Decryption of files encrypted with certs with invalid/inaccessible crlDistributionPoints currently fails (invalid crypto engine):
To reproduce:
- S/MIME encrypt a file with the following 2 certs (invalid/inaccessible):
- CA
- invalid content crlDistributionPoints = URI:https://gnupg.com/share/g10code-key.asc
- inaccessible url crlDistributionPoints = URI:http://gnupg.test/crl.pem
- resulting files (txt content: 12345)
- CA
- Decrypt the files in Kleopatra (gpgsm --decrypt without additional flag works) -> Error: Invalid crypto engine.
| inaccessible | invalid |
 |  |
Debugview
118 42.846381 6944 kleopatra.exe org.kde.pim.kleopatra: GpgME::DecryptionResult( 119 42.846381 6944 kleopatra.exe error: GpgME::Error(117440662 (Invalid crypto engine)) 120 42.846381 6944 kleopatra.exe fileName: <null> 121 42.846381 6944 kleopatra.exe unsupportedAlgorithm: <null> 122 42.846381 6944 kleopatra.exe isWrongKeyUsage: 0 123 42.846381 6944 kleopatra.exe isDeVs: 0 124 42.846381 6944 kleopatra.exe isBetaCompliance: 0 125 42.846381 6944 kleopatra.exe legacyCipherNoMDC: 0 126 42.846381 6944 kleopatra.exe symkeyAlgo: ?.? 127 42.846381 6944 kleopatra.exe recipients: 128 42.846381 6944 kleopatra.exe GpgME::DecryptionResult::Recipient( 129 42.846381 6944 kleopatra.exe keyID: 85CDF0E469EB0634 130 42.846381 6944 kleopatra.exe shortKeyID: 69EB0634 131 42.846381 6944 kleopatra.exe publicKeyAlgorithm: <null> 132 42.846381 6944 kleopatra.exe status: GpgME::Error(0 (Success))) 133 42.846381 6944 kleopatra.exe ) 134 42.846381 6944 kleopatra.exe GpgME::VerificationResult( 135 42.846381 6944 kleopatra.exe error: GpgME::Error(117440662 (Invalid crypto engine)) 136 42.846381 6944 kleopatra.exe fileName: 137 42.846381 6944 kleopatra.exe signatures: 138 42.846381 6944 kleopatra.exe ) 139 42.846546 6944 kleopatra.exe org.kde.pim.kleopatra: 0x1f8ec1b5130 140 42.846601 6944 kleopatra.exe org.kde.pim.kleopatra: 0x1f8ec1b5130 141 42.846911 6944 kleopatra.exe org.kde.pim.kleopatra: Task: "Decrypting crl.invalid.txt.p7m..." has no total progress set. 142 42.847065 6944 kleopatra.exe org.kde.pim.kleopatra: Task: "Decrypting crl.invalid.txt.p7m..." has no total progress set. 143 42.848178 6944 kleopatra.exe org.kde.pim.libkleo: errorAsString gettext_use_utf8(-1) returns 1 144 42.848255 6944 kleopatra.exe org.kde.pim.libkleo: errorAsString error: "Invalid crypto engine" 145 42.848305 6944 kleopatra.exe org.kde.pim.libkleo: errorAsString error (percent-encoded): "Invalid%20crypto%20engine" 146 42.850276 6944 kleopatra.exe org.kde.pim.kleopatra: not showing link (not available) 147 42.860686 6944 kleopatra.exe org.kde.pim.kleopatra: All done
Logs
CLI gpgsm (works)
C:\Users\g10\Desktop\testdata\crl>gpgsm -vv --status-fd 2 --decrypt crl.inaccessible.txt.p7m gpgsm: enabled compatibility flags: gpgsm: recp 0 - issuer: '1.2.840.113549.1.9.1=#636140676E7570672E74657374,CN=CA,OU=QA,O=g10code,L=Erkrath,ST=NRW,C=DE' gpgsm: recp 0 - serial: 07 [GNUPG:] ENC_TO CE61ED7460A3CB9D 0 0 gpgsm: encrypted to rsa4096 key 360321232067CC26E76AFB0DCE61ED7460A3CB9D gpgsm: AES256.CBC encrypted data gpgsm: asking dirmngr about 36:03:21:23:20:67:CC:26:E7:6A:FB:0D:CE:61:ED:74:60:A3:CB:9D gpgsm: WARNING: fetching CRL failed gpgsm: (further info: fetching CRL via crlDP http://gnupg.test/crl.pem failed) gpgsm: response of dirmngr: Unknown error gpgsm: certificate #07/1.2.840.113549.1.9.1=#636140676E7570672E74657374,CN=CA,OU=QA,O=g10code,L=Erkrath,ST=NRW,C=DE gpgsm: checking the CRL failed: Unknown error gpgsm: validation model used: shell gpgsm: invalid certification chain: Unknown error [GNUPG:] TRUST_UNDEFINED 32900 [GNUPG:] DECRYPTION_OKAY 12345[GNUPG:] FAILURE gpgsm-exit 50331649 C:\Users\g10\Desktop\testdata\crl>gpgsm -vv --status-fd 2 --decrypt crl.invalid.txt.p7m gpgsm: enabled compatibility flags: gpgsm: recp 0 - issuer: '1.2.840.113549.1.9.1=#636140676E7570672E74657374,CN=CA,OU=QA,O=g10code,L=Erkrath,ST=NRW,C=DE' gpgsm: recp 0 - serial: 08 [GNUPG:] ENC_TO 85CDF0E469EB0634 0 0 gpgsm: encrypted to rsa4096 key 1C94AD079527EA81DA68095F85CDF0E469EB0634 gpgsm: AES256.CBC encrypted data gpgsm: asking dirmngr about 1C:94:AD:07:95:27:EA:81:DA:68:09:5F:85:CD:F0:E4:69:EB:06:34 gpgsm: WARNING: inserting CRL into cache failed gpgsm: (further info: insert CRL via crlDP https://gnupg.com/share/g10code-key.asc failed) gpgsm: response of dirmngr: Invalid CRL object gpgsm: certificate #08/1.2.840.113549.1.9.1=#636140676E7570672E74657374,CN=CA,OU=QA,O=g10code,L=Erkrath,ST=NRW,C=DE gpgsm: checking the CRL failed: Invalid CRL object gpgsm: validation model used: shell gpgsm: invalid certification chain: Invalid CRL object [GNUPG:] TRUST_UNDEFINED 162 [GNUPG:] DECRYPTION_OKAY 12345[GNUPG:] FAILURE gpgsm-exit 50331649
gpg version
>gpg --version gpg (GnuPG) 2.5.21 libgcrypt 1.12.2
Split from T6702: Kleopatra: Offer retry of S/MIME encryption if encryption failed with "not trusted".