1763939 - OpenPGP requiring secret key for message Outlook is able to display

Status: RESOLVED INCOMPLETE

(MailNews Core :: Security: OpenPGP, defect)

Description

[Nils]

Steps to reproduce:

I received a mail from a Datev system that I can see in Outlook but not in Thunderbird. It was visible in ESR, but not in 98 (when I switched to that) and not in 100b1 (just updated). Essentially the mail contains HTML with a link to the system where I can retrieve the actual message.

Actual results:

• Outlook: shows a "secure-email.html" attachment and displays it
• iOS: needs SEPPmail Reader to read the mail: https://apps.apple.com/de/app/seppmail-reader/id1565769384
• Thunderbird: Red bar in message window with "The secret key that is required to decrypt this message is not available." See attached screenshot.

'''
MIME-Version: 1.0
content-type: multipart/encrypted; boundary="----------=_1649152399-3080-0"; protocol="application/pgp-encrypted"
X-getmail-retrieved-from-mailbox: INBOX

This is a multi-part message in MIME format...

------------=_1649152399-3080-0
Content-Type: application/pgp-encrypted
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Version: 1

------------=_1649152399-3080-0
Content-Type: application/octet-stream
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

-----BEGIN PGP MESSAGE-----

[content]

-----END PGP MESSAGE-----

------------=_1649152399-3080-0--
'''

Expected results:

TB should display the message as it used to in ESR.

Comment 1

[Nils]

Attachment: Screenshot of preview pane with error

Comment 2

[Magnus Melin [:mkmelin]]

Which was the last version it worked in?

Comment 3

[Nils]

I think it was 91 where it worked, then I switched to 98 to test the Nostalgy++ addon (see Bug 1755446 ... not much happening on that bug unfortunately, and its breaking Nostalgy) with a beta, and then moved on to 99 and today 100. It didn't work with any of the betas.

Comment 4

[Nils]

It was whichever 91 version was current around Feb 15-17, that's when I switched to 98.

Comment 5

[Kai Engert [:KaiE:]]

The structure of this message seems unusual.

Which software creates this kind of encrypted message?

Do you think you could use that software to create a test email, encrypted to this key:
https://keys.openpgp.org/search?q=alice-test%40kuix.de
and send it by email to [e-mail] ?

Comment 6

[Kai Engert [:KaiE:]]

ok, you said it's sent by Datev...

Would you be able to share such an email with me? Even if I cannot decrypt it, I might be able to study its structure, and check what happens on the Thunderbird side.

When seeing the email, use file save as, save as .eml file, then zip it, then send the zip file by email to [e-mail]

Comment 7

[Nils]

Just moved from 100b4 to 101b1 (Win 11 64 bit)

• Same behavior on the mail I received
• the mail I had sent (in my Sent folder) you with the attachment as a EML renders the content correctly and shows the red PGP warning banner in the screenshot in this bug
• After I moved the mail to you from Sent to my Bugs folder it still displays correctly, but without the red PG banner

I am assuming that the correct display may be due to the extra text part of the mail... maybe there needs to be an extra text part before the signed part to make it show correctly?

I sent you a mail with the EML as a zipped attachment as requested. Thanks for your help!

Comment 8

[Kai Engert [:KaiE:]]

(In reply to Nils from comment #7)

I sent you a mail with the EML as a zipped attachment as requested.

The file you sent consists only of headers. There is a content-type header that suggest that an encrypted message should follow - but no message follows.

Comment 9

[Nils]

Resaved, zipped and resent to you...

Comment 10

[Kai Engert [:KaiE:]]

I have received an email from Nils, which contains a correct OpenPGP email message, which matches the headers shown in comment 0 above.

Of course I cannot decrypt the message, that is expected.

In order to test that the structure of the email is correct, I have replaced the parts between BEGIN PGP and END PGP with a test message that I can decrypt with my own key. When opening this modified test message with Thunderbird Daily build (version 102), the message is decrypted correctly.

That confirms the outermost structure of the email message valid and can be processed correctly by Thunderbird.

If Thunderbird doesn't show ANY contents of this email, it means that your Thunderbird configuration doesn't have the required secret key to decrypt the message.

I will send you a private email, which contains the key ID of the secret key that is required to decrypt the message you have sent to me. You should check your Thunderbird setup, and check if you do have that secret key available.

Comment 11

[Kai Engert [:KaiE:]]

If you do have the required secret key, then the problem could be related to the contents inside the encrypted message.

In order to further analyze the problem, you would have to decrypt the message, and send me the raw decrypted content of the message (in a private email to me).

These instructions could be used:

• open the .eml file that you have sent to me in a plain text editor (e.g. notepad on windows)
• delete all lines above the "... BEGIN PGP ..." line
• delete all lines after the "... END PGP ..." line
• save the file to a new filename, e.g. msg.asc
• use GnuPG to decrypt the message
• GnuPG will tell you which new file it has created to store the decrypted message.
• Create a zip file with the decrypted message
• send me that zip file

Comment 12

[Nils]

https://dassteuerhaus.de/service/verschluesselte-emails/thunderbird/ has some instructions (in German) for TB, https://dassteuerhaus.de/service/verschluesselte-emails/outlook/ for Outlook.

The weird thing is that both Outlook and TB are on a fresh machine, Outlook shows it out of the box (or maybe it does not show the content, but a "default template text" that it gets from I have no clue where, with instructions on how to open the encrypted part).

I'll have a look to see if I have a certificate / key in my old installation of TB... any ideas of where TB stores it?

Comment 13

[Kai Engert [:KaiE:]]

Your test email was encrypted using OpenPGP.

The web site you quoted seems to talk about S/MIME. If you have a personal S/MIME certificate with secret key, it shouldn't help to decrypt an encrypted OpenPGP message.

Comment 14

[Kai Engert [:KaiE:]]

If you don't have the matching secret key for an encrypted OpenPGP message, you cannot decrypt it.
That's not a bug in Thunderbird.

Marking this bug as invalid.

It seems you need to analyze what kind of encryption system you are using in your environment.

Comment 15

[Nils]

Aaaaaaah, I think I get it. Here's what is happening:

• years ago I added my PGP key to Datev for my primary email account to receive these mails
• this year I installed a new laptop (new outlook, new TB)
• When the sender sends a mail via Datev to me (I asked him to send to both of my accounts to test) TWO DIFFERENT emails get sent by the Datev system, and not the same one going to both recipients:
• Mail #1 goes to my primary account (which I was looking at on TB). This one is PGP encrypted (probably with the real content) since that is the key that Datev has for that email identity... and since the TB installation is new it does not have my secret key, so teh TB message is 100% correct
• Mail #2 goes to my other account which I see on Outlook. Since that email address is not registered with Datev, it gets a semi-generic secure-email.html attachment (but with an adapted subject and sender in the HTML content) and with the instructions on how to register the email address / decrypt the mail, but this is NOT the same content as the other mail (which probably has the ACTUAL email content encrypted)

This explains it... I was assuming the same email went to both accounts.

So thanks for the help, closing as NOTABUG or similar is great.