thunderbird / thunderbird/thunderbird-android
PGP decryption fails when message is encrypted to anonymous recipient
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 14k
- Forks
- 2.8k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 57
Description
Given a message like this
$ LANG=C gpg --batch --list-packets test.gpg
gpg: using "XXXXXXXX" as default secret key for signing
gpg: anonymous recipient; trying secret key XXXXXXXXXXXXXXXX ...
gpg: okay, we are the anonymous recipient.
gpg: encrypted with 4096-bit RSA key, ID XXXXXXXXXXXXXXXX, created 2099-99-99
"John Doe <john@doe.invalid>"
gpg: encrypted with ELG key, ID 0000000000000000
where I am the undisclosed recipient (key-ID 0), but also encrypted to the disclosed key-ID of the sender (John Doe in this example), k-9 mail fails to decrypt the message.
It requests the private key for "John Doe" from OpenKeychain.
Expected behavior on a message encrypted to key-ID 0 would be to just try whatever private keys are available.
It looks like Thunderbird creates such messages.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with the provided gpg --batch --list-packets example, then trace how K-9 Mail handles the anonymous recipient and requests keys from OpenKeychain. Done means messages encrypted to key-ID 0 are attempted with available private keys, including when another disclosed recipient is present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100