Odd "gpg: KEYTOCARD failed: Invalid time" error when using `--pinentry-mode=loopback`
Testing, NormalPublic
Actions

Assigned To

Authored By

	rubensayshi
	Mon, Sep 2, 10:36 AM

Description

When using --pinentry-mode=loopback for a keytocard action we're getting an odd error: "gpg: KEYTOCARD failed: Invalid time"

We're experiencing this on both MacOS and Ubuntu (5 different users so far).
I hit this myself using gpg (GnuPG) 2.4.5

It seems something "recent" (past 1~2yrs) as the script we've been using to setup our YubiKey has been untouched and working fine for ~2yrs, but in the past year more people starting hitting this issue.
I've been digging through gpg commits, but struggling to understand the code at times, I can't pinpoint anything that could be the cause...

it works fine without --pinentry-mode=loopback (but then we need to manually enter the pin a bunch of times)

There's more people hitting this (see external link to a reddit post)

Details

External Link: https://www.reddit.com/r/yubikey/comments/1b5pjzq/strange_gpg_error_when_using_keytocard/

Revisions and Commits

rG GnuPG
	rG95468f531c3b agent: Fix KEYTOCARD for the use case with loopback pinentry.
	rG5a1bf7e5524e agent: Fix KEYTOCARD for the use case with loopback pinentry.
	rG4a4c1efac59f agent: Fix KEYTOCARD for the use case with loopback pinentry.

Related Objects

Mentioned In: T7191: Release GnuPG 2.5.1

Event Timeline

rubensayshi created this task.Mon, Sep 2, 10:36 AM

y38k problems with some frontends are known for some 32 bit platforms.

Please write a proper bug report and don't expect us to read a reddit thread.

• werner added a project: Info Needed.Mon, Sep 2, 5:02 PM

I can replicate the problem.

The cause of this is that when it's comes with loopback mode, gpg-agent inquires back to the frontend and the buffer overwritten, which results parsing the line wrong.
I'm going to fix.

• gniibe added a commit: rG4a4c1efac59f: agent: Fix KEYTOCARD for the use case with loopback pinentry..Tue, Sep 3, 7:20 AM

• werner awarded a token.Tue, Sep 3, 11:02 AM

• werner edited projects, added gpgagent; removed Info Needed.Tue, Sep 3, 11:07 AM

In T7283#190901, @werner wrote:

y38k problems with some frontends are known for some 32 bit platforms.

Please write a proper bug report and don't expect us to read a reddit thread.

I'm sorry, definitely not on 32bit and the reddit link was just for reference to indicate multiple people are experiencing this.

and I'm sorry, not sure what else to provide

In T7283#190941, @gniibe wrote:

I can replicate the problem.

The cause of this is that when it's comes with loopback mode, gpg-agent inquires back to the frontend and the buffer overwritten, which results parsing the line wrong.
I'm going to fix.

awesome, let me know if you need another person to test.

• werner added a commit: rG5a1bf7e5524e: agent: Fix KEYTOCARD for the use case with loopback pinentry..Tue, Sep 3, 11:12 AM

• werner added a commit: rG95468f531c3b: agent: Fix KEYTOCARD for the use case with loopback pinentry..Tue, Sep 3, 11:14 AM

• gniibe changed the task status from Open to Testing.Wed, Sep 4, 1:34 AM

• werner mentioned this in T7191: Release GnuPG 2.5.1.Thu, Sep 12, 12:22 PM