1969429 - ECDSA Certificate Selectable for Mail Encryption - but can't be used ("Sending failed") - was able to select the key for encryption even though key usages only list "Digital Signature"

Status: UNCONFIRMED

(MailNews Core :: Security: S/MIME, defect)

Description

[Rainer Rillke]

Steps to reproduce:

1. Create an ECDSA certificate
   1.1 openssl genpkey -genparam -algorithm ec -pkeyopt ec_paramgen_curve:P-256 -out ECPARAM.pem
   1.2 openssl req -newkey ec:ECPARAM.pem -keyout PRIVATEKEY.key -out MYCSR.csr
2. Let a CA process the CSR and download the Cert bundle
3. Create a P12 Bundle from the downloaded Cert bundle
   3.1 openssl pkcs12 -export -inkey PRIVATEKEY.key -in Cert_bundle.pem -out Cert_bundle.p12
4. Import the bundle into Mozilla Thunderbird 115.18.0 (Ubuntu 22.04 LTS) under Hamburger Menu -> Settings -> Certificates -> Manage Certificates -> Your Certificates -> Import ...
   4.1 Note that certificate's "Key Usages" is only "Digital Signature" but not "Key Encipherment" (View -> "Key Usages" in Certificate Manager)
5. Set this certificate as the Personal certificate for digital signing and for encryption.
   5.1 Under Account Settings -> S/MIME, select the certificate that was just imported in the step before
6. Attempt to send an encrypted E-Mail to yourself
   6.1 Under S/MIME select "Encrypt" and "Digitally Sign"
   6.2 Press "send"
   6.3 See error: "Sending of the message failed.
   You specified encryption for this message, but the application either failed to find the encryption certificate specified in your Mail & Newsgroup Account Settings, or the certificate has expired."

Actual results:

I am able to select an ECDSA certificate for encryption leading to an error down the road when actually trying to use it for that purpose. According to crypto.stackexchange, "the ECDSA algorithm can't be used for encryption".

Expected results:

When selecting an ECDSA certificate that can't be used for encryption in the Account Settings -> S/MIME for encryption, a meaningful error message like "Your selected certificate uses the ECDSA algorithm and therefore can't be used for encryption; get an RSA certificate instead" would be favorable.
After all, proper encryption shouldn't be hard to use for the end user.

Comment 1

[Magnus Melin [:mkmelin]]

Rainer, wow is this in v139?

Comment 2

[Anna Weine]

Kai have you seen this bug?

Comment 3

[Kai Engert [:KaiE:]]

You say you are using Thunderbird 115. That's an old version. Please try a newer version.

We have enabled support for encryption using ECDH in Thunderbird version 128, see bug 676118

Comment 4

[Kai Engert [:KaiE:]]

You say the usage of the selected certificate doesn't allow encryption, but only signatures.

I agree that TB should prevent configuring a non-encryption certificate for encryption.

But it's expected that the non-encryption cert fails when you use it for encryption, right?

Comment 5

[Rainer Rillke]

Hi, I re-tried on a Thunderbird 128.11.1esr (64-bit) under Ubuntu (apt sources). The result differs as TB already detects that the certificate can't be used while composing the message but it still allows selecting a certificate for encryption that can't be used for encryption. I'll attach some screenshots.

Comment 6

[Rainer Rillke]

Note that ECDSA ≠ ECDH.

Comment 7

[Rainer Rillke]

Well kind of, reading through https://stackoverflow.com/a/4970640/2683737

Comment 8

[Rainer Rillke]

Attachment: Error message when attempting to send an email to myself because TB can't encrypt because cert does not allow that. But cert was selectable for encryption.

Comment 9

[Rainer Rillke]

Attachment: ECDSA certificate issued by HARICA for S/MIME use but only for signing, not encryption

Comment 10

[Rainer Rillke]

Attachment: ECDSA certificate issued by HARICA for S/MIME use but only for signing, not encryption (2)

Comment 11

[Rainer Rillke]

Attachment: ECDSA certificate issued by HARICA for S/MIME use but only for signing, not encryption selected for encryption without any issue

Comment 12

[Kai Engert [:KaiE:]]

Yes, TB doesn't perform a validation at the time we select a certificate.

This could be costly when preparing the certificate selection dialog, because a user could potentially have many of them.

However, in bug 1944810 we're working on a mechanism to test the selected/configured certificate.
Once done, we could potentially also execute that test automatically after the user selects one, and reject if the test doesn't succeed.