Bug 27236

Summary:	encryptpad/encryotcli can't decrypt its encrypted files
Product:	Mageia	Reporter:	Nicolas Pomarède <npomarede>
Component:	RPM Packages	Assignee:	Stig-Ørjan Smelror <smelror>
Status:	RESOLVED OLD	QA Contact:
Severity:	critical
Priority:	Normal	Keywords:	Triaged
Version:	7
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	encryptpad-cli-0.4.0.4-5.mga7	CVE:
Status comment:

Description Nicolas Pomarède 2020-09-01 20:52:22 CEST

Description of problem:

Under mageia 7, encryptpad/encryptcli seem broken.
If I try to decrypt a gpg file encrypted with  EncryptPad 0.5.0.0 from cauldron, then it fails with this message :

Cannot decrypt the file: Incorrect passphrase

Worse, if I encrypt the file with encryptcli under mageia7 and try to decrypt it under mageia7 too, then it fails.
So, encryptcli seems unable to decrypt the files it produces (I don't know if the problem is only with passphrase or with keyfile too)


Version-Release number of selected component (if applicable):
encryptpad-cli-0.4.0.4-5.mga7
encryptpad-qt5-0.4.0.4-5.mga7


How reproducible:
always

Steps to Reproduce:

- create a dummy text file to encrypt : test.txt
- encrypt test.txt with the default parameters :

encryptcli -e test.txt > test.gpg
when prompted, enter a passphrase twice, for example "mageia"

now, try to decrypt test.gpg
encryptcli -d test.gpg
when prompted, enter the passphrase "mageia"; it should fail with this message :

Cannot decrypt the file: Incorrect passphrase

Possible fix :
backport encryptpad/encryptcli from cauldron to mageia 7 :
encryptpad-cli-0.5.0.0-2.mga8
encryptpad-qt5-0.5.0.0-2.mga8

I mark this bug as "critical" because if you encrypt some sensitive files and delete them after to keep only the gpg files, then it's quite possible you lost your data as you won't be able to decrypt it.

Comment 1 Nicolas Pomarède 2020-09-01 20:55:44 CEST

more infos : although encryptcli/encryptpad won't be able to decrypt the files under mageia7, if the files are copied to a cauldron PC with encryptpad version 5, then it's possible to decrypt the files with version 5 under cauldron.

so, data are not lost and can be recovered with a more recent version, but it's still a severe bug.

Comment 2 Aurelien Oudelet 2020-09-01 22:12:29 CEST

Hi, thanks for reporting this bug.
Sorry for this risk of data loss.

According to this:
In reply to Nicolas Pomarède from comment #1)
> more infos : although encryptcli/encryptpad won't be able to decrypt the
> files under mageia7, if the files are copied to a cauldron PC with
> encryptpad version 5, then it's possible to decrypt the files with version 5
> under cauldron.
> 
> so, data are not lost and can be recovered with a more recent version, but
> it's still a severe bug.

Some changes seem done upstream between version Mageia 7 ships and version today in Cauldron.

Assigned to the package maintainer.

(Packagers: Please set the status to 'assigned' if you are working on it)

Assignee: bugsquad => smelror
Keywords: (none) => Triaged

Comment 3 Aurelien Oudelet 2021-07-06 13:17:40 CEST

Mageia 7 is EOL since July 1st 2021.
There will not have any further bugfix for this release.

You are encouraged to upgrade to Mageia 8 as soon as possible.

@reporter, if this bug still apply with Mageia 8, please let us know it.

@packager, if you work on the Mageia 7 version of your package, please check the Mageia 8 package if issue is also present. In this case, please fix the Mageia 8 version instead.

This bug report will be closed OLD if there is no further notice within 1st September 2021.

Comment 4 Marja Van Waes 2021-09-07 14:10:52 CEST

Hi bug reporter and hi assignee and others involved,

Please reopen this bug report if it is still valid for Mageia 8 or 9(cauldron), and change "Version:" in the upper left of this report accordingly.

This report is being closed as OLD because it was filed against Mageia 7, for which  support ended on June 30th 2021.

Thanks,
Marja

Status: NEW => RESOLVED
Resolution: (none) => OLD