trezor-agent icon indicating copy to clipboard operation
trezor-agent copied to clipboard

Fix AssertionError on decryption whenever there is another ECC key in the keychain

Open prometheanSolutions opened this issue 2 years ago • 1 comments

Whenever there are other public keys in the GPG keychain with the ECC alogrithm, decryption is not possible.

How to reproduce:

Short: Suppose our trezor-key has the uuid: 'trezor'. We create another public key called 'Alice' and encrypt a file with both keys. Decryption is not possible.

Long:

  1. Generate second key with the following properties: ECC and ECC (encryption) - nistp256 gpg --full-generate-key --expert (9) ECC and ECC (3) NIST P-256 Key is valid for? (0) 0 Real name: Alice
  2. Delete secret key for key 'Alice' gpg --delete-secret-key 'Alice'
  3. Encrypt a test file with both keys gpg -e -r Alice -r trezor test
  4. Restart trezor gpg agent
  5. Try to decrypt gpg -d test.gpg

Result: There is an AssertionError: File "/home/user/projects/trezor-agent/libagent/gpg/agent.py", line 174, in get_identity assert pubkey.key_id() == pubkey_dict['key_id'] AssertionError

This is the case, because all compatible keys in the keychain are being tried and when the key is not the same with the key on the HW device an Assertion error is thrown.

Fix by: Ignore keys which do not correspond to key on device instead of throwing an Assertion Error

prometheanSolutions avatar Dec 23 '23 20:12 prometheanSolutions

Looks like I duplicated this work in #483. The comment there has a script to automate key generation & testing/repro.

dlitz avatar Aug 02 '24 05:08 dlitz