Maniphest T8549

Import of S/MIME certificate fails because of "password too long"
Open, Needs TriagePublic
Actions

Assigned To
None
Authored By
• ikloecker
Tue, Nov 10, 9:05 AM
Tags
Subscribers
• ikloecker

Description

This was reported for Gpg4win 5.1.0 at https://bugs.kde.org/show_bug.cgi?id=527885

DESCRIPTION
I created a certificate (‘digital ID’) in Adobe Acrobat in .pfx format with a password and saved it locally (not in the Windows certificate store). The password worked when I used it to sign and certify the PDF file in Adobe. But when I tried to import the .pfx file to Kleopatra it says the password was incorrect.

STEPS TO REPRODUCE
(0. Create digital ID with Adobe Acrobat in .pfx format)

  1. Import
  2. Select .pfx file
  3. Enter password

OBSERVED RESULT
Error message that the pw was incorrect.

EXPECTED RESULT
Successul import of file.

SOFTWARE/OS VERSIONS
Operating System (available in the Info Center app, or by running kinfo in a terminal window): Windows 11 Version 26H2
KDE Plasma Version: ?
KDE Frameworks Version: 6.20.0
Qt Version: 6.10.1

ADDITIONAL INFORMATION
Kleopatra: Gpg4win-5.1.0
Kleopatra: d0f98df6bab59519ffd9652ed88b11338677526e
GnuPG: 2.5.21
Libgcrypt: 1.12.2
KDE Frameworks: 6.20.0
Qt: 6.10.1 wird verwendet und gebaut wurde mit 6.10.1
Windows 11 Version 26H2
Build ABI: x86_64-little_endian-llp64
Kernel: winnt 10.0.26300

Details

External Link
https://bugs.kde.org/show_bug.cgi?id=527885
Version
Gpg4win 5.1.0

Related Objects

Event Timeline

• ikloecker created this task.Tue, Nov 10, 9:05 AM
• ikloecker added a comment.EditedTue, Nov 10, 9:09 AM

Looks like gpgsm considers the password too long:

echo 'fWQ%kCHFb2D40GasQHOi7V*BF2Nae8b$oYH^447zol^a%m0YdZAb2RGVf5PqrfJnyeTT%g$1Vp7&AB#q2kzDOxMjEIzloLDJDbil1P70PWzwVsmXc9C0Qv75^EXQ&4nG' | gpgsm --batch --pinentry-mode loopback --passphrase-fd 0 --import JohnDoe.pfx 
gpgsm: password too long

Looking at the source code it seems that gpgsm supports at most 31 characters.

There are two things that should probably be changed in gpgsm:

  • gpgsm should emit a password too long error status so that Kleopatra can show a better error than "Bad passphrase". Currently, gpgsm emits [GNUPG:] ERROR import.parsep12 11.
  • gpgsm should probably support longer passwords; it seems the restriction to 31 characters exists at least since CVS times.
• ikloecker added a comment.Tue, Nov 10, 9:14 AM

It's also a bit strange that gpgsm tries to decrypt the certificate with 10+ different encoding although the password is too long so that decryption is guaranteed to fail.