[8.940][BUG] PGP encryption chosen ahead of S/MIME

In testing with Wingman, we discovered that the behavior of the encryption engine changed from V7.5 to V8.302.

Proved it! - He reports that he cannot enable PGP encryption in V9 because of a bug in V9, so we could not test to confirm that the following error still exists in the beta.

When both a PGP key and an S/MIME certificate are available for an address, the S/MIME certificate should be used for encryption. Wingman was receiving empty emails from me. We determined from the headers that it was because my V8.302 was encrypting with PGP. I changed no other settings and deleted the public PGP key I had for him. Bingo, everything worked perfectly!

Cheers - Bob

0 wingman over 12 years ago
Just to add-Headers for the encrypted email coming from Bob

MIME-Version: 1.0
Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
boundary="=-c3Qj0nCmYvyqnUWZCWqi"

Bob had both S/MIME and openpgp enabled whereas I had only S/MIME enabled
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 12 years ago

Wingman and I have just confirmed the same bug exists in the current beta, so I'll change the title of the thread.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 dreb over 12 years ago in reply to BAlfson

Hi Bob, Wingman,

I've tested this with 7.507. This version prefers also PGP and not S/MIME for encryption.

Are you sure that the PGP-encrypted mail was empty?
If the recipient does not decrypt the mail (because of disabled PGP) then eg. thunderbird shows indeed the mail as empty, whereas "View source" reveals that the mail contains pgp-encrypted data.

Regards
Dietrich
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 12 years ago

Hi, Dietrich, and welcome to the User BB!

You are correct - that is exactly what occurs.

Cheers - Bob
PS The last time I tested the primacy of S/MIME over PGP was in December 2010; that likely was about 7.507, so I'm mystified that it's now working that way for you! From the manual: "Note - If you configure both S/MIME and OpenPGP for an individual user, e-mails sent by this user will be signed and encrypted using S/MIME."

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 dreb over 12 years ago in reply to BAlfson

Hi Bob,
thx for the welcome :-)

Yes, I've seen this note in the help too.
We will discuss with the product management whether the documentation or the implementation is flawed.

Regards
Dietrich
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 12 years ago

Thanks for reporting. We are now tracking this as Mantis ID #21310
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 12 years ago

The Mantis ID #21310 is now under investigation.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 12 years ago

We will discuss with the product management whether the documentation or the implementation is flawed.

I know that S/MIME was selected first 18 months ago, and for a year before that when I was learning & testing Astaro Encryption.

Since the SMTP Proxy knows how to strip an S/MIME cert, but not a PGP key, it's reasonable to prefer S/MIME.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago in reply to BAlfson

I know that S/MIME was selected first 18 months ago, and for a year before that when I was learning & testing Astaro Encryption.

Since the SMTP Proxy knows how to strip an S/MIME cert, but not a PGP key, it's reasonable to prefer S/MIME.

Cheers - Bob

Unless strip PGP is an option [:D]

Sent from my iPhone using Astaro.org
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

any update on this?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel