EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Simple String Encryption

Also by EldoS: BizCrypto
Components for BizTalk® and SQL Server® Integration Services that let you securely store and transfer information in your business automation solutions.
#6040
Posted: 04/26/2008 03:09:19
by Ken Ivanov (EldoS Corp.)

1) Regarding 'bad session key' issue: please try to play with UseOldPackets, UseNewFeatures and ProtectionLevel properties and check if some combination of them helps.

2) there's no such concept as 'detached version of the key'. Please ask your client to provide a message he is able to process so that we could give some advice to you.
#6043
Posted: 04/28/2008 14:15:56
by Joe King (Standard support level)
Joined: 04/04/2008
Posts: 16

Quote
Innokentiy Ivanov wrote:
1) Regarding 'bad session key' issue: please try to play with UseOldPackets, UseNewFeatures and ProtectionLevel properties and check if some combination of them helps.

2) there's no such concept as 'detached version of the key'. Please ask your client to provide a message he is able to process so that we could give some advice to you.


Wow, it seems I am hitting every possible road block on this one. Turns out the client is using PGP 6.5.2, which has known issues ([URL=http://www.cert.org/advisories/CA-2000-18.html]CERT Advisory[/URL]) with respect to signing. From what I've read on these forums, other individuals have run into this [URL=http://www.eldos.com/forum/read.php?FID=7&TID=734]very[/URL] [URL=http://www.eldos.com/forum/read.php?FID=7&TID=751]same[/URL] [URL=http://www.eldos.com/forum/read.php?FID=7&TID=462]problem[/URL]. My code appears to be correct when I compare it to what other forum users have supplied. Thus, I have forwarded this advisory to the client and await further details.

Thank you, gentlemen, for all of your help.
#6083
Posted: 05/02/2008 12:09:40
by Joe King (Standard support level)
Joined: 04/04/2008
Posts: 16

Quote
Innokentiy Ivanov wrote:
Please re-check that you are passing the right keys to the EncryptingKeys and SigningKeys keyrings. The first one should only contain public keys which the message should be encrypted to, and the second one should only contain secret keys which you plan to create signatures with (in most cases EncryptingKeys contains a single public key of recipient, and SigningKeys contains a single signing key). It is likely that in your case the SigningKeys keyring contains other secret keys [with different passwords], which are unsuccessfully tried by TElPGPWriter.


I figured I back up a few steps as far as the signing issue goes. I just tried generating a brand new key pair w/ passphrase (using PGP Desktop 9.8) and then exported the secret key (to a .skr file). I tried using the sample application to sign a plain text file, pasting the exact passphrase into the "Password for secret key" field, but to no avail. I am still getting the "Signing failed" error. Why is my passphrase not working when I know it is correct?
#6084
Posted: 05/02/2008 12:24:42
by Ken Ivanov (EldoS Corp.)

Is the password accepted by the demo application if the sample keys (%SBB%\PGPKeys\secbbox.*) are used? The password for SBB secret keys is "password" (without quotes).
#6085
Posted: 05/02/2008 13:00:47
by Joe King (Standard support level)
Joined: 04/04/2008
Posts: 16

Quote
Innokentiy Ivanov wrote:
Is the password accepted by the demo application if the sample keys (%SBB%\PGPKeys\secbbox.*) are used? The password for SBB secret keys is "password" (without quotes).


Yes, these do work. As for my keys, the client sent me a .asc file containing their public key. I then imported this into PGP Desktop and exported a .pkr file. Then, I exported my public and secret keys from PGP Desktop (to .pkr and .skr respectively). I copied the client secring.skr and my pubring.pkr over to the keys folder. When I go into the sample app, the public key dropdown list shows an entry for both the client and myself and the secret key dropdown list only shows myself. I select a file, choose the client entry for public key, my entry for the secret key, enter my passphrase, and click enter and I get the sign failed error.

The only thing I can think of is that somehow my public key is getting included in the skr file and the sample app gets confused when trying to match up the passphrase. Perhaps you can recommend another program for generating these keyring files that might yield better results?
#6086
Posted: 05/02/2008 13:18:09
by Ken Ivanov (EldoS Corp.)

OpenPGPBlackbox should process keyrings created by any other PGP-compliant application correctly. We will try to reproduce the issue with PGP Desktop 9.8 in our conditions and get back to you ASAP.
Also by EldoS: MsgConnect
Cross-platform protocol-independent communication framework for building peer-to-peer and client-server applications and middleware components.

Reply

Statistics

Topic viewed 17022 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!