Importing key from keyserver does not work: "No keys imported"
Categories
(MailNews Core :: Security: OpenPGP, defect)
Tracking
(Not tracked)
People
(Reporter: u617804, Unassigned)
Details
Attachments
(3 files)
Import key
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Steps to reproduce:
TB 91.2.0 (64-bit)
Go to Tools -> OpenPGP Key Manager
and search for key "0xB3464F896AA15948". It should not be found. If it is, delete the key.
Go to Keyserver -> Discover Keys Online
and enter 0xB3464F896AA15948
TB asks if one key should be imported (it's printed the long format of the key (which is confusing BTW), see screenshot).
Click "OK"
Actual results:
A message is shown "No keys imported", and the key is not imported.
Expected results:
It seems that TB has found the key on the keyserver, because it asks the user if the key should be imported, and also asks about the trust in the key.
So it is really unexpected that the key import fails.
There should be an error message that explains the reason why import failed.
I have followed the debugging possibilities on https://wiki.mozilla.org/Thunderbird:OpenPGP#Debugging_.2F_Tracing
The Developer Tools->Error console stays empty
/tmp/enigdbug.txt
2021-10-09 16:12:33.998 [DEBUG] enigmailKeyManager.js: enigmailKeyManagerLoad
2021-10-09 16:12:34.149 [DEBUG] enigmailKeyManager.js: loadkeyList
2021-10-09 16:12:34.150 [DEBUG] enigmailKeyManager.js: buildKeyList
2021-10-09 16:12:34.150 [DEBUG] keyRing.jsm: loadKeyList( null)
2021-10-09 16:12:34.232 [DEBUG] keyRing.jsm: createAndSortKeyList()
2021-10-09 16:12:45.694 [DEBUG] keyserver.jsm: accessVksServer.download(0xB3464F896AA15948)
2021-10-09 16:12:45.695 [DEBUG] keyserver.jsm: accessVksServer.accessKeyServer(vks://keys.openpgp.org)
2021-10-09 16:12:45.696 [DEBUG] keyserver.jsm: accessVksServer.accessKeyServer: requesting GET for https://keys.openpgp.org:443/vks/v1/by-keyid/B3464F896AA15948
2021-10-09 16:12:45.698 [DEBUG] enigmailKeyManager.js: refreshKeys
2021-10-09 16:12:45.698 [DEBUG] enigmailKeyManager.js: buildKeyList
2021-10-09 16:12:45.699 [DEBUG] keyRing.jsm: EnigmailKeyRing.clearCache
2021-10-09 16:12:45.699 [DEBUG] keyRing.jsm: loadKeyList( null)
2021-10-09 16:12:45.786 [DEBUG] keyRing.jsm: createAndSortKeyList()
2021-10-09 16:12:45.971 [DEBUG] keyserver.jsm: accessVksServer.onload(): status=200
2021-10-09 16:12:45.971 [DEBUG] key.jsm: getKeyListFromKeyBlock
Following https://wiki.mozilla.org/Thunderbird:OpenPGP#RNP_log
I also did export RNP_LOG_CONSOLE=1 in the Linux Bash console before starting TB from that console.
Do I assume correctly that the RNP log messages should appear in the console window, not in any file?
There are no messages in the console.
$ gpg --keyserver keys.openpgp.org --recv-keys 0xB3464F896AA15948
gpg: key 0xB3464F896AA15948: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg: w/o user IDs: 1
Looks like duplicate of bug 1663234, only the error messege is not that buggy anymore.
This should really be fixed, as the use case is a really basic one:
The mentioned key is from the Debian maintainer Ana Lopez, the key is used for signing the Debian-Announce mailing-list mail
https://lists.debian.org/debian-announce/2021/msg00007.html
In TB it looks like this (see screenshot).
When clicking on "Discover" the dialog https://bugzilla.mozilla.org/attachment.cgi?id=9245096 appears.
At least there really should be a clear reason for the failing, as I suggested sadly already one year ago in https://bugzilla.mozilla.org/show_bug.cgi?id=1663234#c1. Now I did much work in filing this new (duplicate) bug again, for this really basic use case.
The precise use case is the following:
- I am described to the debian-announce mailinglist
- In 2021 so far, there where eight mails in that mailinglist, so low traffic
- The posts are from different Debian maintainers, I do not know them.
- I had once imported the key 0xF22674467E4AF4A3 from Debian maintainer Laura Reina, but that key expired end of september 2021
So I think in this case I want just TOFU, so for every mailing list mail from another (for me unknown) maintainer I do not yet have the key for, I just want to import the key and trust it on first use, so for future mails signed by the same key the signature is promptly displayed as trusted (hopefully). The chance that the signer key was forged is very unlikely because that would be detected very fast and there would be a scandal.
|
||
Comment 6•4 years ago
|
||
I can't import this key in GnuPG either:
<pre>
$ cat /tmp/7A33ECAA188B96F27C917288B3464F896AA15948.asc | gpg --import
gpg: key 0xB3464F896AA15948: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg: w/o user IDs: 1
</pre>
So indeed, that seems to be a duplicate of Bug 1663234 and I'm closing it as such.
Sorry but I don't think that importing keys without user ID and doing better at this than GnuPG is a really basic use case so don't expect high priority.
We'll work on TOFU in Bug 1627956.
This bug is not only if there is no user id in the key, but also when the user ID of the key does not match the sender's mail address.
Like with this key:
0x782F6A283D69AE18
that Apple uses to sign it's mails to the Apple security announce mailing list
User ID is
Apple Product Security <product-security@apple.com>
while the actual sender is
Sorry forget my comment 7, I forgot that the keyservers just publish the key with stripped user id.
I just could not think of the possibility that there are "different versions" of the same key, because removing the user ID is some kind of manipulation of the public key, no?
Can anyone also change the user ID of a public key?? That would make no sense as TB validates the user ID and if an attacker could just spoof it that would be pointless. I am confused.
My confusion was also because I could import the Apple public key manually in the Bash console with
gpg --receive-keys 0x782F6A283D69AE18
so gpg also fetched it from a keyserver, and that key contained the user ID.
So I thought the key that TB fetched from a keyserver would also need to have the user ID.
But I guess my local gpg (still) uses a key server that does not strip user ids, while TB uses a user-id-stripping key server.
So, dependent on which keyserver you query, you get somehow "different" keys.
|
||
Comment 10•4 years ago
|
||
(In reply to Arvidt from comment #8)
Sorry forget my comment 7, I forgot that the keyservers just publish the key with stripped user id.
I just could not think of the possibility that there are "different versions" of the same key, because removing the user ID is some kind of manipulation of the public key, no?
OpenPGP uses packet structure, and you may strip any of them (like userid and it's signature) leaving structure still valid.
Can anyone also change the user ID of a public key?? That would make no sense as TB validates the user ID and if an attacker could just spoof it that would be pointless. I am confused.
UserID must have valid self-certification (i.e. signature, produced by secret key which corresponds to the public key). Without it userid must not be used at all as anyone may attach userid packet to the key. Also key owner may add new userids, add new certification, revoke existing userids and so on, adding new packets to the key structure.
Description
•