1497154 - Wrong encipherment certificate status - recipient certificate status should not be checked for signing usage, since that only concerns the sender certificate.

Status: RESOLVED FIXED

(Thunderbird :: Message Compose Window, defect)

Description

[Chris GAUDRY [:cmgaudry33]]

Attachment: msgCompSecurityInfo.js.patch

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

Steps to reproduce:

- Composing a ciphered email using valid encipherment certificates.
- Save it.
- Viewing "Security message" window.



Actual results:

All encipherment certificate statuses are "Invalid".


Expected results:

All encipherment certificate statuses should be "Valid".

Comment 1

[Chris GAUDRY [:cmgaudry33]]

Hello,

In the "Message Security" window, all the recipient's encryption certificates always have the status "Invalid", although these certificates are all valid as well as the certificate of the associated CA and that their usages include "Critical" and "Key Encryption".
Indeed, the control performed on the uses of these certificates includes signing and key encipherment, whereas it should only include encryption. The signature of the message only concerns the sender of the message.
Therefore, to resolve this problem, you must remove line 263 from the mailnews/extensions/smime/content/msgCompSecurityInfo.js file, as described in the attached hotfix.

Thank you in advance.

Comment 2

[Jorg K (CEST = GMT+2)]

Comment on attachment 9015205 [details] [diff] [review]
msgCompSecurityInfo.js.patch

Not a proper HG patch, but we got the message, thanks.

Magnus, this one is for you.

Comment 3

[Magnus Melin [:mkmelin]]

Attachment: bng1497154_certificate_status_usage.patch

Made that a proper patch.
Thanks for the patch!

I wonder though, what kind of strange certificates are these? How would anybody be able to get them and use them them when they are not sent out through signing. It's also bad procedures to send encrypted but unsigned mails.

Comment 4

[Jorg K (CEST = GMT+2)]

Attachment: bng1497154_certificate_status_usage.patch

Corrected surname of author.

Comment 5

[Chris GAUDRY [:cmgaudry33]]

(In reply to Magnus Melin [:mkmelin] from comment #3)
> Created attachment 9015486 [details] [diff] [review]
> bng1497154_certificate_status_usage.patch
> 
> Made that a proper patch.
> Thanks for the patch!
> 
> I wonder though, what kind of strange certificates are these? How would
> anybody be able to get them and use them them when they are not sent out
> through signing. It's also bad procedures to send encrypted but unsigned
> mails.

I'm not sending encrypted unsigned mail, but encrypted AND signed mail.
The problem is not there.

The "Message Security" window only checks for recipients certificates. These certificates only apply to encipherment.
When you send encrypted and signed mail, you sign with the sender's signing certificate and cipher with all the cipherment certificates (sender+recipient(s)).

The original code only works if each recipient certificate has both signature and cipherment usages.
The good procedure is to separate authentication, signing and cipherment certificates, to be able to remove any of theses usages of the user at anytime by revoking the corresponding certificate.

Comment 6

[Magnus Melin [:mkmelin]]

Yes, I'm not suggesting your usage is wrong. I'm suggesting the recipient certs are odd. 

How did you obtain them, if they weren't obtained by receiving signed mails from these persons?

Comment 7

[Chris GAUDRY [:cmgaudry33]]

These certificates are imported from an LDAP directory. These certificates have been generated by a professionnal PKI for enterprise use.

Comment 8

[Magnus Melin [:mkmelin]]

I see. Kind of defeats the purpose though, doesn't it. Or well, you could secure your internal communications, but anyone outside the eh, ldap access, can't send you encrypted mail.

Comment 9

[Chris GAUDRY [:cmgaudry33]]

This is for internal use only (the network is closed for security reasons).

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/03c827f7c3ac
recipient certificate status should not be checked for signing usage since that only concerns the sender certificate. r=mkmelin

Comment 11

[Jorg K (CEST = GMT+2)]

Reported against TB 60, so I guess we should fix it there. So uplift?

Comment 12

[Magnus Melin [:mkmelin]]

Comment on attachment 9015490 [details] [diff] [review]
bng1497154_certificate_status_usage.patch

Review of attachment 9015490 [details] [diff] [review]:
-----------------------------------------------------------------

Yep

Comment 13

[Jorg K (CEST = GMT+2)]

Comment on attachment 9015490 [details] [diff] [review]
bng1497154_certificate_status_usage.patch

[Triage Comment]

Comment 14

[Jorg K (CEST = GMT+2)]

TB 60.3 ESR:
https://hg.mozilla.org/releases/comm-esr60/rev/807198ad8091

Comment 15

[Jorg K (CEST = GMT+2)]

TB 63.0b2:
https://hg.mozilla.org/releases/comm-beta/rev/332f8acdf8e6