Incorrectly encrypting long messages when manually including self in "To" field
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
Problem:
This is an issue that causes Saltpacks to not be able to be decrypted by the desired individuals when the original message being encrypted is too long.
I found this while trying to send a long message to a coworker. Our workflow involves encrypting a command I need them to run (which may contain secret information), sending them the Saltpack over Slack, and having them decrypt the message and run the command.
Enviornment:
Hardware: MacBook Pro (16-inch 2019) Intel Core i7 processor.
Operating System: MacOS Monterey 12.4
Keybase Version: keybase version 6.0.1-20220609162338+0fc9feea3d
Recreate:
- Create a long message, I used a message 6129 characters long.
- Set the "To" field to be BOTH your coworker and yourself.
- Encrypt the message.
- Send them the Saltpack. They are unable to decrypt it, and get an error that "This message was encrypted for someone else or for a key you don't have."
Work Around
- If you instead set the "To" field to JUST your coworker and use the "Include yourself" checkbox, then your coworker will be able to decrypt the Saltpack without issue.
- Or just send smaller messages, as this issue does not occur for messages of length 11 characters (I did not investigate to find at what size the issue first begins, just these two extremes of a very short vs a long message).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file, test, or entry point is named. Start by reproducing the failure with a 6129-character message, comparing manually listing yourself in To with using the Include yourself checkbox. Done means both recipient configurations produce Saltpacks the intended coworker can decrypt.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100