@werner I added an implementation https://dev.gnupg.org/D622
that matches Linux behavior and avoids the message about secure memory not being supported on Windows. The change is scoped to the pinentry tool and intentionally follows Linux behavior. Does this approach look reasonable to you?

I think "O" is a better key:

We need to change the accelerator. Right now gpg-agent uses

I don't think that we will implement that any time soon. Today we too often require more mlock-able memory than available and in this case Libgcrypt resorts to allocating new memory arenas which are not locked. This is not as worse as one might think: the majro advantage with secmem is that a free() on secmem allocated memory will also wipe that memory. A better solution has always been to use an encrypted swap/paging file. 25 years ago, it was not easy to configure but today there should be no problem and hopefully already the default.

While key generation works now with an expiry date up to 2106-02-04, the representation on the command line is a bit ugly.

Looks good to me on gpg4win-5.0.0 @ win11. Tested with 20 starts of each combination:

• with / without keyboxd
• quitting kleopatra / killing all processes

I think this has been resolved in Gpg4win 5.

Will be in the next release.

it does not make sense to have a workboard item for this parent ticket.

Looks good to me on gpg4win-5.0.0-beta479 @ win11:

This does not happen any more, tested with Gpg4win-5.0.0-beta479

Tested with Gpg4win-5.0.0-beta479

with Gpg4win-5.0.0-beta479 the listing after creating the new key with ADSK looks ok now:

Given that the 2.2 fix has been tested and resolved and we don't have another ticket for 2.6, we can close this one.

Note that for exploiting this bug a second preimage attack for SHA-1 is required. This kind of attack on SHA1 is not yet possible.

So why are there different grades of failure? Why is "invalid packet" a less scary error message than "WARNING: message was not integrity protected" when both are equally bad things?

Right. And the MDC detects this and only if says okay you get a good decryption status back.

This warning shall only show up if a message was really modified and not in case of

a simple truncation.

(Testing for now for better visibility. Real or Semi-real bugs with fixes are already set to Resolved)

The described attack is not easy to understand and as of today the
gpg.fail website seems to have the same content as the draft we
received on 2025-10-23. There it states:

Fixed in 2.5.16

Also fixed in the other active branches.