I'm working on a program that encrypts email after receiving so that at least it can be stored encrypted on the receiving mail server (although still would be transmitted in plain text). While it is designed to not double-encrypt already-encrypted emails, it still seems to fail on encrypting already-signed emails.

I tested this sequence of commands and it also fails; and this is essentially what the program is doing:

echo "Hello" > blah.txt
gpg --clearsign blah.txt
gpg --encrypt --armor blah.txt.asc
gpg --decrypt blah.txt.asc.asc

The last command normally would decrypt and also validate the signature. However, it instead decrypts only and a second --validate pass is needed to validate the signature. This means that email clients display the mail incorrectly, even if they include PGP support.

migrated from security.stackexchange.com Sep 28 '13 at 20:00

This question came from our site for information security professionals.

  • 1
    That seems to me to be the normal and expected behavior. If anything, your program should be responsible for scanning the decrypted message to determine if it needs signature validation before presenting to the user. Your program is the one playing matryoshka games, it isn't GnuPG's job to clean up after it. – gowenfawr Sep 28 '13 at 18:40
  • The program is the one encrypting the email, not decrypting it. When using GnuPG with --encrypt and --clearsign in one go, the --decrypt works. But if it's done separately it doesn't work. Yet, it theoretically is possible to encrypt an already signed message (this is often considered a vulnerability since the recipient email address is not signed). – uakf.b Sep 28 '13 at 21:10

GPG can only verify the signature at the same time as decrypting a file when the signature was included with the original encryption process. From GPG's point of view a clear-signed message or detached signature included with PGP/MIME would be part of the plain text data that has been encrypted. Thus a separate operation to verify the signature is normal.

Interestingly this process of nesting a clear-signed signature inside an encrypted block is exactly what Hushmail still does, in spite of it not being anywhere near the recommendations of RFC 4880.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.