Re: PGG/GPG Integration bug (somewhat nasty & urgent), potential mailcrypt concept bug

[Simon Josefsson <jas@extundo.com>]

"Georg C. F. Greve" <greve@gnu.org> writes:

> I have to say that this is quite annoying and makes Gnus somewhat
> unusable right now. I see three potential fixes here:
>
>  a) create clean way to turn off all pgg handling of PIN's or
>     Passphrases, turning that part of the operation over to
>     gpg-agent.

Do `pgg-cache-passphrase' help?

>  c) fix decryption of messages that are encrypted for SmartCard

Can you tell whether this could be solved by a similar simple patch as
the patch you provided for the b) case?

> If you read the above carefully, you will find that indeed there
> something strange: a mail gets signed TWICE, apparently, once for
> sending, once for archival.
>
> This is bad for use in secure environments (SmartCards count
> signatures) and in fact annoying if you enter your PIN every time,
> which some paranoid people may feel like doing.
>
> So I wonder: Is there a striking reason to do this?

Yes, although somewhat obscure.

The encoding done for archiving purposes is not necessarily the same
as is used for outgoing mail.  It is the same if you mail and post a
message, there is one set of MIME rules for mail and another for news.
Gcc'ed messages might have attachments striped etc, so may be rather
different from what is actually sent.

While that is an explanation, I completely agree that the resulting
situation is sub-optimal.

Some solutions:

Use bcc.  Ugly workaround, but guarantee that you archive exactly what
was mailed (not posted though, since that could be different).

In the GCC handling, make Gnus notice whether the MIME-prepared
message, before PGP signing, is identical to the MIME-prepared message
that was used as input to PGP signing when sending the e-mail, and in
that case store the mailed copy rather than signing another copy of
the identical message.

>  gg>  b) fix the caching of PINs
>
> Fortunately, I was able to resolve this one myself.

Applied, thanks!