s/mime with crypt_use_gpgme and gpgsm not working?

[Michael Tatge]

Hi,

i'm trying to run mutt with s/mime and
$crypt_use_gpgme set, but i keep running into errors when it comes to
decryption. Signing / verifying works ok.

TL;DR i cannot decrypt messages that are encrypted for me.

[-- Begin signature information --]
Good signature from:
1.2.840.113549.1.9.1=#6D69636861656C2E7461746765406D63666573732D69742E636F6D
aka: <***@XXX>
created: Wed Mar 21 12:22:08 2018
[-- End signature information --]

[-- The following data is signed --]

BUT:
[-- The following data is S/MIME encrypted --]

[-- Error: decryption failed: Invalid value passed to IPC --]


[-- End of S/MIME encrypted data --]

Sending s/mime encypted messages seems ok too.

Maybe i'm doing something wrong.

Mutt 1.9.4 (2018-02-28) (debian package from testing)
gpgsm (GnuPG) 2.2.5
libgcrypt 1.8.1
libksba 1.3.5-unknown

gpg:OpenPGP:/usr/bin/gpg
gpg-agent:Private Keys:/usr/bin/gpg-agent
scdaemon:Smartcards:/usr/lib/gnupg/scdaemon
gpgsm:S/MIME:/usr/bin/gpgsm
dirmngr:Network:/usr/bin/dirmngr
pinentry:Passphrase Entry:/usr/bin/pinentry

gpg-agent.conf:
default-cache-ttl 600
pinentry-program /usr/bin/pinentry-curses

gpgsm.conf:
default-key C1:B3:80:90:E5:8F:FE:53:8C:44:2B:70:7E:79:CD:E2:72:55:59:85
auto-issuer-key-retrieve
include-certs -1 # this will include all certificates in the chain up to the root

gpgsm --list-keys
is listing all certs including the whole ca chain

gpgsm --list-secret-keys is listing my secret key


running gpgsm manually seems to be working ok

$ echo "some text" | gpgsm --sign --armor | gpgsm --verify
gpgsm: Note: non-critical certificate policy not allowed
gpgsm: Note: non-critical certificate policy not allowed
gpgsm: DBG: adding certificates at level -1
gpgsm: signature created
gpgsm: Signature made 2018-03-21 11:09:21 using certificate ID
0x72555985
gpgsm: Note: non-critical certificate policy not allowed
gpgsm: Note: non-critical certificate policy not allowed
gpgsm: Good signature from "/EMail=***@XXX"
gpgsm: aka "***@XXX"

$ echo "some text" | gpgsm --encrypt --recipient ***@XXX --armor | gpgsm --decrypt
gpgsm: Note: non-critical certificate policy not allowed
gpgsm: Note: non-critical certificate policy not allowed
gpgsm: encrypted data created
gpgsm: DBG: recp 0 - issuer: 'CN=COMODO RSA Client Authentication and
Secure Email CA,O=COMODO CA Limited,L=Salford,ST=Greater
Manchester,C=GB'
gpgsm: DBG: recp 0 - serial: 069B11DBBF7D5819F2ED167B024F009F
some text

relevant muttrc:
unset smime_is_default
set crypt_autosmime
set crypt_use_gpgme

I'm NOT sourcing gpg.rc or smime.rc.
If I source both and unset crypt_use_gpgme
Everything is fine tough, but it uses smime_keys then.

Thanks,

Michael

[Michael Tatge]

Post by Michael Tatge
TL;DR i cannot decrypt messages that are encrypted for me.
Mutt 1.9.4 (2018-02-28) (debian package from testing)

FWIW, tested against
Mutt 1.9.4+99 (e250c602) (2018-03-15)
too. Same problem.

Michael

[Kevin J. McCarthy]

Post by Michael Tatge

Post by Michael Tatge
TL;DR i cannot decrypt messages that are encrypted for me.
Mutt 1.9.4 (2018-02-28) (debian package from testing)

FWIW, tested against
Mutt 1.9.4+99 (e250c602) (2018-03-15)
too. Same problem.

Hi Michael,

Some quick searches turned up:
https://dev.gnupg.org/T2919

The Trac ticket referenced is now at:
<https://gitlab.com/muttmua/trac-tickets/blob/master/tickets/open/3808-mutt15231_Invalid_value_passed_to_IPC.txt>

In the gnupg ticket, stbuehler pointed at a patch he sent to NeoMutt
that may help with this problem:
https://github.com/neomutt/neomutt/pull/662

If you feel comfortable patching and testing, I'd appreciate to know if
that fixes it for you. Regardless, I will take a closer look and apply
that patch myself later today.

[Kevin J. McCarthy]

Post by Kevin J. McCarthy
If you feel comfortable patching and testing, I'd appreciate to know if
that fixes it for you. Regardless, I will take a closer look and apply
that patch myself later today.

Hi Michael,

I'm attaching a patch that's just a slightly different version of the
one I mentioned. It's against stable, but should apply to master with
just a warning about a 5-line offset. If you could try it out, I'd
appreciate it.

Thank you,

[Michael Tatge]

Hi Kevin,

Post by Kevin J. McCarthy

Post by Kevin J. McCarthy
If you feel comfortable patching and testing, I'd appreciate to know if
that fixes it for you. Regardless, I will take a closer look and apply
that patch myself later today.

I'm attaching a patch that's just a slightly different version of the
one I mentioned.

seems to work. At least I can read (decrypt) the messages now.
Thanks a lot!

[-- The following data is S/MIME encrypted --]

[-- Begin signature information --]
Good signature from:
1.2.840.113549.1.9.1=#6D69636861656C2E7461746765406D63666573732D69742E636F6D
aka: <***@XXX>
created: Wed Mar 21 20:30:18 2018
[-- End signature information --]

[-- The following data is S/MIME signed --]

[Body]

[-- End of S/MIME signed data --]

[-- End of S/MIME encrypted data --]

Nice!


One minor glitch:
1. set crypt_verify_sig=ask-no

Open a s/mime signed or signed and encrypted message.
Mutt asks: "Verify PGP signature? ([no]/yes):"
Maybe we should generalize that as "Verify signature?"

Patch attached. Translations would still need to be adapted.

Post by Kevin J. McCarthy
https://dev.gnupg.org/T2919
https://github.com/neomutt/neomutt/pull/662

Oh, yes i forgot to mention outlook was involved.

Michael

[Kevin J. McCarthy]

Post by Michael Tatge
seems to work. At least I can read (decrypt) the messages now.
Thanks a lot!

Thank you for testing it out. I've pushed the fix up.

Post by Michael Tatge
1. set crypt_verify_sig=ask-no
Open a s/mime signed or signed and encrypted message.
Mutt asks: "Verify PGP signature? ([no]/yes):"
Maybe we should generalize that as "Verify signature?"

Thanks, I've made the change.