Hello,
I am using password base encryption (-c) using an IBM product called Encryption Facility (EF). I have encrypted a file using EF with the following OpenPGP commands and when using Kleopatra (Version 3.1.8-gpg4win-3.1.8 on Windows 10) to perform the decryption, sometimes it works and sometimes it does not.
I encrypt the same file, with the same openPGP commands and using the same passphrase. When I decrypt this file using EF it always decrypts successfully, however with Kleopatra, a file that fails to decrypt may decrypt the next time I try to decrypt it. Or a file that successfully decrypts with Kleopatra may fail to decrypt the next time.
Here are the OpenPGP commands used for encryption:
-o '/home/suimgwy/_input.pbe'
-s2k-cipher-name AES_256
-s2k-digest-name SHA256
-s2k-mode 3
-s2k-passphrase dave
-t ISO-8859-1
-use-mdc
-c '/home/suimgwy/_input.txt'
_input.txt file contains 1 line of data: Testing using password based encryption.
When the encrypted _input.pbe file fails to decrypt, I renamed the encrypted file to: decryption.failed.pbe
These are the messages that are seen after clicking "Diagnostics"
gpg: AES256 encrypted session key
gpg: encrypted with 1 passphrase
gpg: decryption failed: No secret key
When the encrypted _input.pbe file decrypts successfully, I renamed the encrypted file to: decrypted.ok.pbe.
The file that decrypted successfully yesterday failed to decrypt once today. Here are the Diagnostic messages when it failed to decrypt:
gpg: AES256 encrypted session key
gpg: encrypted with 1 passphrase
gpg: key setup failed: Invalid key length
gpg: decryption failed: Invalid key length
Here is the --list-packets for decryption.failed.pbe
```
C:\userfiles\EF\GnuPG\>gpg --list-packets _decryption.failed.pbe
gpg: AES256 encrypted session key
gpg: encrypted with 1 passphrase
gpg: decryption failed: No secret key
# off=0 ctb=c3 tag=3 hlen=2 plen=38 new-ctb
:symkey enc packet: version 4, cipher 9, s2k 3, hash 8, seskey 192 bits
salt 65303373C42692B1, count 1507328 (167)
# off=40 ctb=d2 tag=18 hlen=2 plen=107 new-ctb
:encrypted data packet:
length: 107
mdc_method: 2
```
Here is the --list-packets for decrypted.ok.pbe
```
C:\userfiles\EF\GnuPG\pmr_michal>gpg --list-packets _decrypted.ok.pbe
gpg: AES256 encrypted session key
gpg: encrypted with 1 passphrase
# off=0 ctb=c3 tag=3 hlen=2 plen=38 new-ctb
:symkey enc packet: version 4, cipher 9, s2k 3, hash 8, seskey 192 bits
salt 5B4295D0D11177A0, count 98304 (104)
# off=40 ctb=d2 tag=18 hlen=2 plen=107 new-ctb
:encrypted data packet:
length: 107
mdc_method: 2
# off=53 ctb=cb tag=11 hlen=2 plen=72 new-ctb
:literal data packet:
mode t (74), created 1560362253, name="/home/suimgwy/_input.txt",
raw data: 42 bytes
```
I will attach both encrypted files. The password is dave. I would like to know what is wrong with the file (_decryption.failed.pbe) that fails to decrypt. You will not be able to reproduce unless you have the IBM Encryption Facility product but I can reproduce.
{F729065}
{F729064}
Thanks for looking into this!
Regards,
Dave Hilliard
dhilliar@us.ibm.com