Your message dated Mon, 09 May 2005 19:02:52 -0400
with message-id <[EMAIL PROTECTED]>
and subject line Bug#299814: fixed in gnupg 1.4.1-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 16 Mar 2005 18:53:31 +0000
>From [EMAIL PROTECTED] Wed Mar 16 10:53:30 2005
Return-path: <[EMAIL PROTECTED]>
Received: from server.beamnet.de [62.75.155.124]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DBde6-0005n2-00; Wed, 16 Mar 2005 10:53:30 -0800
Received: from [192.168.0.7] (pD956EFAA.dip0.t-ipconnect.de [217.86.239.170])
(sasl authenticated)
by server.beamnet.de (Postfix) with ESMTP id 87A47231604C
for <[EMAIL PROTECTED]>; Wed, 16 Mar 2005 19:53:20 +0100 (CET)
Message-ID: <[EMAIL PROTECTED]>
Date: Wed, 16 Mar 2005 19:53:37 +0100
From: Thomas Viehmann <[EMAIL PROTECTED]>
Organization: beamNet
User-Agent: Debian Thunderbird 1.0 (X11/20050116)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: [EMAIL PROTECTED]
Subject: GnuPG 1.2.5 selects wrong encryption keys
X-Enigmail-Version: 0.90.0.0
X-Enigmail-Supports: pgp-inline, pgp-mime
Content-Type: multipart/mixed;
boundary="------------060809060500010402020308"
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
This is a multi-part message in MIME format.
--------------060809060500010402020308
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Package: gnupg
Version: 1.2.5-3
Severity: grave
Tags: woody, sarge, patch
Hi.
GnuPG 1.2.5 selects wrong encryption keys (e.g. for my key in the debian
keyring). Thus, data is encrypted irreversible, i.e. lost.
When discussed on debian-private in February, I was encouraged to file
this bug.
According to upstream, this is fixed by newer installments of the GnuPG
(>=1.2.7 IIRC).
Simon Richter pointed out that a fix can be found with
cvs -d :pserver:[EMAIL PROTECTED]:/cvs/gnupg login
cvs -d :pserver:[EMAIL PROTECTED]:/cvs/gnupg rdiff -u \
-D'2004/11/29' -D'2004/11/30' gnupg
The attached patch is a version of the above rdiff that cleanly applies
to debianized source of gnupg 1.2.5-3 and with it applied gnupg packages
without this bug are build.
Kind regards
T.
P.S.: I really would like to see this bug fixed on db.debian.org (or
whereever ud-mailgate runs) and would happily try to come up with a
patch for the appropriate version of gnupg if that means that I can hope
to be able to read ud-mailgate's encrypted mails.
--------------060809060500010402020308
Content-Type: text/x-patch;
name="gnupg.dont_encrypt_to_auth_key.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="gnupg.dont_encrypt_to_auth_key.diff"
diff -urN gnupg-1.2.5~/g10/getkey.c gnupg-1.2.5/g10/getkey.c
--- gnupg-1.2.5~/g10/getkey.c 2004-05-01 11:19:03.000000000 +0200
+++ gnupg-1.2.5/g10/getkey.c 2005-03-16 19:15:52.000000000 +0100
@@ -1248,6 +1248,51 @@
}
}
+static int
+parse_key_usage(PKT_signature *sig)
+{
+ int key_usage=0;
+ const byte *p;
+ size_t n;
+ byte flags;
+
+ p=parse_sig_subpkt(sig->hashed,SIGSUBPKT_KEY_FLAGS,&n);
+ if(p && n)
+ {
+ /* first octet of the keyflags */
+ flags=*p;
+
+ if(flags & 3)
+ {
+ key_usage |= PUBKEY_USAGE_SIG;
+ flags&=~3;
+ }
+
+ if(flags & 12)
+ {
+ key_usage |= PUBKEY_USAGE_ENC;
+ flags&=~12;
+ }
+
+ if(flags & 0x20)
+ {
+ key_usage |= PUBKEY_USAGE_AUTH;
+ flags&=~0x20;
+ }
+
+ if(flags)
+ key_usage |= PUBKEY_USAGE_UNKNOWN;
+ }
+
+ /* We set PUBKEY_USAGE_UNKNOWN to indicate that this key has a
+ capability that we do not handle. This serves to distinguish
+ between a zero key usage which we handle as the default
+ capabilities for that algorithm, and a usage that we do not
+ handle. */
+
+ return key_usage;
+}
+
/*
* Apply information from SIGNODE (which is the valid self-signature
* associated with that UID) to the UIDNODE:
@@ -1280,17 +1325,7 @@
uid->expiredate = sig->expiredate;
/* store the key flags in the helper variable for later processing */
- uid->help_key_usage = 0;
- p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_FLAGS, &n );
- if ( p && n ) {
- /* first octet of the keyflags */
- if ( (*p & 3) )
- uid->help_key_usage |= PUBKEY_USAGE_SIG;
- if ( (*p & 12) )
- uid->help_key_usage |= PUBKEY_USAGE_ENC;
- /* Note: we do not set the CERT flag here because it can be assumed
- * that thre is no real policy to set it. */
- }
+ uid->help_key_usage=parse_key_usage(sig);
/* ditto or the key expiration */
uid->help_key_expire = 0;
@@ -1486,16 +1521,8 @@
*/
PKT_signature *sig = signode->pkt->pkt.signature;
const byte *p;
- size_t n;
-
- p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_FLAGS, &n );
- if ( p && n ) {
- /* first octet of the keyflags */
- if ( (*p & 3) )
- key_usage |= PUBKEY_USAGE_SIG;
- if ( (*p & 12) )
- key_usage |= PUBKEY_USAGE_ENC;
- }
+
+ key_usage=parse_key_usage(sig);
p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
if ( p ) {
@@ -1831,7 +1858,6 @@
u32 keytimestamp = 0;
u32 key_expire = 0;
const byte *p;
- size_t n;
if ( subnode->pkt->pkttype != PKT_PUBLIC_SUBKEY )
BUG ();
@@ -1890,14 +1916,7 @@
sig = signode->pkt->pkt.signature;
sig->flags.chosen_selfsig=1; /* so we know which selfsig we chose later */
- p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_FLAGS, &n );
- if ( p && n ) {
- /* first octet of the keyflags */
- if ( (*p & 3) )
- key_usage |= PUBKEY_USAGE_SIG;
- if ( (*p & 12) )
- key_usage |= PUBKEY_USAGE_ENC;
- }
+ key_usage=parse_key_usage(sig);
if ( !key_usage ) { /* no key flags at all: get it from the algo */
key_usage = openpgp_pk_algo_usage ( subpk->pubkey_algo );
}
diff -urN gnupg-1.2.5~/include/cipher.h gnupg-1.2.5/include/cipher.h
--- gnupg-1.2.5~/include/cipher.h 2003-12-03 11:10:16.000000000 +0100
+++ gnupg-1.2.5/include/cipher.h 2005-03-16 19:10:05.000000000 +0100
@@ -51,6 +51,8 @@
#define PUBKEY_USAGE_SIG 1 /* key is good for signatures */
#define PUBKEY_USAGE_ENC 2 /* key is good for encryption */
#define PUBKEY_USAGE_CERT 4 /* key is also good to certify other keys*/
+#define PUBKEY_USAGE_AUTH 8 /* key is good for authentication */
+#define PUBKEY_USAGE_UNKNOWN 128 /* key has an unknown usage bit */
#define DIGEST_ALGO_MD5 1
#define DIGEST_ALGO_SHA1 2
--------------060809060500010402020308--
---------------------------------------
Received: (at 299814-close) by bugs.debian.org; 9 May 2005 23:13:27 +0000
>From [EMAIL PROTECTED] Mon May 09 16:13:27 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DVHRG-0004da-00; Mon, 09 May 2005 16:13:27 -0700
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1DVHH2-0005S6-00; Mon, 09 May 2005 19:02:52 -0400
From: James Troup <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#299814: fixed in gnupg 1.4.1-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Mon, 09 May 2005 19:02:52 -0400
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 2
Source: gnupg
Source-Version: 1.4.1-1
We believe that the bug you reported is fixed in the latest version of
gnupg, which is due to be installed in the Debian FTP archive:
gnupg_1.4.1-1.diff.gz
to pool/main/g/gnupg/gnupg_1.4.1-1.diff.gz
gnupg_1.4.1-1.dsc
to pool/main/g/gnupg/gnupg_1.4.1-1.dsc
gnupg_1.4.1-1_i386.deb
to pool/main/g/gnupg/gnupg_1.4.1-1_i386.deb
gnupg_1.4.1.orig.tar.gz
to pool/main/g/gnupg/gnupg_1.4.1.orig.tar.gz
gpgv-udeb_1.4.1-1_i386.udeb
to pool/main/g/gnupg/gpgv-udeb_1.4.1-1_i386.udeb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
James Troup <[EMAIL PROTECTED]> (supplier of updated gnupg package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 9 May 2005 23:41:50 +0100
Source: gnupg
Binary: gnupg gpgv-udeb
Architecture: source i386
Version: 1.4.1-1
Distribution: unstable
Urgency: low
Maintainer: James Troup <[EMAIL PROTECTED]>
Changed-By: James Troup <[EMAIL PROTECTED]>
Description:
gnupg - GNU privacy guard - a free PGP replacement
gpgv-udeb - minimal signature verification tool (udeb)
Closes: 299814 300859 307203
Changes:
gnupg (1.4.1-1) unstable; urgency=low
.
* New upstream release. Closes: #307203
* Fixes mis-selection of encryption key. Closes: #299814
* Countermeasures against the Mister/Zuccherato CFB attack.
Closes: #300859
* 18_ca_po_update.dpatch, 21_strgutil_update.dpatch: dropped - merged
upstream.
* debian/rules (build-deb-stamp): don't forcefully regenerate po/ca.gmo.
(clean): likewise, don't remove po/ca.gmo.
Files:
1d8bde243e7024b1cc7e137e6729881e 1304 utils standard gnupg_1.4.1-1.dsc
1cc77c6943baaa711222e954bbd785e5 4059170 utils standard gnupg_1.4.1.orig.tar.gz
cc11b349b662bf3810470e0a52ef545e 16502 utils standard gnupg_1.4.1-1.diff.gz
e92a533403a9523b92631581898f9c64 1908156 utils standard gnupg_1.4.1-1_i386.deb
1a1aaae3fbcd33fddddeed0c2d5d4cf0 129262 debian-installer extra
gpgv-udeb_1.4.1-1_i386.udeb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iQIVAwUBQn/pFtfD8TGrKpH1AQIrPA//bOtX1tDgXM1B1hK+p1WQhOshjmvS2zP2
KiEVB7jJJDnaV6eFJ2yoVlJcbFMjNt0xHktGycZq+4Yfq9XVf04S3dQ7GuYl0Ejw
bmg+s3TKOqR9nPjY0wfnd43rdxUAAg1aLzA1hsZNAQZ2AHyysG67/e7TGJOCvvSE
SB58c18/eKvuFkkIDkssxn9wsQEkbLw7V5gRnzlcH8JhKfGCvtn1Vp9aXVnCpxuJ
+oA++CxctFQ69maMMwhDSI77DwRZk6b1N6vMsLctmlV4awY7275QMJn98rHw2keL
527gPBJwKVI8xr31Y5nbfLdcm2KQUp83qv+pDcaaqOT3ZzjQa5EEla9PyfQt4tO0
QhyG70jwYZkpqztu2Epiq5ZDxMToCq/elS+p4NiqbxpNF5+hfCWInIn8Ktk9mWV2
j0SyuZxD1ZNcoU60xOdSk5X2LrHgSqVopjDr1oivT+7dvZ37/8SMprV1Gp6nkY26
6f830EulFpXSGK3msbYfTXJ2vg1i/wtaFPC/mqIbazazGUP7gWP/KHrAFiWCg/vD
oFKGgWCDtWoeYkYCS92D7D5HfuMwU8evecWWg3c1eKWeWXe7Qw73JcLueuOnaYzV
hs53u5LBtwsm40JIebsZgnpwNvrIo+ysiGAR9P/q0uPQh6pno/sU4uieVCAonUyI
HL08xa3PAzU=
=Ofao
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
