed: No secret key <GpgSM>

This is okay.
c) Now try via gpgme.
Using Package: python-pyme
Architecture: powerpc
Version: 0.8.1+clean-1
dpkg -l libgpgme11* gpgsm gnupg* gpg-agent
ii gnupg 1.4.9-3 GNU privacy guard - a free PGP replacement
ii gnupg-agent 2.0.11-1kk1 GNU privacy guard - password agent
ii gnupg2 2.0.11-1kk1 GNU privacy guard - a free PGP replacement
ii gpgsm 2.0.11-1kk1 GNU privacy guard - S/MIME version
ii libgpgme11 1.1.8-0kk1 GPGME - GnuPG Made Easy
ii libgpgme11-dev 1.1.8-0kk1 GPGME - GnuPG Made Easy

And the attached script.

python decryptdetails.py hi.txt.gpg
gpgme version: 1.1.8
engines:
/usr/bin/gpg2 2.0.11
/usr/bin/gpgsm 2.0.11
/usr/bin/gpgconf 2.0.11
OpenPGP True
CMS True

Trying to decrypt file 'hi.txt.gpg' using protocol 'OpenPGP' ...
Traceback (most recent call last):

File "decryptdetails.py", line 88, in <module>
  main()
File "decryptdetails.py", line 85, in main
  decryptprintdetails(filename, proto)
File "decryptdetails.py", line 50, in decryptprintdetails
  status = c.op_decrypt(cipherfile, plaintext)
File "/usr/lib/python2.5/site-packages/pyme/util.py", line 64, in _funcwrap
  "Invocation of " + name)
File "/usr/lib/python2.5/site-packages/pyme/errors.py", line 46, in

errorcheck

raise GPGMEError(retval, extradata)

pyme.errors.GPGMEError: Invocation of gpgme_op_decrypt: GPGME: Decryption
failed (7,152)

python decryptdetails.py --CMS hi.txt.smime
gpgme version: 1.1.8
engines:
/usr/bin/gpg2 2.0.11
/usr/bin/gpgsm 2.0.11
/usr/bin/gpgconf 2.0.11
OpenPGP True
CMS True

Trying to decrypt file 'hi.txt.smime' using protocol 'CMS' ...
Traceback (most recent call last):

File "decryptdetails.py", line 88, in <module>
  main()
File "decryptdetails.py", line 85, in main
  decryptprintdetails(filename, proto)
File "decryptdetails.py", line 50, in decryptprintdetails
  status = c.op_decrypt(cipherfile, plaintext)
File "/usr/lib/python2.5/site-packages/pyme/util.py", line 64, in _funcwrap
  "Invocation of " + name)
File "/usr/lib/python2.5/site-packages/pyme/errors.py", line 46, in

errorcheck

raise GPGMEError(retval, extradata)

pyme.errors.GPGMEError: Invocation of gpgme_op_decrypt: GpgSM: No secret key
(3,17)

Expectation: the OpenPGP should also end up with "No secret key".

Note there is some analysis at
https://www.intevation.de/roundup/kolab/issue3351 (Reason for decryption
problem "no secret key" not visible)
Please check it.

Details

Due Date
Apr 30 2009, 2:00 AM
Version
2.0.11

Event Timeline

bernhard added a subscriber: bernhard.Mar 24 2009, 6:22 PM

212_decryptdetails.py2 KBDownload

bernhard added projects: gnupg, Bug Report.Mar 24 2009, 6:22 PM
bernhard set Version to 2.0.11.
bernhard added a subscriber: • werner.
• werner added a comment.Mar 25 2009, 10:34 AM

Just a short hint: If you report problems with gpgme you should add the option
--status-fd 2 to the gpg or gpgsm invcation. gpgme cares only about these
status lines.

bernhard added a comment.Mar 25 2009, 2:54 PM

Thanks for the hint. Interesting enough the result is the opposite.
With gpgme for OpenPGP the no_secret key is _not_ reported,
but
LANGUAGE=C gpgsm --status-fd 2 --decrypt hi.txt.gpg
[GNUPG:] ENC_TO XYAAAAAA 16 0
[GNUPG:] NO_SECKEY XYAAAAAA
[GNUPG:] BEGIN_DECRYPTION
[GNUPG:] DECRYPTION_FAILED
[GNUPG:] END_DECRYPTION

While with gpgsm gpgme reports it correctly, but --status does not:
LANGUAGE=C gpgsm --status-fd 2 --decrypt hi.txt.gpg
[GNUPG:] DECRYPTION_FAILED

• werner added a comment.Mar 25 2009, 4:08 PM

You are using both times the same command line ?

Fixed in SVN 4968.

There are actually two places to fix it. gpg-agent needs to return NO_SECKEY
and not ENOENT and gpgsm needs to print ENC_TO and NO_SECKEY status lines. I
implemented both and the gpgme/tests/gpgsm/cms-decrypt test programs shows:

gpgme_op_decrypt: No secret key <GpgSM> (50331665)
unsupported_algorithm: [none]
wrong_key_usage: 0
file_name: [none]
recipient.status: No secret key <GPGME> (117440529)
recipient.pkalgo: 0
recipient.keyid : EBD7D8185CAD8D91

That is very similar to what gpg does. Note however that there is no keyID in
CMS messages thus we can print this info only if we have the certificate. We
could in theory use the S/N and issuer but that would need quite some changes to
gpgme.

Note that this reporting does also not work with gpg if the wildcard keyIDs are
used (-R option to gpg).

• werner added a project: Restricted Project.Mar 25 2009, 4:08 PM
bernhard claimed this task.Mar 26 2009, 8:38 AM

Arg, sorry for T1020 (bernhard on Mar 25 2009, 02:54 PM / Roundup) this was a paste and copy fault on my part.
Here again from gnupg 2.0.11 and gpgme 1.1.8 (as noted before):

gpg2 --status-fd 2 --decrypt hi.txt.gpg
[GNUPG:] ENC_TO XXX 16 0
gpg: encrypted with 2048-bit ELG key, ID ((..))
[GNUPG:] NO_SECKEY 790E5D2125DCF44C
[GNUPG:] BEGIN_DECRYPTION
[GNUPG:] DECRYPTION_FAILED
gpg: decryption failed: No secret key
[GNUPG:] END_DECRYPTION

LANGUAGE=C gpgsm --status-fd 2 --decrypt hi.txt.smime
((leavin out debugging messages for dirmngr and some of gpgsm.)
gpgsm: no key usage specified - assuming all usages
gpgsm: DBG: connection to agent established
gpgsm: no running dirmngr - starting `/usr/bin/dirmngr'
system does not support logging to a socket - using stderr
gpgsm: DBG: connection to dirmngr established

gpgsm: certificate is good

gpgsm: root certificate is good

gpgsm: validation model used: shell

gpgsm: error decrypting session key: No such file or directory
gpgsm: decrypting session key failed: No such file or directory
[GNUPG:] DECRYPTION_FAILED
gpgsm: message decryption failed: No secret key <GpgSM>

Thanks for the fix, I'll give it a spin.

• werner removed bernhard as the assignee of this task.Apr 3 2009, 9:40 AM
• werner set Due Date to Apr 30 2009, 2:00 AM.
• werner closed this task as Resolved.Jun 17 2009, 11:35 AM
• werner claimed this task.
• werner removed a project: Restricted Project.