1 Return-Path: <public@simonhirscher.de>
\r
2 X-Original-To: notmuch@notmuchmail.org
\r
3 Delivered-To: notmuch@notmuchmail.org
\r
4 Received: from localhost (localhost [127.0.0.1])
\r
5 by olra.theworths.org (Postfix) with ESMTP id 3EEE7431FBC
\r
6 for <notmuch@notmuchmail.org>; Mon, 23 Sep 2013 16:24:16 -0700 (PDT)
\r
7 X-Virus-Scanned: Debian amavisd-new at olra.theworths.org
\r
11 X-Spam-Status: No, score=0.363 tagged_above=-999 required=5
\r
12 tests=[RDNS_DYNAMIC=0.363] autolearn=disabled
\r
13 Received: from olra.theworths.org ([127.0.0.1])
\r
14 by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024)
\r
15 with ESMTP id a5Bs8cbVvl2z for <notmuch@notmuchmail.org>;
\r
16 Mon, 23 Sep 2013 16:24:11 -0700 (PDT)
\r
17 Received: from cloudia.org (lvps176-28-19-116.dedicated.hosteurope.de
\r
19 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
\r
20 (No client certificate requested)
\r
21 by olra.theworths.org (Postfix) with ESMTPS id 60925431FB6
\r
22 for <notmuch@notmuchmail.org>; Mon, 23 Sep 2013 16:24:11 -0700 (PDT)
\r
23 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
\r
24 d=1e100.net; s=20130820;
\r
25 h=mime-version:in-reply-to:references:from:date:message-id:subject:to
\r
26 :content-type:content-transfer-encoding;
\r
27 bh=z1RLu2Zm1FYnMMxstEwHh3BXS/9pKG/AmeZn6G9+1W8=;
\r
28 b=eySy24lJM+YlprFzB1oJkmDtyXAl8f5a8Bbw1X+/lFzOvT5/SJP+IZwQFuE+gagpR/
\r
29 mf1puluJQFs7qpV10LOM0O5UEeidlYo0ozRkQrjri4ZwB56+UIiIIhHOh5SiF+1zM5QW
\r
30 5GvqpuXL2YWCvnv/yJfi6XcwbgpCoFD+gEznlYfZyFmZLcxWOaln54ahqaly1g1IJ7ry
\r
31 t+SeTVVgBgDX6fP0oI8R/ho+VtseOVE4Vegm4xbqUjB5/KWeNoZkHvovwZK9cTjCLkN5
\r
32 /A6RixmpzCBuPYc2hEN9BrLW611NtGed6zYojVkF+R7gbhYaQ/PSdcwW+8qAA48vYsDa
\r
34 X-Received: by 10.112.51.166 with SMTP id l6mr21852036lbo.5.1379978642770;
\r
35 Mon, 23 Sep 2013 16:24:02 -0700 (PDT)
\r
37 In-Reply-To: <52289D36.2060006@fifthhorseman.net>
\r
39 <CAEj42wtt9O1-k9hm9DNCh7En=b-eDYQWham5-FR-wzrt+sij+g@mail.gmail.com>
\r
40 <52289D36.2060006@fifthhorseman.net>
\r
41 From: Simon Hirscher <public@simonhirscher.de>
\r
42 Date: Tue, 24 Sep 2013 01:23:32 +0200
\r
44 <CAEj42wuNziY65Q=9cS7kJquNrmrsd91gp34b4=4xrsoBcYfZnQ@mail.gmail.com>
\r
45 Subject: Re: [BUG] Decryption fails if message was signed with an unknown key
\r
46 To: notmuch <notmuch@notmuchmail.org>
\r
47 Content-Type: text/plain; charset=UTF-8
\r
48 Content-Transfer-Encoding: quoted-printable
\r
49 X-Mailman-Approved-At: Tue, 24 Sep 2013 03:47:39 -0700
\r
50 X-BeenThere: notmuch@notmuchmail.org
\r
51 X-Mailman-Version: 2.1.13
\r
53 List-Id: "Use and development of the notmuch mail system."
\r
54 <notmuch.notmuchmail.org>
\r
55 List-Unsubscribe: <http://notmuchmail.org/mailman/options/notmuch>,
\r
56 <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>
\r
57 List-Archive: <http://notmuchmail.org/pipermail/notmuch>
\r
58 List-Post: <mailto:notmuch@notmuchmail.org>
\r
59 List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>
\r
60 List-Subscribe: <http://notmuchmail.org/mailman/listinfo/notmuch>,
\r
61 <mailto:notmuch-request@notmuchmail.org?subject=subscribe>
\r
62 X-List-Received-Date: Mon, 23 Sep 2013 23:24:16 -0000
\r
66 First of all, sorry for the delay =E2=80=93 I had locked myself out from
\r
67 everything digital to study for my exams.
\r
69 On Thu, Sep 5, 2013 at 5:03 PM, Daniel Kahn Gillmor
\r
70 <dkg@fifthhorseman.net> wrote:
\r
71 > I just tried to replicate this, and i do not see this misbehavior. I'm
\r
72 > using notmuch 0.16-1 on a debian testing/unstable system.
\r
74 I'm using notmuch 0.15.2 on Ubuntu 12.04. Maybe the bug got fixed
\r
75 somehow in the meantime? If you really can't reproduce the bug (see
\r
76 below) I will build the newest version from source (as well as send
\r
77 you the output of notmuch show --format=3Draw id:xyz@example.com |
\r
78 devel/printmimestructure).
\r
80 > A) how does it know that there was a signature if the message was
\r
81 > encrypted? normal PGP/MIME messages contain a single OpenPGP chunk that
\r
82 > contains signatures wrapped inside the encryption, so that an observer
\r
83 > can't tell whether there is a signature or not (or who made the signature=
\r
86 That's a good question. I suppose that although GnuPG successfully
\r
87 decrypts the message, notmuch somehow discards the decrypted content
\r
88 because the signature verification failed. As I said: GnuPG is
\r
89 perfectly able to decrypt the message if I do it manually.
\r
91 > B) the date of the message is the unix epoch date (1970-01-01), and the
\r
92 > date of the signature appears to be the unix epoch date as well. this
\r
93 > seems suspicious and likely to be false. how are these messages being
\r
96 I'm sorry, that was just me being ultra paranoid. :)
\r
98 > C) you appear to be using gnupg 2.0.17. the latest version of the
\r
99 > 2.0.x line of gpg is 2.0.21. maybe you can upgrade your gpg
\r
100 > installation and try again?
\r
102 > D) you have the mingw32 version of gpg. Does this mean you're running
\r
103 > notmuch on windows?
\r
105 No, as far as I can see this was the sender's GPG version. I'm using
\r
106 GnuPG 1.4.11 on Ubuntu.
\r
108 > E) i'd be curious to see what printmimestructure looks like on the
\r
109 > message in question. if you've got a decent shell and the notmuch
\r
110 > source code, you should be able to do:
\r
114 > if you can clarify any of the above, i'd appreciate it.
\r
116 > Also, if you can, you're welcome to send a signed/encrypted message
\r
117 > using the same framework that generated the problematic message directly
\r
118 > to me (my OpenPGP fingerprint is
\r
119 > 0EE5BE979282D80B9F7540F1CCD2ED94D21739E9), and i'd be happy to take a
\r
122 Well, so far the problematic messages have always come from my
\r
123 contacts, i.e. I didn't generate them myself. But I just tried out the
\r
124 following in order to reproduce the bug: I created a fresh dummy key
\r
125 pair, sent a signed and encrypted email (via Emacs'
\r
126 mml-secure-message-sign-encrypt) in the dummy's name to my regular
\r
127 email address and checked whether I could open that email. Of course I
\r
128 could =E2=80=93 because I had both, the recipient's private key (for
\r
129 decryption) and the sender's public key (for signature verification).
\r
130 Then I removed the dummy key pair from my key ring =E2=80=93 and voil=C3=A0=
\r
132 notmuch failed at decrypting the message (or at least told me there
\r
133 was a decryption error, as described in my previous mail).
\r
135 Now, in order for you to test that behavior I'm going to send you a
\r
136 signed and encrypted message because that should exactly reproduce the
\r
137 bug, as long as you don't import my key (id EBACABE5 /
\r
138 http://simonhirscher.de/public_key.asc) for signature verification.
\r
projects / notmuch-archives.git / blob