failed decryption on gwene group?

failed decryption on gwene group?

[Eric Abrahamsen]

I sort of doubt this is a gnus problem, but I've seen related
discussions here, and I don't know where else to post, so...

I'm subscribed to the Hacker News feed via gwene, as
gwene.com.ycombinator.news. Recently, opening the group has failed like
so:

gnutls.c: [1] Discarded message[136] due to invalid decryption
gnutls.c: [0] (Emacs) fatal error: Decryption has failed.
gnutls.c: [1] Note that the security level of the Diffie-Hellman key exchange has been lowered to 256 bits and this may allow decryption of the session data
gnutls.c: [1] Discarded message[33] due to invalid decryption
gnutls.c: [0] (Emacs) fatal error: Decryption has failed.
apply: Server closed connection

I'm on archlinux, running emacs-version "24.3.1" and the arch gnutls
package is at version 3.2.3-1.

For a while I had gnutls-min-prime-bits set to 1024 (something I found
from this list), which got rid of the warning on the third line. Then
arch's gnutls package was updated, and I started getting these
decryption errors, I removed that customization, thinking it was the
source of the problem, but now it appears it isn't -- I'm not getting
this error for any group but the ycombinator one, presumably because
it's got this one broken message.

I've catchup'd articles in this group several times, and over various
restarts and refreshes the unread count in the *Group* buffer continues
to be updated, but I can never enter the group.

Is something actually broken in this group's message data? Or maybe
there's something I can change in my setup to fix it? Any hints very
welcome...

Eric

Re: failed decryption on gwene group?

[Lars Magne Ingebrigtsen]

Eric Abrahamsen <eric@ericabrahamsen.net> writes:

> I sort of doubt this is a gnus problem, but I've seen related
> discussions here, and I don't know where else to post, so...
>
> I'm subscribed to the Hacker News feed via gwene, as
> gwene.com.ycombinator.news. Recently, opening the group has failed like
> so:
>
> gnutls.c: [1] Discarded message[136] due to invalid decryption
> gnutls.c: [0] (Emacs) fatal error: Decryption has failed.

[...]

> I'm on archlinux, running emacs-version "24.3.1" and the arch gnutls
> package is at version 3.2.3-1.

Ted, does Emacs support that gnutls version?

-- 
(domestic pets only, the antidote for overdose, milk.)
  No Gnus T-Shirt for sale: http://ingebrigtsen.no/no.php

Re: failed decryption on gwene group?

[Ted Zlatanov]

On Sat, 03 Aug 2013 15:11:00 +0200 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 

LMI> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>> I sort of doubt this is a gnus problem, but I've seen related
>> discussions here, and I don't know where else to post, so...
>> 
>> I'm subscribed to the Hacker News feed via gwene, as
>> gwene.com.ycombinator.news. Recently, opening the group has failed like
>> so:
>> 
>> gnutls.c: [1] Discarded message[136] due to invalid decryption
>> gnutls.c: [0] (Emacs) fatal error: Decryption has failed.

LMI> [...]

>> I'm on archlinux, running emacs-version "24.3.1" and the arch gnutls
>> package is at version 3.2.3-1.

LMI> Ted, does Emacs support that gnutls version?

3.2.x is ABI-compatible, so we call it with the same function calls as
any other GnuTLS version.  If 3.2.2 has bugs on Arch Linux, they seem
local because I haven't heard about this problem from anyone else.  To
be sure, simply use the `gnutls-cli' utility.  If it fails similarly,
the problem is not Emacs.

Ted

Re: failed decryption on gwene group?

[Eric Abrahamsen]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Sat, 03 Aug 2013 15:11:00 +0200 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 
>
> LMI> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>>> I sort of doubt this is a gnus problem, but I've seen related
>>> discussions here, and I don't know where else to post, so...
>>> 
>>> I'm subscribed to the Hacker News feed via gwene, as
>>> gwene.com.ycombinator.news. Recently, opening the group has failed like
>>> so:
>>> 
>>> gnutls.c: [1] Discarded message[136] due to invalid decryption
>>> gnutls.c: [0] (Emacs) fatal error: Decryption has failed.
>
> LMI> [...]
>
>>> I'm on archlinux, running emacs-version "24.3.1" and the arch gnutls
>>> package is at version 3.2.3-1.
>
> LMI> Ted, does Emacs support that gnutls version?
>
> 3.2.x is ABI-compatible, so we call it with the same function calls as
> any other GnuTLS version.  If 3.2.2 has bugs on Arch Linux, they seem
> local because I haven't heard about this problem from anyone else.  To
> be sure, simply use the `gnutls-cli' utility.  If it fails similarly,
> the problem is not Emacs.
>
> Ted

Oh, whoops, maybe I actually am using the gnutls-cli utility... At
least:

starttls-use-gnutls --> t
starttls-gnutls-program --> "gnutls-cli"

Sorry, should have mentioned that in the first post. What does this
mean, then? It's definitely not an emacs thing?

Thanks,
eric

Re: failed decryption on gwene group?

[Ted Zlatanov]

On Sun, 04 Aug 2013 10:18:21 +0800 Eric Abrahamsen <eric@ericabrahamsen.net> wrote: 

EA> Ted Zlatanov <tzz@lifelogs.com> writes:
>> 
>> 3.2.x is ABI-compatible, so we call it with the same function calls as
>> any other GnuTLS version.  If 3.2.2 has bugs on Arch Linux, they seem
>> local because I haven't heard about this problem from anyone else.  To
>> be sure, simply use the `gnutls-cli' utility.  If it fails similarly,
>> the problem is not Emacs.

EA> Oh, whoops, maybe I actually am using the gnutls-cli utility... At
EA> least:

EA> starttls-use-gnutls --> t
EA> starttls-gnutls-program --> "gnutls-cli"

EA> Sorry, should have mentioned that in the first post. What does this
EA> mean, then? It's definitely not an emacs thing?

If you see the Diffie-Hellman messages, you're probably using the
built-in GnuTLS integration.  I think the `starttls-use-gnutls' and such
are deprecated now.

Regardless, to know for sure if GnuTLS 3.2.2 has issues, call
its `gnutls-cli' from the command line against your server and port.
That will tell you unambiguously.

Ted

Re: failed decryption on gwene group?

[Eric Abrahamsen]

Ted Zlatanov <tzz@lifelogs.com> writes:

> On Sun, 04 Aug 2013 10:18:21 +0800 Eric Abrahamsen <eric@ericabrahamsen.net> wrote: 
>
> EA> Ted Zlatanov <tzz@lifelogs.com> writes:
>>> 
>>> 3.2.x is ABI-compatible, so we call it with the same function calls as
>>> any other GnuTLS version.  If 3.2.2 has bugs on Arch Linux, they seem
>>> local because I haven't heard about this problem from anyone else.  To
>>> be sure, simply use the `gnutls-cli' utility.  If it fails similarly,
>>> the problem is not Emacs.
>
> EA> Oh, whoops, maybe I actually am using the gnutls-cli utility... At
> EA> least:
>
> EA> starttls-use-gnutls --> t
> EA> starttls-gnutls-program --> "gnutls-cli"
>
> EA> Sorry, should have mentioned that in the first post. What does this
> EA> mean, then? It's definitely not an emacs thing?
>
> If you see the Diffie-Hellman messages, you're probably using the
> built-in GnuTLS integration.  I think the `starttls-use-gnutls' and such
> are deprecated now.
>
> Regardless, to know for sure if GnuTLS 3.2.2 has issues, call
> its `gnutls-cli' from the command line against your server and port.
> That will tell you unambiguously.

Looks like it's okay from the command line:

$ gnutls-cli -s -p 563 news.gmane.org
Processed 157 CA certificate(s).
Resolving 'news.gmane.org'...
Connecting to '80.91.229.13:563'...

- Simple Client Mode:

Then it waits for a prompt. I'm not quite sure that's conclusive,
though: I'm able to open most groups through this server, right now it
only appears to be two or three gwene groups in particular that fail to
decrypt properly...

Re: failed decryption on gwene group?

[Lars Magne Ingebrigtsen]

Eric Abrahamsen <eric@ericabrahamsen.net> writes:

> $ gnutls-cli -s -p 563 news.gmane.org
> Processed 157 CA certificate(s).
> Resolving 'news.gmane.org'...
> Connecting to '80.91.229.13:563'...
>
> - Simple Client Mode:
>
> Then it waits for a prompt. I'm not quite sure that's conclusive,
> though: I'm able to open most groups through this server, right now it
> only appears to be two or three gwene groups in particular that fail to
> decrypt properly...

No, at that point it hasn't started doing anything encryption-ey, so
it's not conclusive.

Port 563 isn't doing STARTTLS, but straight TLS.  So drop the -s and see
what it says.

-- 
(domestic pets only, the antidote for overdose, milk.)
  No Gnus T-Shirt for sale: http://ingebrigtsen.no/no.php
  and http://lars.ingebrigtsen.no/2013/08/twenty-years-of-september.html

Re: failed decryption on gwene group?

[Eric Abrahamsen]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>
>> $ gnutls-cli -s -p 563 news.gmane.org
>> Processed 157 CA certificate(s).
>> Resolving 'news.gmane.org'...
>> Connecting to '80.91.229.13:563'...
>>
>> - Simple Client Mode:
>>
>> Then it waits for a prompt. I'm not quite sure that's conclusive,
>> though: I'm able to open most groups through this server, right now it
>> only appears to be two or three gwene groups in particular that fail to
>> decrypt properly...
>
> No, at that point it hasn't started doing anything encryption-ey, so
> it's not conclusive.
>
> Port 563 isn't doing STARTTLS, but straight TLS.  So drop the -s and see
> what it says.

Without the "-s" option I get an untrusted certificate error:

$ gnutls-cli -p 563 news.gmane.org
Processed 157 CA certificate(s).
Resolving 'news.gmane.org'...
Connecting to '80.91.229.13:563'...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
 - subject `C=NO,ST=Some-State,O=Gmane,CN=news.gmane.org', issuer `C=NO,ST=Some-State,O=Gmane,CN=news.gmane.org', RSA key 1024 bits, signed using RSA-SHA1, activated `2011-12-04 06:38:42 UTC', expires `2014-12-03 06:38:42 UTC', SHA-1 fingerprint `c0ec2f016cff4a43c1a7c7834b480b3ac54e90f9'
	Public Key Id:
		d21a01452b5a9b06106946930e64717869ff7ae0
	Public key's random art:
		+--[ RSA 1024]----+
		|=O+.ooo          |
		|+*o+ . .         |
		|= + + o          |
		| . + = o         |
		|  . + + S        |
		|   . . =         |
		|    . +          |
		|     E .         |
		|      .          |
		+-----------------+

- Status: The certificate is NOT trusted. The certificate issuer is unknown. 
*** Verifying server certificate failed...
*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.

Re: failed decryption on gwene group?

[Julien Danjou]

[-- Attachment #1: Type: text/plain, Size: 231 bytes --]

On Mon, Aug 05 2013, Eric Abrahamsen wrote:

> Without the "-s" option I get an untrusted certificate error:

Add --insecure.

-- 
Julien Danjou
// Free Software hacker / freelance consultant
// http://julien.danjou.info

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 835 bytes --]

Re: failed decryption on gwene group?

[Eric Abrahamsen]

On 08/05/13 15:41 PM, Julien Danjou wrote:
> On Mon, Aug 05 2013, Eric Abrahamsen wrote:
>
>> Without the "-s" option I get an untrusted certificate error:
>
> Add --insecure.
>
> -- 
> Julien Danjou
> // Free Software hacker / freelance consultant
> // http://julien.danjou.info

Now it complains about the unverified certificate, gets on with things,
and the last few lines are:

*** Verifying server certificate failed...
- Description: (TLS1.0-PKIX)-(RSA)-(AES-128-CBC)-(SHA1)
- Session ID: CE:A2:BB:FD:5D:50:D1:01:F9:C3:B9:6C:4B:1B:C4:3D:14:15:A2:EA:8D:AA:B5:6D:75:1A:63:35:55:6A:B8:06
- Version: TLS1.0
- Key Exchange: RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

- Simple Client Mode:

200 news.gmane.org InterNetNews NNRP server INN 2.5.1 ready (posting ok)
- Peer has closed the GnuTLS connection


There's about a ten-second wait between the "200" success message and
the closing of the connection.

Thanks to you all for walking me through this, hope we're almost there!

E

Re: failed decryption on gwene group?

[Adam Sjøgren]

Eric Abrahamsen <eric@ericabrahamsen.net> writes:

> There's about a ten-second wait between the "200" success message and
> the closing of the connection.

That is probably just an inactivity time out. "Oh, you are the silent
type? Ok, I can't help you - bye bye."

Try typing something, say "GROUP gmane.discuss".


  Best regards,

    Adam

-- 
 "Världens kapare meddelar att millimeterrättvisa inte        Adam Sjøgren
  kommer införas i år heller"                            asjo@koldfront.dk

Re: failed decryption on gwene group?

[Eric Abrahamsen]

asjo@koldfront.dk (Adam Sjøgren) writes:

> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>
>> There's about a ten-second wait between the "200" success message and
>> the closing of the connection.
>
> That is probably just an inactivity time out. "Oh, you are the silent
> type? Ok, I can't help you - bye bye."
>
> Try typing something, say "GROUP gmane.discuss".

Okay, thanks. I tried typing the names of two groups that currently
won't open for me in gnus:

GROUP gwene.com.ycombinator.news
211 108741 1 108741 gwene.com.ycombinator.news
GROUP gmane.emacs.help
211 91040 1 92753 gmane.emacs.help

That looks like success to me! What now?

Re: failed decryption on gwene group?

[Eric Abrahamsen]

Eric Abrahamsen <eric@ericabrahamsen.net> writes:

> asjo@koldfront.dk (Adam Sjøgren) writes:
>
>> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>>
>>> There's about a ten-second wait between the "200" success message and
>>> the closing of the connection.
>>
>> That is probably just an inactivity time out. "Oh, you are the silent
>> type? Ok, I can't help you - bye bye."
>>
>> Try typing something, say "GROUP gmane.discuss".
>
> Okay, thanks. I tried typing the names of two groups that currently
> won't open for me in gnus:
>
> GROUP gwene.com.ycombinator.news
> 211 108741 1 108741 gwene.com.ycombinator.news
> GROUP gmane.emacs.help
> 211 91040 1 92753 gmane.emacs.help
>
> That looks like success to me! What now?

I tried an ARTICLE command, and that worked as well. I asked for article
number 33, as I was seeing this in *Messages*: gnutls.c: [1] Discarded
message[33] due to invalid decryption.

I guess I don't really think they refer to the same article, but what
the hey. Anyway, I was able to retrieve the message successfully.

Re: failed decryption on gwene group?

[Eric Abrahamsen]

Eric Abrahamsen <eric@ericabrahamsen.net> writes:

> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>
>> asjo@koldfront.dk (Adam Sjøgren) writes:
>>
>>> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>>>
>>>> There's about a ten-second wait between the "200" success message and
>>>> the closing of the connection.
>>>
>>> That is probably just an inactivity time out. "Oh, you are the silent
>>> type? Ok, I can't help you - bye bye."
>>>
>>> Try typing something, say "GROUP gmane.discuss".
>>
>> Okay, thanks. I tried typing the names of two groups that currently
>> won't open for me in gnus:
>>
>> GROUP gwene.com.ycombinator.news
>> 211 108741 1 108741 gwene.com.ycombinator.news
>> GROUP gmane.emacs.help
>> 211 91040 1 92753 gmane.emacs.help
>>
>> That looks like success to me! What now?
>
> I tried an ARTICLE command, and that worked as well. I asked for article
> number 33, as I was seeing this in *Messages*: gnutls.c: [1] Discarded
> message[33] due to invalid decryption.

Never mind, all the misbehaving groups show the same "message[33]" error.

Re: failed decryption on gwene group?

[Eric Abrahamsen]

Eric Abrahamsen <eric@ericabrahamsen.net> writes:

> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>
>> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>>
>>> asjo@koldfront.dk (Adam Sjøgren) writes:
>>>
>>>> Eric Abrahamsen <eric@ericabrahamsen.net> writes:
>>>>
>>>>> There's about a ten-second wait between the "200" success message and
>>>>> the closing of the connection.
>>>>
>>>> That is probably just an inactivity time out. "Oh, you are the silent
>>>> type? Ok, I can't help you - bye bye."
>>>>
>>>> Try typing something, say "GROUP gmane.discuss".
>>>
>>> Okay, thanks. I tried typing the names of two groups that currently
>>> won't open for me in gnus:
>>>
>>> GROUP gwene.com.ycombinator.news
>>> 211 108741 1 108741 gwene.com.ycombinator.news
>>> GROUP gmane.emacs.help
>>> 211 91040 1 92753 gmane.emacs.help
>>>
>>> That looks like success to me! What now?
>>
>> I tried an ARTICLE command, and that worked as well. I asked for article
>> number 33, as I was seeing this in *Messages*: gnutls.c: [1] Discarded
>> message[33] due to invalid decryption.
>
> Never mind, all the misbehaving groups show the same "message[33]" error.

Bah, now it seems to have stopped doing it (actually, all nntp-related
actions suddenly seem to be going a lot faster). I have no idea if
something got updated (I've been keeping up with gnus git) or if this is
just a temporary reprieve based on some alignment of the stars, but
there it is...

Re: failed decryption on gwene group?

[Wolfgang Jenkner]

On Sat, Aug 03 2013, Eric Abrahamsen wrote:

> gnutls.c: [1] Discarded message[33] due to invalid decryption
> gnutls.c: [0] (Emacs) fatal error: Decryption has failed.
> apply: Server closed connection

> I'm on archlinux, running emacs-version "24.3.1" and the arch gnutls
> package is at version 3.2.3-1.

I saw this error with gnutls 3.2.2 (but not with 3.2.0).  I haven't seen
it after upgrading to (vanilla) 3.2.3.

Perhaps, the archlinux patch[1], which was first applied to 3.2.2, is
now stale and toxic (at least its second hunk)?

[1] https://projects.archlinux.org/svntogit/packages.git/commit/trunk/tls_fix.diff?h=packages/gnutls&id=bd985e895a39a755c350c7433a1edc1f8a0bd06e 

Wolfgang