I have just upgraded from Thunderbird 68 with Enigmail to Thunderbird 78, with its native OpenPGP features. However, the migration from Enigmail didn't succeed and it fails to associate the keys in my keyring to my e-mail accounts.

When I first upgraded, Enigmail popped up a tab with a "Migrate" button on it. At first it didn't work -- it kept complaining that Thunderbird's OpenPGP infrastructure wasn't initialised -- but turning it off-and-on again got me passed that.

When I successfully started the migration, it started asking me for passwords to keys. Fair enough, I assume it was just trying to validate them. However, then it started asking me the password to a revoked key. I'm pretty sure I got the password right -- although it was revoked in 2016, so I can't be sure -- but it just kept going round in a loop. Ultimately, I cancelled this and Enigmail completed, with the warning that this key couldn't be imported. That's fine; like I say, it's revoked.

Now, in Account Settings > Account > End-To-End Encryption, it fails to associate my key with my accounts. I assume it does this based on the key identity matching the account's e-mail address. My main key has many identities associated with it (one for my personal e-mail, one for work, etc.), is this what is causing the association to fail? (Incidentally, my keys do correctly appear in Thunderbird's OpenPGP key manager.)

Seeing that this doesn't work, I try exporting my keys with gnupg and importing them into Thunderbird. It correctly recognises the keys when I do the import, but then it starts asking for the password to that revoked key again! I don't know what that key has to do with my new keys, apart from it has the same identity.

If I don't do anything -- i.e., assume it will work magically -- when I try to send a signed or encrypted e-mail, it complains that it cannot find the secret key for my identity's key. So, it did work magically, in the sense that it correctly determined the signing/encryption key it should be using -- and not the revoked one -- but for some reason it fails to find the secret key. What's going on!?

Is Thunderbird shelling out to gnupg under the hood, or does it contain its own implementation and its own keyring? If the latter, that could explain it, but if it does work that way, I'm not happy about the "forking" of keyrings. That would mean I have to maintain another set.

  • As documented the new PGP implementation has an own keystore and can no longer re-use an existing keystore of gnupg. The keystore is now integrated into your TB profile and protected by your TB passphrase. – Robert Sep 18 '20 at 13:27
  • OK, fair enough. I personally find that a bit annoying, but it is what it is... In which case, maybe if I expunge the Thunderbird keystore, from the failed Enigmail migration, and start over, it will work? – Xophmeister Sep 18 '20 at 14:00
  • 1
    AFAIK Thunderbird uses a totally different keystore format. Hence reusing the keystore is no longer possible. wiki.mozilla.org/Thunderbird:OpenPGP:2020 – Robert Sep 18 '20 at 14:07
  • OK, I found the problem, I think... I detached the certification primary key from my key, in GnuPG, leaving only the separate encrypt, sign and authentication subkeys. When Enigmail did the migration, it was unable to migrate the certification key because it doesn't exist. I tried importing the backup key I have, with the certification key intact, and now it's working. – Xophmeister Sep 18 '20 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.