Error: Session key decryption failed when decrypting file encrypted with Kleopatra gpg4win

[tungnat97]

• OpenPGP.js version: 5.4.0
• Affected platform (Browser or Node.js version): 14.17.2

I tried to decrypt the encrypted file from my clients. Some of them couldn't be decrypted as the error mention above was thrown (Session key decryption failed). I tried to track down the error and found out that, in line 84 of file private_key.js, the condition this.subkeys[i].getKeyID().equals(keyID, true) was false, so that in line 211 of message.js, the map function just didn't have anything to map and so decryptedSessionKeyPackets had nothing inside it.

[twiss]

Hi 👋 In that case, it most likely means that you're using the wrong key to decrypt.
To confirm, does decryption work if you remove that check, or if you modify the message to have an "anonymous" key id (of all zeros)?

[tungnat97]

It threw "Decryption error" when I removed the check. I've not tried to modify the key id as you said, but I tested the same private key with Kleopatra and Openpgp, and the former worked well while the latter threw the reported error.

[twiss]

Are you sure it's using that key to decrypt and not another one? And, could you also try decrypting using GnuPG or Sequoia, or so, to see if it works there?

[tungnat97]

Yep, I'm pretty sure. It also worked with some files but didn't with others. Here's a snippet of my code that read and decrypt files using PGP from an SFTP server

      const decryptionKeys = await openpgp.decryptKey({
          privateKey: await openpgp.readPrivateKey({
              armoredKey: fs.readFileSync(this.configService.get<string>("sftpBIDV.privatePath")).toString(),
          }),
          passphrase: this.configService.get<string>("sftpBIDV.passphrase"),
      });
      const logFolder = this.configService.get<string>("sftpBIDV.location");
      const list = await this.sftpClient.list(logFolder);
      const encryptedList: any[] = list.filter(x => x.name.includes("csv"));
      await bluebird.map(encryptedList, async(x) => {
          const file = await this.fileBaoCoModel.findOne({
              _id: x.name,
          });
          if (file === null) {
              await this.fileBaoCoModel.create({ _id: x.name });
              const buffer: Buffer = await this.sftpClient.get(`${logFolder}/${x.name as string}`);
              const message = await openpgp.readMessage({
                  binaryMessage: buffer,
              });
              try {
                  const decrypted = await openpgp.decrypt({
                      message,
                      decryptionKeys,
                  });
                  console.log("DATA", decrypted.data.split("\n").map(x => x.split("|")));
              } catch (err) {
                  console.log(err);
              }
          }
      });

[twiss]

If it works with some but not others, then presumably the key id of those other files is different? It sounds like an issue on the encryption side.
To confirm, could you post some example files and the public key? (Or, a dump from gpg --list-packets or similar.)

[tungnat97]

Here are two outputs of two files that couldn't be decrypted:

➜ ~ gpg --list-packet /home/tung/odoo-user-backend/src/modules/log-thanh-toan-bidv/assets/PTIT_H_20220811150225_mahoa.csv.pgp
gpg: encrypted with RSA key, ID 50A0245C15FB9918
gpg: decryption failed: No secret key
# off=0 ctb=85 tag=1 hlen=3 plen=268
:pubkey enc packet: version 3, algo 1, keyid 50A0245C15FB9918
        data: [2046 bits]
# off=271 ctb=d2 tag=18 hlen=3 plen=657 new-ctb
:encrypted data packet:
        length: 657
        mdc_method: 2
➜  ~ gpg --list-packet PTIT_H_20220820220127.csv.pgp
gpg: encrypted with RSA key, ID 50A0245C15FB9918
gpg: decryption failed: No secret key
# off=0 ctb=85 tag=1 hlen=3 plen=268
:pubkey enc packet: version 3, algo 1, keyid 50A0245C15FB9918
        data: [2048 bits]
# off=271 ctb=d2 tag=18 hlen=3 plen=204 new-ctb
:encrypted data packet:
        length: 204
        mdc_method: 2

Here is the output of the file that could be decrypted:

➜  ~ gpg --list-packet PTIT_H_20220819171000.csv.gpg
gpg: encrypted with RSA key, ID A8EF92505B3BC893
gpg: decryption failed: No secret key
# off=0 ctb=85 tag=1 hlen=3 plen=268
:pubkey enc packet: version 3, algo 1, keyid A8EF92505B3BC893
        data: [2045 bits]
# off=271 ctb=d2 tag=18 hlen=2 plen=148 new-ctb
:encrypted data packet:
        length: 148
        mdc_method: 2

Seems like there was some problem with key id. Note that they were all decrypted with Kleopatra.

[tungnat97]

Here it is

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBGLZf6kBCADlcYk8PELbUUFlrP/tQxuILow8jTZiTwQk2TXLYUxMn/v0wKK9
xA4sd/sl3W/YsxDkDHIJS11t9Rb0O0Su9ncLOfrXfXqbcytGx8yYY4P+GmMrgliH
aVcPqEDPyS/MB0rOv7Z1Wkqg5JnBWMxZ2jA9owiPM8qSjcagJ1+YariUQTtgDxvq
WEepK9bdBaNTbzhNqTrs8I5MBn1+ZHZRFkg+ZAgYQFPwZDgQwg0qAgOLnlxGeiKu
fZg2F8l56d74pClcXBM+ksHlPPZuO1GQQTwGMnNwR6snT63zRo3Q90ymcS7ozcWH
sudjFXekjD5pgFQZFZBeUVfABK2zqIG8aaJFABEBAAG0HXB0aXQtcGdwIDxuaGFu
bnRAcHRpdC5lZHUudm4+iQFOBBMBCgA4FiEEQjEpoOa5pV4Fu6D2UKAkXBX7mRgF
AmLZf6kCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQUKAkXBX7mRhm7AgA
29Yk9TSi4H2dK6r9wg4tipTeCx2lAkrCwzx1TuUNj8PlK0WSRnc+obkqT6pDiFgd
stlM6aLUHU3t+MT+9TEZyjM4mCNLLYc11aKzHDzP83wL/d9FdDf6JBuhZUdMzXKh
vXwmfvnVeds0R0b8TE8O8EqAfoCy9NmPgMN/EKsz/omRyL4Tq9A3SZpOobBS4Aaf
bVilC4F2UGaoWUR6qk3bbF+UmBIvhJ6zhxR6otfaTw3xWxjw0JC+JWzJ8ygttEL9
9vG+d+tLkuTSh6gj85EWeOfrXeZQ5vflsHpYK+0f7e30y5LwvPCJ6mSKIEC4AO9u
KTkYY+Ngk4ddagzMtWTZubkBDQRi2X+pAQgAmTGX8J1al+J/iVpD5wEOTl+zi4l2
tNe7cHg5URslOeiHG4yv0nfNBFBq8iLkeLH/wnRwt5m3ecmhFQ7gNU8OtPOxBoKn
SF4qQqIKhNrv2MsDEjacLrNCUcN/N84VNoDVOtBD2Mpmb3r1nolhuqQKinAr9o+2
xLfULELMzWYkBxrhLD3go+e4lCEGdK7c+AWfhK3+4Ol7jrANT7vCZpC2HAbm4yAR
1GsUrgs5l7lGpbMpZ64bbXLlNQymrWWHTgA7LixezeCKVOKRNqCTvhIwJ72NFJ6J
AICoH8mkBMONiVJNv1XF5fzEYmDy2KY9n9FespJlwo2Vy4Y1inn3nA4zQwARAQAB
iQE2BBgBCgAgFiEEQjEpoOa5pV4Fu6D2UKAkXBX7mRgFAmLZf6kCGwwACgkQUKAk
XBX7mRjyKwgAx0s0N9xEjcWmZ9L4lzoiJiGbRjs38QDOSufhPfc0nBMmKlbA8nAS
euY5qneiiBswDWDUTTBMmu2sLwEaiRvwvdZmLpEoV4DoB82477wuwtLbAZW4Ytxm
Krk5XfoLzEGQFSN1OZSrxyqORjfFtmFvpI+2cllLQkQr9UKa1ogtWUi6iHYz+J2e
BHvf99NJcytZ56w/dyjVv/ak/dMQmeDGLn5/tffVFk/h2X88vlngdWPkVxuUR4Ut
UkrvVoE0N98hll7t/4inHOedkkcvrdCt4mmO/dFcEZrHa68M5boEFC9knFAEN/Vg
kmxAVrXSDuw7j8Pru1JeLpkOsr5bDE/ctw==
=qQWH
-----END PGP PUBLIC KEY BLOCK-----

[twiss]

Right. So this only has one encryption subkey, A8EF92505B3BC893. The messages with encryption key id 50A0245C15FB9918 were most likely encrypted with a different key, and so need a different key to decrypt them, as well.

[tungnat97]

Well that is weird, as I could decrypt them all with the same private key using Kleopatra, but not with openpgp.

[larabr]

It looks like the message is encrypted to the primary (signing) key, have a look at #1351 (comment) .

[tungnat97]

Yep, it worked! Thanks a lot!