Behaviour of gpgsm / gpgme with multiple S/MIME certificates/keys per address (old/expired/about to expire and new)

2017-06-09 Thread Dr. Thomas Orgis
Hi, I recently got into trouble with S/MIME signing and encryption in claws-mail, which uses gpgme. My old (first) S/MIME certificate is about to expire, so I got a new one. I added the new one to gpgsm's keystore. But after that, claws-mail as well as gpgsm complain about the keys being

Re: TOFU

2017-06-09 Thread Stefan Claas
On 07.06.17 14:24, Peter Lebbing wrote: > On 07/06/17 13:49, Stefan Claas wrote: >> In Enigmail with the blue and green bar (without showing statistics) it >> would simply mean >> that it switches from green to blue, right? > Not necessarily! > I have one more question if you don't mind. One of my

Re: Key management for archives

2017-06-09 Thread NdK
Il 09/06/2017 08:24, Werner Koch ha scritto: > ( gpg --status-fd 1 --show-session-key --max-output 1 \ > -o /dev/null 2>/dev/null FILE || true ) \ >| awk '$1=="[GNUPG:]" && $2=="SESSION_KEY" {print $3}' > The output can then be used with --override-session-key Tks! That's exactly what

Re: setting GnuPG card to 'not forces' does not let sign

2017-06-09 Thread Matthias Apitz
El día viernes, junio 09, 2017 a las 08:09:12a. m. +0200, Werner Koch escribió: > > > The bad PIN counter in the card is not decremented. Switching the card > > back to 'forced' makes signing with PIN working again. > > Interesting. Did you also try to reset the card (i.e. re-insert) whit >

Re: Key management for archives

2017-06-09 Thread Werner Koch
On Tue, 6 Jun 2017 14:39, ndk.cla...@gmail.com said: > Is it possible to "extract" the used session key, so that the requester > just ignores the asymmetric crypto and just uses the symmetric key to > decode the file? Drawbacks? Other ideas? Here is how I would do that: ( gpg --status-fd 1

Re: Fwd: RE: setting GnuPG card to 'not forces' does not let sign

2017-06-09 Thread Matthias Apitz
El día viernes, junio 09, 2017 a las 08:06:50a. m. +0200, Werner Koch escribió: > On Thu, 8 Jun 2017 12:48, g...@unixarea.de said: > > Every time I write to gnupg-users@gnupg.org I get this crap from a robot > > or from Sarah about dating. Can someone do anything that he/she/it is not > > That

Re: Fwd: RE: setting GnuPG card to 'not forces' does not let sign

2017-06-09 Thread Werner Koch
On Thu, 8 Jun 2017 12:48, g...@unixarea.de said: > Every time I write to gnupg-users@gnupg.org I get this crap from a robot > or from Sarah about dating. Can someone do anything that he/she/it is not That bot is subscribed. I enabled the moderation flag and disabled delivery. Shalom-Salam,

Re: setting GnuPG card to 'not forces' does not let sign

2017-06-09 Thread Werner Koch
> The bad PIN counter in the card is not decremented. Switching the card > back to 'forced' makes signing with PIN working again. Interesting. Did you also try to reset the card (i.e. re-insert) whit non-forced set? Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein