1941370 - Add a mechanism to warn if OpenPGP secret and public keys have different validity

Status: RESOLVED DUPLICATE of bug 1929026

(MailNews Core :: Security: OpenPGP, enhancement)

Description

[Kai Engert [:KaiE:]]

I would like to have a mechanism, to ensure that the validity information that we have in the secret keys matches what we have in the corresponding public key.

I just lost a few hours analyzing a strange behavior, but it was caused by my own mistake.

I had manipulated the expiration date of a key outside of Thunderbird, and had imported only the updated public key into Thunderbird.

When trying to sign with that key, RNP decided that it cannot be done, because the secret signing key was expired. But our key manager UI said the key is valid.

I guess Thunderbird should probably be able to do it by itself. It could load only the secret key data into an RNP FFI area, get the expiration information, then compare with what we get in the public keyring.

If a mismatch is detected, I'd like to show some warning in key manager, or the key details dialog.

Comment 2

[Kai Engert [:KaiE:]]

I think we shouldn't warn, we should rather try to fix automatically.