Cant transfer Autocrypt key (Enigmail -> Deltachat)
OpenPGP addon for Mozilla Thunderbird
Brought to you by:
pbrunschwig
Menu
▾
▴
#772 Cant transfer Autocrypt key (Enigmail -> Deltachat)
wont-fix
nobody
None
2.0
Major
52.6.0 (64-Bit)
2.1.11
Linux
---
nobody
2018-08-11
2018-03-27
No
i already raised a ticket at the deltachat bugtracker
so i just paste the current findings:
> ....sucessfully transfered the key via autocrypt from deltachat 0.10 to enigmail 1.9 weeks before. now i want to transfer the key back to deltachat....
>
> deltachat 0.16.0
> enigmail 2.0
>
> Steps to reproduce the problem
>
> *enigmail 2.0 on Debian Thunderbird
> *send key via autocrypt (doesnt matter if you set a password to the key or not)
> *insert setup code
> *-> invalid setup code
i can confirm this bug.
@g6094199 can you please have a look a the content of the message sent by Thunderbird in Thunderbird > View source - in my test, the mail was way too short, sth like:Message-Id: UalrEpOjoB9Y4A4sX110OZwkZDZ-enigmail
Date: Tue, 27 Mar 2018 13:15:44 GMT
To: ...
From: ...
Autocrypt-Setup-Message: v1
Subject: Autocrypt-Einrichtungsnachricht
Content-type: multipart/mixed; boundary="oUCdP1yLBMfYlR3bpp0xmG3Eiknp6MD5n"--oUCdP1yLBMfYlR3bpp0xmG3Eiknp6MD5n
Content-Type: text/plainDiese Nachricht enthält alle Informationen, um Ihre Autocrypt-Einstellungen zusammen mit Ihrem geheimen Schlüssel sicher von Ihrem Originalgerät zu übertragen.
Um Ihr neues Gerät für Autocrypt einzurichten, folgen Sie bitte den Anweisungen, die von Ihrem neuen Gerät angezeigt werden sollten.
Sie können diese Nachricht behalten und als Sicherungskopie für Ihren geheimen Schlüssel verwenden. Wenn Sie das tun möchten, sollten Sie das Passwort notieren und es sicher verwahren.
--oUCdP1yLBMfYlR3bpp0xmG3Eiknp6MD5n
Content-Type: application/autocrypt-setup
Content-Disposition: attachment; filename="autocrypt-setup-message.html"
Dies ist die Autocrypt-Einrichtungsdatei, die für die Übertragung von Einstellungen und Schlüsseln zwischen Clients verwendet wird. Sie können sie mit dem Einrichtungscode entschlüsseln, den Sie auf Ihrem alten Gerät finden, und dann den enthaltenen Schlüssel in Ihren Schlüsselbund importieren.
-----BEGIN PGP MESSAGE-----
Passphrase-Format: numeric9x4
Passphrase-Begin: 19wy4ECQMI/0pC+95jpBFg6koZcZISOKVI61iy3RytXcLGvF8uiMaBEJNp0FNm
aX760joBEQw6/c5P2FU5EVn+3LIIHr0nEIhjjZKBruDI/7mGFhaDlpcqmjY3
7S0GatJUaC1aOll32kxcU3jJ
=FhgV
-----END PGP MESSAGE-----
--oUCdP1yLBMfYlR3bpp0xmG3Eiknp6MD5n--... the part between -----BEGIN PGP MESSAGE----- and -----END PGP MESSAGE----- should normally read about 100 lines ... maybe more an enigmail issue.
just trying to decrypt the message using gpg - as expected, decryption works but enigmails payload is no private key but just nothing (zero bytes)
and as the decryption does not lead to a private key, delta chat assumes a bad setup code then.
Diff:
I guess the payload could be empty if there is no suitable key for the selected account. Can you confirm that this is not the case?
Can you please attach a debug log file? See https://enigmail.net/index.php/en/faq-en?view=topic&id=15 for how to create that.
@Patrick i think, there was a key but the key seems not to to be protected by a password. Enigmail or gpg asks the "Passphrase: This key (or subkey) is not protected with a passphrase. Please enter a new passphrase to export it." If you hit "cancel" (as you do not want to add a passphrase), the Autocrypt Setup Message, the Setup Code is displayed, and encryption works - but finally, the payload is empty.
i also tries to enter a passphrase here - then the payload is not empty, however, i do not think that it is useful to protect the key to transfer by two passphases. also, delta chat does not support passphrases in keys at all, and, iirc, in general, Autocrypt encourages not to used passphrases in keys.
Btw: with my tests with the enigmail beta i could transfer keys betweend enigmail and delta without problems - of course, the keys did not had a passphrase - as the key to export here does not seem to have as well.
hth -
Björn
I see. There is not much in can do then. Gpg 2.1/2.2 always asks for a password when you export a private key. If you hit cancel, then gpg will not export the key.
The error in Enigmail is that it does not seem to check if it actually got a key from gpg, and if not continue anyhow.
I'll also check if I can convince gpg to accept a command line parameter like no-password, but I would not bet on it.
so in sumary:
this makes me curious
there should be a consensus somehow, but this should be set from the autocrypt guys IMHO.
What is the value of a pw protected key with autocrypt? is non protected autocrypt message an security impact?
Last edit: drsash 2018-03-28
If you don't want to protect the key with a password, you should not hit "Cancel" , but "OK" with an empty password. That's quite a difference.
ok, got it. but anyway it doesnt work.
Going through the code, I believe that the error happens when I'm trying to replace the armor headers of the secret key data. At least the log file tells me that the key was actually exported.
I have added more debugging info here, and created a new build.
Can I ask you to install the following build and check what happens now:
https://enigmail.net/download/nightly/enigmail-nightly-enigmail-2.0-branch-all.xpi
Ideally, I should at least get more information about what went wrong.
beside that no automessage get sent at all when u set no pw...
Last edit: drsash 2018-03-30
The log is very clear the key was not exported by GnuPG. You have to unlock your key for exporting in GnuPG. There is really nothing I can do about this.
I have a similar problem, but with a bit different situation. I have a setup with Yubikey, where subkeys keys are on smartcard and master key is not available at all.
When creating setup message, enigmail calls 'gpg ... --export-secret-keys 0xKEYID', which successfully exports some data (I'm not sure what exactly). Then delta chat obviously has problem with importing secret keys, because there are none.
I don't have a Yubikey, so I can't test anything. If you attach a debug log file, I'll be happy to analyze what's going on.
Debug log file won't tell you much. From enigmails point of view everything looks correctly. The problem is that 'gpg2 --export-secret-keys' does not complain about missing master key, nor subkeys being transferred to a smartcard.
Before doing this enigmail should check for the status of the key. For example 'gpg2 --list-secret-keys' shows:
where '#' in 'sec#' means that the master key is unusable and '>' in 'ssb>' means key is on a smartcard.
I'm sorry, but what do you expect now? Either the key is exported by GnuPG, in which case I don't see why the backup message should not contain it. Or GnuPG cannot export the secret key, in which case trying to create a Setup Message is useless because the purpose of the message is to transfer the secret key. In the latter case, I think you should get an error message already now.
gnupg exports the following stuff:
You can see that the master key has 'gnu-dummy S2K' and subkeys 'gnu-divert-to-card S2K'. These all are stubs, not actual keys.
So, after all, I'd expect to see an error message, when trying to create a setup message. The whole point of using a smartcard is to not be able to export keys. Currently enigmail only checks whether the 'gpg2 --export-secret-keys' completest successfully, which, as you can see above, it does. There needs to be an additional check to test whether there are actual keys or just stubs.