| Summary: | Asks for all keys, when getting mails with hidden recipients | ||
|---|---|---|---|
| Product: | [Applications] kmail2 | Reporter: | Arne Babenhauserheide <arne_bab> |
| Component: | crypto | Assignee: | kdepim bugs <kdepim-bugs> |
| Status: | RESOLVED UPSTREAM | ||
| Severity: | normal | CC: | aheinecke, hauke, kdenis, sknauss |
| Priority: | NOR | ||
| Version: | 5.5.1 | ||
| Target Milestone: | --- | ||
| Platform: | unspecified | ||
| OS: | Linux | ||
| URL: | https://dev.gnupg.org/T3185 | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
|
Description
Arne Babenhauserheide
2013-11-23 18:54:48 UTC
Asking for all passwords sounds like you get mails, that hides the recipients. Please test a mail with [1] to make sure you see your keyid at the output. If you don't see your keyid at the output, gpg has to test all keys. > (it took me quite some time to track down why I have to enter my password twice, but I *think* that this is the reason) This other issue is unrelated, 'cause I use gpg without entering all passphrases everytime. Please discribe your crypto system a bit: * gpg-agent/ gpg-agent.conf * prinentry * What kind of crypto do you use S-MIME/GPG Mime/Inline [1] http://lists.gnupg.org/pipermail/gnupg-users/2011-November/043223.html (In reply to comment #0) > When I now click on one of my sent mails (or receive one of the mails - I > always BCC myself) I have to enter multiple passwords: at least one for each > key. Are that more than two keys and are you sure that you are asked the passphrase for different keys (check the pinentry message!)? Are you sure this is different from the bug you reported two weeks earlier? https://bugs.kde.org/show_bug.cgi?id=327357 (In reply to comment #0) > at least one for each key. Once for each of your keys or once for every target key? (In reply to comment #1) > If you don't see your keyid at the output, gpg has to test all keys. That doesn't make sense if his description is precise: If he hides the IDs of n recipient keys and at least two of them are his own (which are probably the last in the list) then he should have to try n-1 keys only because every key of his own could decrypt the message. Perhaps it helps to save the mail to a file, attach "strace -p $PID -f -e trace=execve" to the kmail/kontact process (in order to see the gpg calls) and then open the file. Perhaps it makes sense to add some gpg debugging capability to KMail. If it is activated all gpg calls and a copy of all used data are written to a directory. At Sat, 04 Jan 2014 08:27:02 +0000, Hauke Laging wrote: > > When I now click on one of my sent mails (or receive one of the mails - I > > always BCC myself) I have to enter multiple passwords: at least one for each > > key. > > Are that more than two keys and are you sure that you are asked the passphrase > for different keys (check the pinentry message!)? Yes, I checked that multiple times. > Are you sure this is different from the bug you reported two weeks earlier? There are two issues: Being asked for different keys and being ask twice for the same. I am not 100% sure that I did not miss a different key ID in the earlier bug, though I think it was the same (I cannot test right now: I'll only be able to access my KDE machine again in a few days). Best wishes, Arne This bug has only been reported for versions before 4.14, which have been unsupported for at least two years now. Can anyone tell if this bug still present? If noone confirms this bug for a Framework-based version of kmail2 (version 5.0 or later, as part of KDE Applications 15.12 or later), it gets closed in about three months. Please - still awnser my question: Are the recipients are hidden in the mail? This is a feature of gpg and than gpg has to test every private key ( in worst case scenario), because I can be that only the last key is the one that decrypts the email. If gpg can see the keyIds it should only ask for these keys to enter the passphrase. (In reply to Sandro Knauß from comment #7) > Please - still awnser my question: Are the recipients are hidden in the > mail? This is a feature of gpg and than gpg has to test every private key ( > in worst case scenario), because I can be that only the last key is the one > that decrypts the email. If gpg can see the keyIds it should only ask for > these keys to enter the passphrase. There are hidden recipients, yes. That might explain the issue… Sorry for being so slow to answer - and thank you for persisting! A possibility to improve this might be to first try the key for the email address with which I received the email. I cannot currently test this with a kmail based on kde5, because akonadi currently does not work at all for me (fails to start and the error logs says that all old accounts are missing). Yepp for Yepp for getting mails with hidden recipients i can confirm that. Sorry, I'm lost here. Sandro, did you mean to confirm it for a KF5 based version? If so, which one? Can you update the Version field of this bug? Otherwise: earlier this year, there was consensus on the mailing list that all 4.x PIM bugs should be closed. Do you still think that this bug should be kept alive? If you don't, please feel free to close it. Well this issue is still valid for hidden recipients on KF5 based kdepim :( I've updated the accected version to a 5 based version. The problem is intrinsic inside the hidden recipient feature - because with this feature gpg can't detect the correct key and have to test all keys. But maybe Andre can give us tips how we can use the API from gpg in a smarter way, so we can improve the situation for most cases. Maybe we should ask the user what keys should be tried. At least in my case I have often a good guess what key is the correct one... I think you may close this as "Upstream" and have an upstream report about this. GPGME / GnuPG has no way of providing something like an "suggested decryption key". Also GnuPG on the command line will ask for all keys for all recipients even if it was able to decrypt the session key already, basically showing all the Problems this report is about. Hidden Recipients is a very ugly feature and should not be used regularly. Afaik KMail sends out encrypted BCC Mails as different mails because of that uglyness. So KMail is pretty perfect that way, but can't improve over the general GnuPG behavior. I created the upstream report: https://dev.gnupg.org/T3185 IMO KMail does everything right but GnuPG's handling of hidden recipients could be improved so let's close this here. -- Off topic: While I'm commenting on a Bug from the "Rollenspieler, Spinner, Physikliebhaber, Gurpser und freiberuflicher Weltenbastler" I would like to point you to: https://debian-administration.org/users/dkg/weblog/97 Your key is part of my manual test keyring for weird keys for some years now :-P |