Arch Linux

deeenes

Member

Registered: 2015-08-28

Posts: 16

Mutt and Enigmail pass empty passphrase to GPG

I used to use GPG with Thunderbird and Enigmail until cca. 1 year ago, for signing, en/decrypting mails.
Recently I needed encrypted mailing again, of course all the software have been updated since last time I used.
I realized that Enigmail does not ask for password, and returns an error "Send operation aborted. Error - encryption command failed."

What I see in Enigmail's log:

    2015-08-28 15:36:55.682 [CONSOLE] enigmail> /usr/bin/gpg --charset utf-8 --display-charset utf-8 --batch --no-tty --status-fd 2 -a -t --encrypt --sign --trust-model always --encrypt-to 0x00000000 -r 0x5706A4B600000000 -u 0x00000000 --use-agent
    2015-08-28 15:36:55.694 [DEBUG]   enigmail> DONE
    2015-08-28 15:36:55.744 [DEBUG] enigmail.js: Setting useAgent to true for gpg2 >= 2.0.16
    2015-08-28 15:36:55.747 [DEBUG] enigmailCommon.jsm: encryptMessageEnd: uiFlags=1, sendFlags=00000063, outputLen=0
    2015-08-28 15:36:55.747 [DEBUG] enigmailCommon.jsm: parseErrorOutput: status message: 
    gpg: 0x5706A4B600000000: skipped: public key already present
    [GNUPG:] PROGRESS need_entropy X 8 16
    [GNUPG:] PROGRESS need_entropy X 16 16
    [GNUPG:] BEGIN_SIGNING H8
    [GNUPG:] USERID_HINT 5706A4B600000000 yy xx <xxyy@gmail.com>
    [GNUPG:] NEED_PASSPHRASE 5706A4B600000000 5706A4B600000000 1 0
    gpg: Sorry, we are in batchmode - can't get input

    2015-08-28 15:36:55.747 [DEBUG] enigmailCommon.jsm: parseErrorOutput: statusFlags = 00000000
    2015-08-28 15:36:55.747 [DEBUG] enigmailCommon.jsm: parseErrorOutput(): return with errorMsg = gpg: 0x5706A4B600000000: skipped: public key already present
    gpg: Sorry, we are in batchmode - can't get input
    2015-08-28 15:36:55.747 [DEBUG] enigmailCommon.jsm: encryptMessageEnd: command execution exit code: 2
    2015-08-28 15:36:55.747 [DEBUG] enigmail.js: Enigmail.encryptMessage: command execution exit code: 2

I see that gpg says it can not get input because of batch mode. I don't know the password how is supposed to asked for and passed, and I don't see any Enigmail option which may affect this behaviour.

So I decided to set up Mutt, where I have a closer control over all these things. I put the gpg commands into `.muttrc` as it was advised in all the howtos, for example this one. When I try to sign a message, gpg's output is:

    gpg: signing failed: No passphrase given
    gpg: signing failed: No passphrase given
    Press any key to continue...

Gpg itself starts gpg-agent. Gpg-agent is set up to forget any passphrase in one second, but the problem is that it never prompts for passphrase. I tried to `export GPG_TTY=$(tty)`, but this hasn't changed anything. Then I checked the `pgp_sign_command` in my `.muttrc`, it is:

    set pgp_sign_command="gpg --no-verbose --batch --output - --passphrase-fd 0 --armor --detach-sign --textmode %?a?-u %a? %f"

I tried the same command on a dummy file `tmpf`:

    gpg --no-verbose --batch --output - --passphrase-fd 0 --armor --detach-sign --textmode --local-user 00000000 tmpf

It prompts for passphrase from `stdin` as it should be with `-passphrase-fd 0`, until the first newline. If the passphrase is ok, then gpg returns the signature. If it is bad, it prints

    gpg: signing failed: Bad passphrase
    gpg: signing failed: Bad passphrase

if it is empty

    gpg: signing failed: No passphrase given
    gpg: signing failed: No passphrase given

This latter is what I see trying with Mutt, so I assume it passed an empty password, what is not surprising, because it did not asked me.

AFAIK, I did not change anything in `gpg.conf` or `gpg-agent.conf` (although my config files are years old), and I wrote `.muttrc` following the mentioned howto.

I would appreciate any hint what could be wrong!

Last edited by deeenes (2015-08-28 15:22:34)

deeenes

Member

Registered: 2015-08-28

Posts: 16

Re: Mutt and Enigmail pass empty passphrase to GPG

Ok, it looks like `--passphrase-fd 0` causes this problem, because then gpg expects the passphrase from stdin, and does not ask for it interactively. However, I needed to remove the `--batch` option, otherwise I get the error "can not get input in batch mode". So with removing these 2 options, signing and encrypting works well. Then, I am wondering, why it is like this in all the howtos? Something changed recently in gpg? And also probably Enigmail needs the `--batch` option to be removed, but how it can be set there?