Problem with new public Key

[wiegandr]

Hello,
we changed ower key for pgp a while ago. Some partners now send us mails te gateway can not decrypt.
We create a new key with ed25519 and import this key to the gateway. When I test sending a mail with this key I can send it via Thunderbird from private to the mail behind the gateway. But our partner see on his gateway that the message was encrypted, but the ciphermail gateway did not decrypt the message. I just receive an asc file.
So to verify we also create a RSA4096 ke also with no success.
When the partner changed back to 2048 everthing is fine.
Is it possible to modify the log settings so I can see for what header the ciphermail gateway is looking or some other possibility to check where the problem is located.

Regards
Robert

[martijn]

To make sure I understand the issue, so you can send an email encrypted with ed25519 from your Thunderbird to the gateway and this email is then decrypted but, not when your partner sends the email?

[wiegandr]

Correct. The email from Thunderbird is working.
The partner gateway is “Julia Mailoffice” and the log from them say it was encrypted correctly. I cann decrypt the received *asc file local via gpg so the key is the correct one.

[wiegandr]

Maybe some usefull header from t different senders where the message isn’t decrypted when it comes with ed25519

Content-Type: multipart/encrypted; boundary=--mime6428d0b64adc0a4ee6cd2e1cd7b42916; protocol="application/pgp-encrypted"

----mime6428d0b64adc0a4ee6cd2e1cd7b42916
Content-Type: application/pgp-encrypted

Version: 1.0

----mime6428d0b64adc0a4ee6cd2e1cd7b42916
Content-Type: application/octet-stream; name=encrypted.asc

and the other

Content-Type: multipart/encrypted;
boundary=NoSpamProxy_efaed941-2aae-4e6b-a260-2c1430f86bf6; 
protocol="application/pgp-encrypted"
Content-Language: de-DE

This is an OpenPGP/MIME encrypted message (RFC 2440 and 3156)

--NoSpamProxy_efaed941-2aae-4e6b-a260-2c1430f86bf6
Content-Type: application/pgp-encrypted;
Content-Disposition: inline;

Version: 1
--NoSpamProxy_efaed941-2aae-4e6b-a260-2c1430f86bf6
Content-Type: application/octet-stream; charset=us-ascii; name=encrypted.asc
Content-Disposition: attachment; filename=encrypted.asc

[martijn]

Do you see any error message in the MPA log? Or some warning?

[wiegandr]

I found a error, but this is strange. From the partner I get this error:

03 Apr 2025 11:00:45 | ERROR Unhandled RuntimeException. (mitm.application.djigzo.james.mailets.PGPHandler) [Spool Thread #0]
java.lang.IllegalArgumentException: Invalid Curve25519 public key
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder.decryptSessionData(Unknown Source) ~[bcpg.jar:1.71.00.0]
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder.access$400(Unknown Source) ~[bcpg.jar:1.71.00.0]
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder$2.recoverSessionData(Unknown Source) ~[bcpg.jar:1.71.00.0]
at org.bouncycastle.openpgp.PGPPublicKeyEncryptedData.getSessionKey(Unknown Source) ~[bcpg.jar:1.71.00.0]
at org.bouncycastle.openpgp.PGPPublicKeyEncryptedData.getDataStream(Unknown Source) ~[bcpg.jar:1.71.00.0]
at mitm.common.security.openpgp.PGPHandler.handleEncryptedDataList(PGPHandler.java:272) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:180) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:141) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPMIMEHandler.handlePGPMIMEEncrypted(PGPMIMEHandler.java:706) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPMIMEHandler.handleMessage(PGPMIMEHandler.java:270) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1125) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1102) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.PGPHandler.serviceMailTransacted(PGPHandler.java:498) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:137) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.hibernate.DatabaseActionExecutorImpl$1.doAction(DatabaseActionExecutorImpl.java:164) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.hibernate.DatabaseActionExecutorImpl.executeTransaction(DatabaseActionExecutorImpl.java:81) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.hibernate.DatabaseActionExecutorImpl.executeTransaction(DatabaseActionExecutorImpl.java:158) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet.serviceMail(AbstractTransactedMailet.java:122) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.AbstractDjigzoMailet.service(AbstractDjigzoMailet.java:281) [ciphermail-core.jar:5.5.3.0g99d2faca]
at org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:424) [james-2.3.1.jar:?]
at org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:405) [james-2.3.1.jar:?]
at org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:309) [james-2.3.1.jar:?]
at java.lang.Thread.run(Thread.java:750) [?:1.8.0_372]

Same key from Thunderbird just show:

INFO Message has been PGP decrypted;

[wiegandr]

and here the log entry from the other partner, a bit different

02 Apr 2025 15:35:56 | ERROR Database error servicing email. (mitm.application.djigzo.james.mailets.PGPHandler) [Spool Thread #3]
mitm.common.hibernate.DatabaseException: javax.mail.MessagingException: Error handling message;
nested exception is:
java.io.IOException: unknown packet type encountered: 20
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:140) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.hibernate.DatabaseActionExecutorImpl$1.doAction(DatabaseActionExecutorImpl.java:164) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.hibernate.DatabaseActionExecutorImpl.executeTransaction(DatabaseActionExecutorImpl.java:81) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.hibernate.DatabaseActionExecutorImpl.executeTransaction(DatabaseActionExecutorImpl.java:158) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet.serviceMail(AbstractTransactedMailet.java:122) [ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.AbstractDjigzoMailet.service(AbstractDjigzoMailet.java:281) [ciphermail-core.jar:5.5.3.0g99d2faca]
at org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:424) [james-2.3.1.jar:?]
at org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:405) [james-2.3.1.jar:?]
at org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:309) [james-2.3.1.jar:?]
at java.lang.Thread.run(Thread.java:750) [?:1.8.0_372]
Caused by: javax.mail.MessagingException: Error handling message
at mitm.application.djigzo.james.mailets.PGPHandler.serviceMailTransacted(PGPHandler.java:501) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:137) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
... 9 more
Caused by: java.io.IOException: unknown packet type encountered: 20
at org.bouncycastle.bcpg.BCPGInputStream.readPacket(Unknown Source) ~[bcpg.jar:1.71.00.0]
at org.bouncycastle.openpgp.PGPEncryptedDataList.<init>(Unknown Source) ~[bcpg.jar:1.71.00.0]
at org.bouncycastle.openpgp.PGPObjectFactory.nextObject(Unknown Source) ~[bcpg.jar:1.71.00.0]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:163) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:141) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPMIMEHandler.handlePGPMIMEEncrypted(PGPMIMEHandler.java:706) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPMIMEHandler.handleMessage(PGPMIMEHandler.java:270) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1125) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1102) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.PGPHandler.serviceMailTransacted(PGPHandler.java:498) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:137) ~[ciphermail-core.jar:5.5.3.0g99d2faca]
... 9 more

[wiegandr]

Dear Martijn,

I found the solution. The ed25519 key I had generated with gpg2 had the following attributes:
Enc.: AES256, AES192, AES, 3DES
AEAD: OCB
Digest: SHA512, SHA384, SHA256, SHA224, SHA1
Compression: ZLIB, BZIP2, ZIP, not comp
Attributes: MDC, AEAD, Keyserver no-modify

The problem seems to be the AEAD, after I removed the attribute, no one can use it (without manuell modification) so I can not get a message with the following info if I use gpg2 external:
AES256.OCB

That seems the problem. This attribute is for example also added in Outlook and the gpg Addon, if the generate key supports it.

So maybe a update is possible where the AEAD attribute is supported, because anyone could add this attribute, if he modify the key or the gateway on the other hand use it.

Regards
Robert

[martijn]

Can you try the version from the following post? This contains some updated libraries

Aes128 gcm / aes128 cbc?

Hello Martijn, would it be possible to provide the GCM support in a hotfix? From 01.10. new regulations apply and Ciphermail would no longer be edi-compliant in Germany. I would appreciate a prompt reply on this topic. Many thanks in advance

We have been working for the past couple of years on a major rewrite. It should be ready soon but if the above version is not working for you, you might try the new version.

[wiegandr]

I updated to the new version.
Still the same problem with AES.CFB
Here the log, maybe it helps you.

07 May 2025 12:22:40 | ERROR Database error servicing email. (mitm.application.djigzo.james.mailets.PGPHandler) [Spool Thread #1]
mitm.common.hibernate.DatabaseException: javax.mail.MessagingException: Error handling message;
nested exception is:
java.io.IOException: org.bouncycastle.openpgp.PGPException: error decrypting session data: Invalid Curve25519 public key
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:140) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.hibernate.DatabaseActionExecutorImpl$1.doAction(DatabaseActionExecutorImpl.java:164) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.hibernate.DatabaseActionExecutorImpl.executeTransaction(DatabaseActionExecutorImpl.java:81) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.hibernate.DatabaseActionExecutorImpl.executeTransaction(DatabaseActionExecutorImpl.java:158) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet.serviceMail(AbstractTransactedMailet.java:122) [ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.AbstractDjigzoMailet.service(AbstractDjigzoMailet.java:281) [ciphermail-core.jar:5.5.3.52gee712256]
at org.apache.james.transport.LinearProcessor.service(LinearProcessor.java:424) [james-2.3.1.jar:?]
at org.apache.james.transport.JamesSpoolManager.process(JamesSpoolManager.java:405) [james-2.3.1.jar:?]
at org.apache.james.transport.JamesSpoolManager.run(JamesSpoolManager.java:309) [james-2.3.1.jar:?]
at java.lang.Thread.run(Thread.java:750) [?:1.8.0_452]
Caused by: javax.mail.MessagingException: Error handling message
at mitm.application.djigzo.james.mailets.PGPHandler.serviceMailTransacted(PGPHandler.java:501) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:137) ~[ciphermail-core.jar:5.5.3.52gee712256]
... 9 more
Caused by: java.io.IOException: org.bouncycastle.openpgp.PGPException: error decrypting session data: Invalid Curve25519 public key
at mitm.common.security.openpgp.PGPMIMEHandler.handlePGPMIMEEncrypted(PGPMIMEHandler.java:737) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPMIMEHandler.handleMessage(PGPMIMEHandler.java:270) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1125) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1102) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.PGPHandler.serviceMailTransacted(PGPHandler.java:498) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:137) ~[ciphermail-core.jar:5.5.3.52gee712256]
... 9 more
Caused by: org.bouncycastle.openpgp.PGPException: error decrypting session data: Invalid Curve25519 public key
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder.decryptSessionData(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder.access$500(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder$2.recoverSessionData(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.PGPPublicKeyEncryptedData.getSessionKey(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.PGPPublicKeyEncryptedData.getDataStream(Unknown Source) ~[bcpg.jar:?]
at mitm.common.security.openpgp.PGPHandler.handleEncryptedDataList(PGPHandler.java:272) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:180) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:141) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPMIMEHandler.handlePGPMIMEEncrypted(PGPMIMEHandler.java:706) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPMIMEHandler.handleMessage(PGPMIMEHandler.java:270) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1125) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1102) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.PGPHandler.serviceMailTransacted(PGPHandler.java:498) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:137) ~[ciphermail-core.jar:5.5.3.52gee712256]
... 9 more
Caused by: java.lang.IllegalArgumentException: Invalid Curve25519 public key
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder.decryptSessionData(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder.access$500(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.operator.jcajce.JcePublicKeyDataDecryptorFactoryBuilder$2.recoverSessionData(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.PGPPublicKeyEncryptedData.getSessionKey(Unknown Source) ~[bcpg.jar:?]
at org.bouncycastle.openpgp.PGPPublicKeyEncryptedData.getDataStream(Unknown Source) ~[bcpg.jar:?]
at mitm.common.security.openpgp.PGPHandler.handleEncryptedDataList(PGPHandler.java:272) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:180) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPHandler.handle(PGPHandler.java:141) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPMIMEHandler.handlePGPMIMEEncrypted(PGPMIMEHandler.java:706) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPMIMEHandler.handleMessage(PGPMIMEHandler.java:270) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1125) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.common.security.openpgp.PGPRecursiveValidatingMIMEHandler.handleMessage(PGPRecursiveValidatingMIMEHandler.java:1102) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.PGPHandler.serviceMailTransacted(PGPHandler.java:498) ~[ciphermail-core.jar:5.5.3.52gee712256]
at mitm.application.djigzo.james.mailets.AbstractTransactedMailet$1.doAction(AbstractTransactedMailet.java:137) ~[ciphermail-core.jar:5.5.3.52gee712256]
... 9 more

I’m in contact with the other company to change the encryption.
Just for you, the other company use NoSpamProxy

Regards