crypto: use stashed session-key properties for decryption, if available

When doing any decryption, if the notmuch database knows of any
session keys associated with the message in question, try them before
defaulting to using default symmetric crypto.

This changeset does the primary work in _notmuch_crypto_decrypt, which
grows some new parameters to handle it.

The primary advantage this patch offers is a significant speedup when
rendering large encrypted threads ("notmuch show") if session keys
happen to be cached.

Additionally, it permits message composition without access to
asymmetric secret keys ("notmuch reply"); and it permits recovering a
cleartext index when reindexing after a "notmuch restore" for those
messages that already have a session key stored.

Note that we may try multiple decryptions here (e.g. if there are
multiple session keys in the database), but we will ignore and throw
away all the GMime errors except for those that come from last
decryption attempt.  Since we don't necessarily know at the time of
the decryption that this *is* the last decryption attempt, we'll ask
for the errors each time anyway.

This does nothing if no session keys are stashed in the database,
which is fine.  Actually stashing session keys in the database will
come as a subsequent patch.

diff --git a/doc/man7/notmuch-properties.rst b/doc/man7/notmuch-properties.rst
index 68121359592fab423401e6d01718ed7d1022ed1a..9e033e14c16d235919119db6af826bb4573db3a2 100644 (file)
--- a/doc/man7/notmuch-properties.rst
+++ b/doc/man7/notmuch-properties.rst
@@ -74,6 +74,35 @@ of its normal activity.
     **notmuch-config(1)**), then this property will not be set on that
     message.
 
     **notmuch-config(1)**), then this property will not be set on that
     message.
 

+**session-key**
+
+    When **notmuch-show(1)** or **nomtuch-reply** encounters a message
+    with an encrypted part and ``--decrypt`` is set, if notmuch finds a
+    ``session-key`` property associated with the message, it will try
+    that stashed session key for decryption.
+
+    Using a stashed session key with "notmuch show" will speed up
+    rendering of long encrypted threads.  It also allows the user to
+    destroy the secret part of any expired encryption-capable subkey
+    while still being able to read any retained messages for which
+    they have stashed the session key.  This enables truly deletable
+    e-mail, since (once the session key and asymmetric subkey are both
+    destroyed) there are no keys left that can be used to decrypt any
+    copy of the original message previously stored by an adversary.
+
+    However, access to the stashed session key for an encrypted message
+    permits full byte-for-byte reconstruction of the cleartext
+    message.  This includes attachments, cryptographic signatures, and
+    other material that cannot be reconstructed from the index alone.
+
+    The session key should be in the ASCII text form produced by
+    GnuPG.  For OpenPGP, that consists of a decimal representation of
+    the hash algorithm used (identified by number from RFC 4880,
+    e.g. 9 means AES-256) followed by a colon, followed by a
+    hexadecimal representation of the algorithm-specific key.  For
+    example, an AES-128 key might be stashed in a notmuch property as:
+    ``session-key=7:14B16AF65536C28AF209828DFE34C9E0``.
+

 SEE ALSO
 ========
 
 SEE ALSO
 ========
 


@@ -83,5 +112,7 @@ SEE ALSO
 **notmuch-insert(1)**,
 **notmuch-new(1)**,
 **notmuch-reindex(1)**,
 **notmuch-insert(1)**,
 **notmuch-new(1)**,
 **notmuch-reindex(1)**,

+**notmuch-reply(1)**,

 **notmuch-restore(1)**,
 **notmuch-restore(1)**,

+**notmuch-show(1)**,

 ***notmuch-search-terms(7)**
 ***notmuch-search-terms(7)**

diff --git a/lib/index.cc b/lib/index.cc
index 19d03456a674e43a34efe36cba7ca2ad02b0d4f6..6eb60f300a87e10fa1527467de6ecec00095d6c7 100644 (file)
--- a/lib/index.cc
+++ b/lib/index.cc
@@ -548,7 +548,7 @@ _index_encrypted_mime_part (notmuch_message_t *message,
        }
     }
 #endif
        }
     }
 #endif

-    clear = _notmuch_crypto_decrypt (crypto_ctx, encrypted_data, NULL, &err);
+    clear = _notmuch_crypto_decrypt (message, crypto_ctx, encrypted_data, NULL, &err);

     if (err) {
        _notmuch_database_log (notmuch, "Failed to decrypt during indexing. (%d:%d) [%s]\n",
                               err->domain, err->code, err->message);
     if (err) {
        _notmuch_database_log (notmuch, "Failed to decrypt during indexing. (%d:%d) [%s]\n",
                               err->domain, err->code, err->message);

diff --git a/mime-node.c b/mime-node.c
index ae3ebef624d5d1383baf0e2f7c39547f6f73dbfe..daaae9f81ad5d510ed798aa20f55c7d14efe029a 100644 (file)
--- a/mime-node.c
+++ b/mime-node.c
@@ -198,9 +198,16 @@ node_decrypt_and_verify (mime_node_t *node, GMimeObject *part,
     GMimeDecryptResult *decrypt_result = NULL;
     GMimeMultipartEncrypted *encrypteddata = GMIME_MULTIPART_ENCRYPTED (part);
 
     GMimeDecryptResult *decrypt_result = NULL;
     GMimeMultipartEncrypted *encrypteddata = GMIME_MULTIPART_ENCRYPTED (part);
 

-    node->decrypt_attempted = true;
-    if (! node->decrypted_child)
-       node->decrypted_child = _notmuch_crypto_decrypt (cryptoctx, encrypteddata, &decrypt_result, &err);
+    if (! node->decrypted_child) {
+       mime_node_t *parent;
+       for (parent = node; parent; parent = parent->parent)
+           if (parent->envelope_file)
+               break;
+
+       node->decrypt_attempted = true;
+       node->decrypted_child = _notmuch_crypto_decrypt (parent ? parent->envelope_file : NULL,
+                                                        cryptoctx, encrypteddata, &decrypt_result, &err);
+    }

     if (! node->decrypted_child) {
        fprintf (stderr, "Failed to decrypt part: %s\n",
                 err ? err->message : "no error explanation given");
     if (! node->decrypted_child) {
        fprintf (stderr, "Failed to decrypt part: %s\n",
                 err ? err->message : "no error explanation given");

diff --git a/util/crypto.c b/util/crypto.c
index 087536ec7ed97156459339eb6f2b3b09cc5409d8..476f1879a94a7d47a95e624ee184579a533626c5 100644 (file)
--- a/util/crypto.c
+++ b/util/crypto.c
@@ -140,13 +140,50 @@ void _notmuch_crypto_cleanup (unused(_notmuch_crypto_t *crypto))
 #endif
 
 GMimeObject *
 #endif
 
 GMimeObject *

-_notmuch_crypto_decrypt (g_mime_3_unused(GMimeCryptoContext* crypto_ctx),
+_notmuch_crypto_decrypt (notmuch_message_t *message,
+                        g_mime_3_unused(GMimeCryptoContext* crypto_ctx),

                         GMimeMultipartEncrypted *part,
                         GMimeDecryptResult **decrypt_result,
                         GError **err)
 {
     GMimeObject *ret = NULL;
 
                         GMimeMultipartEncrypted *part,
                         GMimeDecryptResult **decrypt_result,
                         GError **err)
 {
     GMimeObject *ret = NULL;
 

+    /* the versions of notmuch that can support session key decryption */
+#if HAVE_GMIME_SESSION_KEYS
+    if (message) {
+       notmuch_message_properties_t *list = NULL;
+
+       for (list = notmuch_message_get_properties (message, "session-key", TRUE);
+            notmuch_message_properties_valid (list); notmuch_message_properties_move_to_next (list)) {
+           if (err && *err) {
+               g_error_free (*err);
+               *err = NULL;
+           }
+#if (GMIME_MAJOR_VERSION < 3)
+           ret = g_mime_multipart_encrypted_decrypt_session (part,
+                                                             crypto_ctx,
+                                                             notmuch_message_properties_value (list),
+                                                             decrypt_result, err);
+#else
+           ret = g_mime_multipart_encrypted_decrypt (part,
+                                                     GMIME_DECRYPT_NONE,
+                                                     notmuch_message_properties_value (list),
+                                                     decrypt_result, err);
+#endif
+           if (ret)
+               break;
+       }
+       if (list)
+           notmuch_message_properties_destroy (list);
+       if (ret)
+           return ret;
+    }
+#endif
+
+    if (err && *err) {
+       g_error_free (*err);
+       *err = NULL;
+    }

 #if (GMIME_MAJOR_VERSION < 3)
     ret = g_mime_multipart_encrypted_decrypt(part, crypto_ctx,
                                             decrypt_result, err);
 #if (GMIME_MAJOR_VERSION < 3)
     ret = g_mime_multipart_encrypted_decrypt(part, crypto_ctx,
                                             decrypt_result, err);

diff --git a/util/crypto.h b/util/crypto.h
index d68634f3322ca7b8d5cfab10c4707189fabb4bc4..0c62ac70d8f1cfde40634964654b2fb58c14e229 100644 (file)
--- a/util/crypto.h
+++ b/util/crypto.h
@@ -16,7 +16,8 @@ typedef struct _notmuch_crypto {
 } _notmuch_crypto_t;
 
 GMimeObject *
 } _notmuch_crypto_t;
 
 GMimeObject *

-_notmuch_crypto_decrypt (GMimeCryptoContext* crypto_ctx,
+_notmuch_crypto_decrypt (notmuch_message_t *message,
+                        GMimeCryptoContext* crypto_ctx,

                         GMimeMultipartEncrypted *part,
                         GMimeDecryptResult **decrypt_result,
                         GError **err);
                         GMimeMultipartEncrypted *part,
                         GMimeDecryptResult **decrypt_result,
                         GError **err);