609007 - Thunderbird uses wrong encryption key

Status: RESOLVED INCOMPLETE

(Thunderbird :: Security, defect)

Description

[Collin]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.41 Safari/534.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6

Thunderbird appears to select the wrong key when encrypting messages to a user with two certificates in the "People" certificate store.

Joe, a colleague who I have exchanged signed and encrypted emails with in the past just installed a new certificate.  Both of Joe's certificates are valid, trusted and appear in his Thunderbird account under the "Your Certificates" store.  Joe has also selected the new certificate for both signing and encryption, neither are set to default.

Once Joe and I have exchanged signed messages I see both of his certificates within certificate manager under "People".  One of Joe's certificates was issued by GeoTrust and the other by Entrust.

When I attempt to compose an encrypted email to Joe I receive the following error: "failed to find an encryption certificate for {email address}."

In order to successfully send an encrypted email to Joe I was forced to delete his older, yet still valid Geotrust certificate from the "people" store on my Thunderbird account.  After removing this certificate and restarting TB I am able to successfully send encrypted emails to Joe and he is able to decrypt successfully.


It looks like a number of others are running into this exact problem:
http://forums.comodo.com/email-certificate/thunderbird-not-picking-up-new-certificate-t49177.0.html

Reproducible: Always

Steps to Reproduce:
1.Install a digital certificate, exchange signed and encrypted emails as usually.
2.Install a second, valid, digital certificate.  You should now have two valid certificates under the "Your Certificates" store for the same email account.  Make sure the new certificate is now selected for signing and encryption.  
3. Assuming you have exchanged your old digital signature with user A.  After exchanging your new digital signature, user A will no longer be able to encrypt emails to you.

Actual Results:  
Others are receiving error messages when they attempt to encrypt an email to me.

Expected Results:  
When a certificate conflict exists, two valid certificates for one address, Thunderbird's certificate manager should always choose the certificate that expires last (the certificate with an expiration date farthest in the future) for signing and encryption purposes.

It looks like a number of others are running into this exact problem:
http://forums.comodo.com/email-certificate/thunderbird-not-picking-up-new-certificate-t49177.0.html

Comment 1

[bugzilla-ff]

Thunderbird 6.0 X64

Just added a new personal certificate so that I now have two valid certs. Sending a signed encrypted e-mail to myself does not use the expected new certificate nor is there a way to select it.

"View Security Info" says that the new certificate is selected but the received e-mail actually used the older certificate.

Comment 2

[Wayne Mery (:wsmwk)]

Collin,
Are you still see ing this problem when using a current version?

Comment 3

[Wayne Mery (:wsmwk)]

http://forums.comodo.com/email-certificate/thunderbird-not-picking-up-new-certificate-t49177.0.html states a workaround "Assume you have an email message signed by the other party, and that the other party's certificate is already in the "People" tab of the Certificate Manager.

First, click on and delete the person's certificate from the Certificate Manager window.  Close the window and exit Thunderbird.

Run Thunderbird again and navigate to the signed message.

Now you can encrypt a message and send it to the other party.  This trick seems to work a single time.  It's obviously not very convenient, but perhaps it sheds some light on the nature of the problem."

Comment 4

[Phoenix]

Resolved per whiteboard