Failure to decrypt file, encrypted with multiple passwords
Closed, WontfixPublic
Actions

Assigned To

Authored By

	onickolay
	Feb 15 2018, 12:33 PM

Description

If file is encrypted to multiple passwords then GnuPG seems to fail to decrypt it using the second password.
However this works fine if AEAD encryption is used.
Encrypted test files are attached.

Details

Version: 24ae5af

Revisions and Commits

rG GnuPG
	rGb4599a0449ea gpg: Allow decryption using several passphrases in may cases.
	rGcbc7bacf2ff9 gpg: Try to mitigate the problem of wrong CFB symkey passphrases.

Related Objects

Mentioned In: T4050: GnuPG fails to decrypt file encrypted with more than one password with any password but the first

Event Timeline

hello.txt14 BDownload

hello.txt.cfb173 BDownload

hello.txt.aead248 BDownload

Please see the original file (hello.txt), CFB-encrypted to two passwords (hello.txt.cfb), and AEAD-encrypted (hello.txt.aead).
Passwords used are '1' and '2'.

• werner added a commit: rGcbc7bacf2ff9: gpg: Try to mitigate the problem of wrong CFB symkey passphrases..Feb 23 2018, 10:56 AM

With AEAD we can immediately check whether the correct passphrase is used. With CFB we can't do that and thus the checking is delayed until we can do the bulk encryption using the session key. At that point it is too late to check for other keys - well we could record that all and try again but that would make the code pretty complicate.

I implemented a basic check for wrong passphrase in CFB mode which should have a 95% chance of catching them: The algo byte in the symkey plaintext is checked to be a valid OpenPGP algo. I close this bug as wontfix and hope that we can soonish move to AEAD.

• werner mentioned this in T4050: GnuPG fails to decrypt file encrypted with more than one password with any password but the first.Jul 6 2018, 8:37 AM

• werner added a commit: rGb4599a0449ea: gpg: Allow decryption using several passphrases in may cases..Jul 6 2018, 8:38 AM

Argh, sorry for bugging. Clearing comment out - I simply missed fact that my tests are run with random messages, so with 5% probability another password will be interpreted as 'good' for the first SKESK.