From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Daniel Kahn Gillmor Newsgroups: gmane.linux.debian.devel.bugs.general,gmane.emacs.bugs Subject: Bug#745553: emacs24-el: mml2015-always-trust should default to nil, not t Date: Fri, 02 May 2014 16:29:53 -0400 Message-ID: <53640041.7070703@fifthhorseman.net> References: <20140422190613.18043.21415.reportbug@alice.fifthhorseman.net> <877g6eilsp.fsf@trouble.defaultvalue.org> Reply-To: Daniel Kahn Gillmor , 745553@bugs.debian.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="fVRvbCUcSkhXaUvdFQOrEMw5fgXd1xKj9" X-Trace: ger.gmane.org 1399062801 3559 80.91.229.3 (2 May 2014 20:33:21 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Fri, 2 May 2014 20:33:21 +0000 (UTC) Cc: 745553-forwarded@bugs.debian.org, 745553@bugs.debian.org To: Rob Browning , bug-gnu-emacs@gnu.org Original-X-From: bounce-debian-bugs-dist=glddb-debian-bugs-dist=m.gmane.org@lists.debian.org Fri May 02 22:33:14 2014 Return-path: Envelope-to: glddb-debian-bugs-dist@m.gmane.org Original-Received: from bendel.debian.org ([82.195.75.100]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1WgK8v-00089b-IY for glddb-debian-bugs-dist@m.gmane.org; Fri, 02 May 2014 22:33:13 +0200 Original-Received: from localhost (localhost [127.0.0.1]) by bendel.debian.org (Postfix) with QMQP id 02C9410B; Fri, 2 May 2014 20:33:13 +0000 (UTC) Old-Return-Path: Original-Received: from localhost (localhost [127.0.0.1]) by bendel.debian.org (Postfix) with ESMTP id D9240315 for ; Fri, 2 May 2014 20:33:12 +0000 (UTC) X-Virus-Scanned: at lists.debian.org with policy bank bug X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-10000 required=5.3 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable Original-Received: from bendel.debian.org ([127.0.0.1]) by localhost (lists.debian.org [127.0.0.1]) (amavisd-new, port 2525) with ESMTP id vNRKzLUPGdP2 for ; Fri, 2 May 2014 20:33:09 +0000 (UTC) Original-Received: from buxtehude.debian.org (buxtehude.debian.org [140.211.166.26]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (Client CN "buxtehude.debian.org", Issuer "Debian SMTP CA" (not verified)) by bendel.debian.org (Postfix) with ESMTPS id DA4DE10B; Fri, 2 May 2014 20:33:08 +0000 (UTC) Original-Received: from debbugs by buxtehude.debian.org with local (Exim 4.80) (envelope-from ) id 1WgK8n-0005nv-9r; Fri, 02 May 2014 20:33:05 +0000 X-Loop: owner@bugs.debian.org Resent-From: Daniel Kahn Gillmor Resent-To: debian-bugs-dist@lists.debian.org Resent-CC: Rob Browning X-Loop: owner@bugs.debian.org Resent-Date: Fri, 02 May 2014 20:33:02 +0000 Resent-Message-ID: X-Debian-PR-Message: followup 745553 X-Debian-PR-Package: emacs24-el X-Debian-PR-Keywords: X-Debian-PR-Source: emacs24 Original-Received: via spool by 745553-submit@bugs.debian.org id=B745553.139906260720854 (code B ref 745553); Fri, 02 May 2014 20:33:02 +0000 Original-Received: (at 745553) by bugs.debian.org; 2 May 2014 20:30:07 +0000 X-Spam-Bayes: score:0.0000 Tokens: new, 14; hammy, 151; neutral, 164; spammy, 0. spammytokens: hammytokens:0.000-+--H*c:pgp-sha512, 0.000-+--H*c:pgp-signature, 0.000-+--H*c:protocol, 0.000-+--H*c:micalg, 0.000-+--H*c:signed Original-Received: from che.mayfirst.org ([209.234.253.108]) by buxtehude.debian.org with esmtp (Exim 4.80) (envelope-from ) id 1WgK5v-0005Ph-34; Fri, 02 May 2014 20:30:07 +0000 Original-Received: from [10.70.10.85] (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id 1B901F984; Fri, 2 May 2014 16:30:02 -0400 (EDT) User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Icedove/24.5.0 In-Reply-To: <877g6eilsp.fsf@trouble.defaultvalue.org> X-Enigmail-Version: 1.6+git0.20140323 X-CrossAssassin-Score: 2 X-Debian-Message: from BTS X-Mailing-List: archive/latest/1067667 X-Loop: debian-bugs-dist@lists.debian.org List-Id: List-URL: List-Post: List-Help: List-Subscribe: List-Unsubscribe: Precedence: list Resent-Sender: debian-bugs-dist-request@lists.debian.org Xref: news.gmane.org gmane.linux.debian.devel.bugs.general:1148139 gmane.emacs.bugs:88545 Archived-At: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --fVRvbCUcSkhXaUvdFQOrEMw5fgXd1xKj9 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 04/24/2014 03:12 PM, Rob Browning wrote: > [If possible, please preserve the 745553-forwarded address in any repli= es.] >=20 > This bug was filed recently, and I suspect it might be something you'd > like to discuss upstream. thanks for forwarding this, Rob. More notes below: > Daniel Kahn Gillmor writes: [...] >> Consider Alice, who has OpenPGP certificates for "Bob >> " and "Carol " in her keyring (in >> that order). She has certified them both, so there is one valid >> primary key for bob@example.org and one valid primary key for >> alice@example.org. >> >> Bob turns evil (or maybe his key is compromised) and he adds a new >> User ID: "Bob " to his OpenPGP cert. He publishes >> the update to the keyservers. >> >> Alice, following best practices, updates her keyring from the >> keyservers regularly. >> >> Alice's keyring now has two certs that have a "carol@example.org" user= >> ID in them. One of them is valid, and the other one is not. >> >> Alice now composes a message to "Carol " and marks >> it with: >> >> <#secure method=3Dpgpmime mode=3Dsignencrypt> >> >> As the message goes out, mml-mode just passes the e-mail address >> carol@example.org to gpg to encrypt the message body, and gpg uses the= >> e-mail address to select a key. Since Bob's key is first in the >> keyring, it is the one that will be used. Turns out the situation is slightly worse than i described above. While i still think that mml2015-always-trust should default to nil (and this defends against some failure modes), there are other problems with key selection that aren't fixed yet. In particular, the problematic scenario described above is *not* fixed by changing the setting. Observing the behavior, it looks like mml-mode does OpenPGP certificate selection by e-mail address in the following way (sorry i haven't dug into the code yet): 0) it asks GnuPG for a cert associated with the given e-mail address 1) it checks the *overall* validity of the cert in order to decide if the cert is the right one 2) if the cert is valid, it encrypts to it. The problem with this is how gpg defines the overall validity of the cert: in particular, it defines the validity of a cert as the *highest* validity of any UserID associated with the cert. It should instead be looking at the validity of the desired User ID specifically, not the overall cert. So in the scenario above, Bob's cert is still overall valid (because it has a valid certification over the correct UserID+key from Alice), even though the carol@example.org UserID is invalid. I don't know mml-mode or elisp well enough to dig into the code and fix this part of the problem quickly, but if someone has patches that i can look at that would point to where it might be changed, i'd be happy to try to review them. --dkg --fVRvbCUcSkhXaUvdFQOrEMw5fgXd1xKj9 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQJ8BAEBCgBmBQJTZABBXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQjk2OTEyODdBN0FEREUzNzU3RDkxMUVB NTI0MDFCMTFCRkRGQTVDAAoJEKUkAbEb/fpc2GsP/iUpY4nzueMgpa+AEPQxV+xL 0xw6QDkLt0E/vmTN6M2DIay3poEfEwLTqb66psAS4zns7ctfn2Uo7kurZLbYpKo1 zyKgy+LqWS+R7rofm+wKGC5jZgi3BqphQW53CbHrRvi+VECNAKEgDwBic4GyxRfv TyWSJ0SMhOsdnj1cxZXnlOwOR4bOBc3B7UBhNQe1z82XD3pC2gaVbXaUNd1fslhB XGuAdo7GiT3v9e7P/mJL1PRKz0DGNY3NHmEIV3RByDEPukfarPOnVb6GPHP5v7RC R/dmqcpeYXWi3FCDh7lhOez8UzuBFl/JgBfX7DHxg16Ccp2BFaLo4FD0HEuB0nPe mxX6Zw1Uri+w3aZqIZKlcBFk/q7NLzUe9f5yl0qgq1CqIDxg4m1beRRKUsNb1/1/ vYZYun9VH131VaMu+wtDzw2qH46f5Oemi1o/ZNG5GkTDdcJlu6/GdupaF8bemy4o 1aWxGwXl/i3OYRCt4HaHZrqET0GRLUVcsB+0u7ZYFD/pS5dI4/itnmVsXed6o5OD SQMqLU7w24BmX6RkC3xOmqeuQKrBuKGhrAEO+rJl8dHPXHv1l7ApCZy4CSJJ4X1c uhkcL6KQyZfByMiOWC7+yZwokNrWIEZM4n1N/zttGx3W0fzL7rJMvdHyo2XAYXIB Ep1Luj+vaGxR8NLbg0h6 =LXAD -----END PGP SIGNATURE----- --fVRvbCUcSkhXaUvdFQOrEMw5fgXd1xKj9--