mml-secure: function doubled, passwd chache, use-my-public key

mml-secure: function doubled, passwd chache, use-my-public key

[Uwe Brauer]

Hello

I just started to use mml together with gnupg, so far I have used
pgp2.6.x with mail-crypt.
I would appreciate if somebody could clarify the following points:

    - what is the difference between the following functions
      Possible completions are:
      mml-secure-message-sign-pgp
      and
      mml-secure-sign-pgp            

      mml-secure-message-sign-pgpauto
      and
      mml-secure-sign-pgpauto        
      the documentation is not very helpful

    - all  the time  I  sign, encrypt or   decrypt I  am asked my
      password,  could  that be  cached  say  for  5  min  (as in
      mailcrypt)

    - when encrypting, could  may own public  key be used as well
      (this way I can read that encrypted mail myself)


    - is there  now variable  to always sign  a msg  (I could put
      that into a hook I know.)

Thanks 

Uwe Brauer 

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Adam Sjøgren]

On Thu, 30 Jun 2005 21:59:18 +0000, Uwe wrote:

>     - when encrypting, could  may own public  key be used as well
>       (this way I can read that encrypted mail myself)

I use the line

 encrypt-to asjo@koldfront.dk

in my ~/.gnupg/options file to achieve that (I think, it's been a
while).


  Best regards,

-- 
 "Du danser godt, men ude af takt"                            Adam Sjøgren
                                                         asjo@koldfront.dk

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Uwe Brauer]

>>>>> "Adam" == Adam Sjøgren <asjo@koldfront.dk> writes:

    Adam> On Thu, 30 Jun 2005 21:59:18 +0000, Uwe wrote:
    >> - when encrypting, could  may own public  key be used as well
    >> (this way I can read that encrypted mail myself)

    Adam> I use the line

    Adam>  encrypt-to asjo@koldfront.dk

Thanks, looking at the mail-crypt code let me conclude that it
shouldn't be too difficult to implement that feature in mml, however
with your solution there may be is no need for such an implementation 

Uwe 

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Werner Koch]

On Thu, 30 Jun 2005 22:20:48 +0000, Uwe Brauer said:

> Thanks, looking at the mail-crypt code let me conclude that it
> shouldn't be too difficult to implement that feature in mml, however
> with your solution there may be is no need for such an implementation 

In fact --encrypt-to has been implemnted as a configuration file
option for gnupg and should in general not be used by applications.

Better keep such setups in gpg.conf than to have any frontend use its
won way of doing thsi pretty standard thing.


Salam-Shalom,

   Werner

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Jochen Küpper]

Uwe Brauer <oub-YB6e1s5WF/He5aOfsHch1g@public.gmane.org> writes:

> I just started to use mml together with gnupg, so far I have used
> pgp2.6.x with mail-crypt.

I use pgg, something you are (or should be) doing as well:
,----[ (info "(pgg)Top") ]
| This manual describes PGG.  PGG is an interface library between Emacs
| and various tools for secure communication.  PGG also provides a simple
| user interface to encrypt, decrypt, sign, and verify MIME messages.
`----

>     - what is the difference between the following functions

,----[ C-h f mml-secure-message-sign-pgp RET ]
| mml-secure-message-sign-pgp is an interactive compiled Lisp function in `mml-sec'.
| It is bound to <menu-bar> <Attachments> <PGP Sign>, C-c RET s o.
| (mml-secure-message-sign-pgp)
| 
| Add MML tag to encrypt/sign the entire message.
| 
| [back]
`----
,----[ C-h f mml-secure-sign-pgp RET ]
| mml-secure-sign-pgp is an interactive compiled Lisp function in `mml-sec'.
| It is bound to <menu-bar> <Attachments> <Secure MIME part> <PGP Sign Part>, C-c RET S o.
| (mml-secure-sign-pgp)
| 
| Add MML tags to PGP sign this MML part.
| 
| [back]
`----
So it seems that the first tags the whole email to be signed, whereas
the second tags a single part of a multipart message to be signed.

>     - all  the time  I  sign, encrypt or   decrypt I  am asked my
>       password,  could  that be  cached  say  for  5  min  (as in
>       mailcrypt)

,----[ (info "(pgg)Caching passphrase") ]
| PGG uses a simple passphrase caching mechanism, which is enabled by
| default.
| 
|  -- Variable: pgg-cache-passphrase
|      If non-`nil', store passphrases.  The default value of this
|      variable is `t'.  If you were worry about security issue, however,
|      you could stop caching with setting it `nil'.
| 
|  -- Variable: pgg-passphrase-cache-expiry
|      Elapsed time for expiration in seconds.
`----

>     - when encrypting, could  may own public  key be used as well
>       (this way I can read that encrypted mail myself)

This happens automatically for me and I do not have anything like that
specified in gpg.conf. Here is my (full) pgg configuration:
,----
| (setq pgg-cache-passphrase t
|       pgg-default-scheme 'gpg
|       pgg-default-user-id "CC1B0B4D"
|       pgg-passphrase-cache-expiry 1800
|       pgg-scheme 'gpg)
`----

Greetings,
Jochen
-- 
Einigkeit und Recht und Freiheit                http://www.Jochen-Kuepper.de
    Liberté, Égalité, Fraternité                GnuPG key: CC1B0B4D
        (Part 3 you find in my messages before fall 2003.)

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Adam Sjøgren]

On Fri, 01 Jul 2005 09:45:11 +0200, Jochen wrote:

> This happens automatically for me and I do not have anything like that
> specified in gpg.conf. Here is my (full) pgg configuration:

> ,----
> | (setq pgg-cache-passphrase t
> |       pgg-default-scheme 'gpg
> |       pgg-default-user-id "CC1B0B4D"
> |       pgg-passphrase-cache-expiry 1800
> |       pgg-scheme 'gpg)
> `----

Thanks for the heads up, I was using this old configuration:

  (require 'gpg)
  (setq mml2015-use 'gpg)
  (setq gpg-temp-directory (expand-file-name "~/.gnupg/tmp"))
  (setq gpg-command-default-alist (quote ((gpg . "gpg") (gpg-2comp . "gpg"))))
  (setq gpg-passphrase-timeout 36000) ; Ten hours
  (setq mm-verify-option 'known)
  (setq mm-decrypt-option 'known)
  (setq gnus-buttonized-mime-types '("multipart/signed" "multipart/encrypted"))

Which I've now happily updated to:

  (setq pgg-cache-passphrase t
        pgg-default-scheme 'gpg
        pgg-default-user-id "8EDD08DF"
        pgg-passphrase-cache-expiry 36000
        pgg-scheme 'gpg)
  (setq mm-verify-option 'known
        mm-decrypt-option 'known)
  (setq gnus-buttonized-mime-types '("multipart/signed" "multipart/encrypted"))

:-)

(I don't need the "encrypt-to asjo@koldfront.dk" in my
~/.gnupg/options for the emails to be encrypted for me any more,
probably because of the pgg-default-user-id...)


  Best regards,

    Adam

-- 
 "Du danser godt, men ude af takt"                            Adam Sjøgren
                                                         asjo@koldfront.dk

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Simon Josefsson]

Uwe Brauer <oub@mat.ucm.es> writes:

> Hello
>
> I just started to use mml together with gnupg, so far I have used
> pgp2.6.x with mail-crypt.
> I would appreciate if somebody could clarify the following points:

Hi!  Sure.

>     - what is the difference between the following functions
>       Possible completions are:
>       mml-secure-message-sign-pgp
>       and
>       mml-secure-sign-pgp            

The first tag the entire message for signing, the second only the
current part.  It is possible to have a multipart MIME document where
only one part is signed.  For normal use, you want the first one.

>       mml-secure-message-sign-pgpauto
>       and
>       mml-secure-sign-pgpauto        
>       the documentation is not very helpful

Same here, although pgpauto picks between PGP/MIME and Inline PGP
automatically.  If the message is multipart, PGP/MIME is used,
otherwise it uses inline PGP.  This appear to not be documented in the
Emacs MIME manual.  Anyone want to add something?  Further, I wonder
if it does the right thing with non-ASCII (then PGP/MIME should be
used) or format=flowed (PGP/MIME is needed).

>     - all  the time  I  sign, encrypt or   decrypt I  am asked my
>       password,  could  that be  cached  say  for  5  min  (as in
>       mailcrypt)

(setq pgg-passphrase-cache-expiry 162222)

The default is 16 seconds.  I think it should be changed to 5 minutes,
but it was discussed before.

>     - when encrypting, could  may own public  key be used as well
>       (this way I can read that encrypted mail myself)

The simplest is to do this via GnuPG.

>     - is there  now variable  to always sign  a msg  (I could put
>       that into a hook I know.)

You could invoke mml-secure-message-sign-pgpmime from a posting style,
I think.

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Werner Koch]

On Thu, 30 Jun 2005 21:59:18 +0000, Uwe Brauer said:

>     - all  the time  I  sign, encrypt or   decrypt I  am asked my
>       password,  could  that be  cached  say  for  5  min  (as in
>       mailcrypt)

For several years I am now using gpg-agent to manage passphrases and
caching.  The drawback with Gnus is that I still need to tweak the
passphrase providing and caching mechanism because its is useless and
actually dangerous to have when using gpg-agent.

I'd really appreciate if someone could add an option to disable the
passphrase stuff manually or automatically.

Using gpg-agent is now pretty simple as it has made its way into
Debian (apt-get install gnupg-agent).


Shalom-Salam,

   Werner

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Jochen Küpper]

Werner Koch <wk-G4NFlZKxdmTYtjvyW6yDsg@public.gmane.org> writes:

> I'd really appreciate if someone could add an option to disable the
> passphrase stuff manually or automatically.

What more than setting pgg-cache-passphrase to nil do you want?

,----[ C-h v pgg-cache-passphrase RET ]
| pgg-cache-passphrase's value is t
| 
| If t, cache passphrase.
| 
| You can customize this variable.
| 
| Defined in `pgg-def'.
`----

Greetings,
Jochen
-- 
Einigkeit und Recht und Freiheit                http://www.Jochen-Kuepper.de
    Liberté, Égalité, Fraternité                GnuPG key: CC1B0B4D
        (Part 3 you find in my messages before fall 2003.)

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Werner Koch]

On Fri, 01 Jul 2005 16:30:56 +0200, Jochen Küpper said:

> What more than setting pgg-cache-passphrase to nil do you want?

No, because Gnus will ask for the passphrase and the passphrase will
actually end up in the message if you accidently use it with enabled
gpg-agent.


Shalom-Salam,

   Werner

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Simon Josefsson]

Werner Koch <wk@gnupg.org> writes:

> On Thu, 30 Jun 2005 21:59:18 +0000, Uwe Brauer said:
>
>>     - all  the time  I  sign, encrypt or   decrypt I  am asked my
>>       password,  could  that be  cached  say  for  5  min  (as in
>>       mailcrypt)
>
> For several years I am now using gpg-agent to manage passphrases and
> caching.  The drawback with Gnus is that I still need to tweak the
> passphrase providing and caching mechanism because its is useless and
> actually dangerous to have when using gpg-agent.
>
> I'd really appreciate if someone could add an option to disable the
> passphrase stuff manually or automatically.

Does (setq pgg-cache-passphrase nil) help?  It appears to work here.

> Using gpg-agent is now pretty simple as it has made its way into
> Debian (apt-get install gnupg-agent).

rant:

latte:/home/jas# apt-get install gnupg-agent
Reading Package Lists... Done
Building Dependency Tree... Done
gnupg-agent is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.
latte:/home/jas#

Then why isn't used automatically?  To get it working I had to start
the daemon manually and add 'use-agent' to ~/.gnupg/gpg.conf.  Either
is hardly user friendly.  When I log on my Debian box, ssh-agent is
started and I didn't do anything to make it run.  Perhaps gpg-agent
can be started in a similar way.  And there seem to be some font bug
in the pinentry dialog window, presumably Unicode related.

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Werner Koch]

On Fri, 01 Jul 2005 16:43:53 +0200, Simon Josefsson said:

> Does (setq pgg-cache-passphrase nil) help?  It appears to work here.

Nope.

> Then why isn't used automatically?  To get it working I had to start

Isn't that a packaging feature? It was actually pretty hard to get it
into Debian; it was blocked by an Debian internal misunderstanding.
From what I heard, SuSE uses gpg-agent for a long time now and recent
KDE releases actually require gpg-agent.

> the daemon manually and add 'use-agent' to ~/.gnupg/gpg.conf.

Without that many people would inadvertly send the passphrase with the
message; consider the usual invocation pog gpg:

 (echo passphrase; cat message) | gpg --passphrase-fd 0 ... >out.msg

so it is far safer to require a conscious decision from the user.

> is hardly user friendly.  When I log on my Debian box, ssh-agent is
> started and I didn't do anything to make it run.  Perhaps gpg-agent
> can be started in a similar way.  And there seem to be some font bug
> in the pinentry dialog window, presumably Unicode related.

The latest release 1.9.17 may indeed be started like ssh-agent and may
actually replace ssh-agent (except for ssh v1 keys) - you can use a
simple wrapper script named ssh-agent and everything works. See the
info page.


Salam-Shalom,

   Werner

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Simon Josefsson]

Werner Koch <wk@gnupg.org> writes:

>> What more than setting pgg-cache-passphrase to nil do you want?
>
> No, because Gnus will ask for the passphrase and the passphrase will
> actually end up in the message if you accidently use it with enabled
> gpg-agent.

That doesn't happen here.  With pgg-c-p set to nil, Gnus won't ask me
for a passphrase, the pinentry dialog pop up instead (the first time),
and then message is signed.  No passphrase in the message either.

>> Then why isn't used automatically?  To get it working I had to start
>
> Isn't that a packaging feature?

Right.  It was just a rant.

>> the daemon manually and add 'use-agent' to ~/.gnupg/gpg.conf.
>
> Without that many people would inadvertly send the passphrase with the
> message; consider the usual invocation pog gpg:
>
>  (echo passphrase; cat message) | gpg --passphrase-fd 0 ... >out.msg
>
> so it is far safer to require a conscious decision from the user.

Ouch.  OTOH, it seem wrong in the long run.  Perhaps 'use-agent' can
be enabled in the template gpg.conf for future users.  But it will
take a while to fix all applications...  O well.

>> is hardly user friendly.  When I log on my Debian box, ssh-agent is
>> started and I didn't do anything to make it run.  Perhaps gpg-agent
>> can be started in a similar way.  And there seem to be some font bug
>> in the pinentry dialog window, presumably Unicode related.
>
> The latest release 1.9.17 may indeed be started like ssh-agent and may
> actually replace ssh-agent (except for ssh v1 keys) - you can use a
> simple wrapper script named ssh-agent and everything works. See the
> info page.

Cool!

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Werner Koch]

On Sat, 02 Jul 2005 21:01:47 +0200, Simon Josefsson said:

> That doesn't happen here.  With pgg-c-p set to nil, Gnus won't ask me
> for a passphrase, the pinentry dialog pop up instead (the first time),
> and then message is signed.  No passphrase in the message either.

Okay. I will check the next time I update Gnus.  Havent't done this
for quite some time.


Salam-Shalom,

   Werner

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Uwe Brauer]

>>>>> "Simon" == Simon Josefsson <jas@extundo.com> writes:

    Simon> Werner Koch <wk@gnupg.org> writes:
    >> On Thu, 30 Jun 2005 21:59:18 +0000, Uwe Brauer said:
    >> 
    >>> - all  the time  I  sign, encrypt or   decrypt I  am asked my
    >>> password,  could  that be  cached  say  for  5  min  (as in
    >>> mailcrypt)
    >> 

    >> Using gpg-agent is now pretty simple as it has made its way into
    >> Debian (apt-get install gnupg-agent).

    Simon> Then why isn't used automatically?  To get it working I had
    Simon>  to start  the  daemon   manually and  add  'use-agent'  to
    Simon> ~/.gnupg/gpg.conf.  Either is hardly user friendly.  When I
    Simon> log on my Debian box, ssh-agent  is started and I didn't do
    Simon> anything to make it run.   Perhaps gpg-agent can be started
    Simon> in a similar  way.  And there seem  to be some font  bug in
    Simon> the pinentry dialog window, presumably Unicode related.

Hi I just installed that agent as well 
my gpg.conf file just contains:
the line
use-agent

The daemon is running but once I set 

pgg-cache-passphrase nil 

Then I am *not* asked about the paasswd but I obtain


--8<------------------------schnipp------------------------->8---

gpg: NOTE: old default options file `/home/oub/.gnupg/options' ignored
[GNUPG:] USERID_HINT AD24CFB593B61FDD Uwe Brauer <oub@gmx.net>
[GNUPG:] NEED_PASSPHRASE AD24CFB593B61FDD AD24CFB593B61FDD 1 0
gpg: problem with the agent - disabling agent use
gpg: can't query password in batchmode
[GNUPG:] MISSING_PASSPHRASE
[GNUPG:] BAD_PASSPHRASE AD24CFB593B61FDD
gpg: Invalid passphrase; please try again ...
[GNUPG:] USERID_HINT AD24CFB593B61FDD Uwe Brauer <oub@gmx.net>
[GNUPG:] NEED_PASSPHRASE AD24CFB593B61FDD AD24CFB593B61FDD 1 0
gpg: can't query password in batchmode
[GNUPG:] MISSING_PASSPHRASE
[GNUPG:] BAD_PASSPHRASE AD24CFB593B61FDD
gpg: Invalid passphrase; please try again ...
[GNUPG:] USERID_HINT AD24CFB593B61FDD Uwe Brauer <oub@gmx.net>
[GNUPG:] NEED_PASSPHRASE AD24CFB593B61FDD AD24CFB593B61FDD 1 0
gpg: can't query password in batchmode
[GNUPG:] MISSING_PASSPHRASE
[GNUPG:] BAD_PASSPHRASE AD24CFB593B61FDD
gpg: skipped `oub': bad passphrase
gpg: signing failed: bad passphrase

gpg exited abnormally: '2'
--8<------------------------schnapp------------------------->8---

So I would appreciate if you could explain me your setting.

Uwe 

Re: mml-secure: function doubled, passwd chache, use-my-public key

[Simon Josefsson]

Uwe Brauer <oub@mat.ucm.es> writes:

> The daemon is running but once I set 
>
> pgg-cache-passphrase nil 
>
> Then I am *not* asked about the paasswd but I obtain
>
>
> --8<------------------------schnipp------------------------->8---
>
> gpg: NOTE: old default options file `/home/oub/.gnupg/options' ignored
> [GNUPG:] USERID_HINT AD24CFB593B61FDD Uwe Brauer <oub@gmx.net>
> [GNUPG:] NEED_PASSPHRASE AD24CFB593B61FDD AD24CFB593B61FDD 1 0
> gpg: problem with the agent - disabling agent use

That sounds like a gpg problem.  Did you start gpg-agent before emacs?
Emacs need to be started with the proper GPG_AGENT_INFO environment
variable set.  You can use M-x setenv RET too.

verify signature (was: mml-secure: function doubled, passwd chache, use-my-public key)

[Uwe Brauer]

Hello


May that is too trivial as well, but I did not find any specific
function for verifying a message which is just sign but not
necessarily encrypted mml-validate seems to be an candidate but the
documentation is not particularly helpful.


Uwe Brauer 

Re: verify signature

[Arne Jørgensen]

Uwe Brauer <oub@mat.ucm.es> writes:

> May that is too trivial as well, but I did not find any specific
> function for verifying a message which is just sign but not
> necessarily encrypted mml-validate seems to be an candidate but the
> documentation is not particularly helpful.

I normally use `gnus-summary-force-verify-and-decrypt' which is bound
to `W s'.

Kind regards,
-- 
Arne Jørgensen <http://arnested.dk/>