PGP Encrypted mail with Gpg4win and Kopano from Outlook

aheinecke

Hi,

I’m the developer of GpgOL, Gpg4win’s Outlook extension. We provide a plugin to send PGP encrypted mails from Outlook.

It’s been reported to us that our Plugin does not create valid PGP/MIME mails when used with a Kopano Server. The report can be found in our ticket system: https://dev.gnupg.org/T3824

It would be interesting to hear if someone else using Outlook and Kopano could confirm that our Plugin does not create valid mails in such a setup. It’s free Software. download

Maybe our assumption that Kopano is to blame is wrong and there is something else broken in the setup of our reporter : -)

Just generate a Key and send yourself a “secured” mail with some text. If it looks weird and has stuff like “Content-type” in it you have confirmed the problem. It should look exactly as you have composed it.

Technical Details:
Our Plugin relies on the MS-OXOSMIME MAPI to MIME conversion algorithm in Outlook/Exchange.
In short: If you create a Message with a special Message Class (for us: IPM.Note.InfoPathForm.GpgOL.SMIME.MultipartSigned ) Outlook treats the first (and only) attachment as the MIME structure of the mail.

So we build a valid multipart/signed or multipart/encrypted mime message and attach it, remove the body, set the message class and send it.
With SMTP Servers Outlook does the conversion but if it’s connected through Exchange the server does the conversion.
This somehow does not work with Kopano (at least we currently think so).

What happens is that our Attachment is split up and put into a Multipart/Mixed message. The “inline.txt” attachment contains the PGP/MIME version marker. The text/plain attachment contains the PGP content.

It looks like this:

Content-Type: multipart/mixed; 
 boundary="=_oTgDbYJZJIkHstD84AzOsmjp4jFEt+cRHoHCd4sbXNjT-YqH"
X-Mailer: Kopano 8.3.4-12
X-Original-Mailer: Microsoft Outlook 16.0

 This is a multi-part message in MIME format. Your mail reader does not
understand MIME message format.
--=_oTgDbYJZJIkHstD84AzOsmjp4jFEt+cRHoHCd4sbXNjT-YqH
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

=2D----BEGIN PGP MESSAGE-----
......
=2D----END PGP MESSAGE-----

--=_oTgDbYJZJIkHstD84AzOsmjp4jFEt+cRHoHCd4sbXNjT-YqH
Content-Type: application/pgp-encrypted; name=inline.txt
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=inline.txt

VmVyc2lvbjogMQ0K
--=_oTgDbYJZJIkHstD84AzOsmjp4jFEt+cRHoHCd4sbXNjT-YqH--

While a valid PGP/MIME Message would be:

Content-Type: multipart/encrypted;
	protocol="application/pgp-encrypted";
	boundary="=-=w4Rm8tvUXpODtB=-="

 This is a multipart message in MIME format.

--=-=w4Rm8tvUXpODtB=-=
Content-Transfer-Encoding: 7bit
Content-Type: application/pgp-encrypted

Version: 1

--=-=w4Rm8tvUXpODtB=-=
Content-Transfer-Encoding: 7bit
Content-Type: application/octet-stream

-----BEGIN PGP MESSAGE-----
....
-----END PGP MESSAGE-----

--=-=w4Rm8tvUXpODtB=-=--

Any Ideas where the MIME message is built / modified in your setup?
We could add some hacks to parse such a broken message but It would be better if we could really fix it so that we are able to send standard confirming PGP/MIME mails.
I would be happy to help analyzing and debugging this from our side, but I don’t have a Kopano setup.

Thanks,
Andre

umgfoin

Hi @aheinecke ,
I can confirm the above problems.
Here the received signed and encrypted mail (textonly) is displays differently in Outlook 16 and Webapp (the Kopano-client), but both carry an additional attachment unknown_content_type.bin (285 bytes) .
The message was sent from Outlook 16 via Kopano-OL-extension/z-push/

Outlook representation - note the unencrypted mail-body-fragment:

Webapp version (end-tag was correctly written):

Best regards,
umgfoin.

aheinecke

Thank you very much for the confirmation. This is exactly the problem my reporter had and which I describe above.

Sebastian

To shed some light on this: several conversions happen. This is related to how Outlook over ActiveSync and Kopano (MAPI) work.

When you send an email via OL+KOE a mime message (RFC2822) is generated by Outlook and sent to the server (z-push) via ActiveSync.
We cannot directly send this email, because it has to pass the MAPI layer of Kopano, so this mime message is converted into a mapi message (via libvmime/im2mapi), placed in the users Outbox as MAPI message, picked up by the kopano-spooler, converted back into a mime message (again via libvmime) and then sent via SMTP.

@umgfoin could you post the mime message received by Z-Push (printed in wbxml log) when sending the mail from Outlook?
I guess that this one is still correct, but in the following two conversions break it.

umgfoin

@sebastian said:

@umgfoin could you post the mime message received by Z-Push (printed in wbxml log) …?

Yes, of course - I’ll post the log-info asap, but I’m off till Friday.
++umgfoin.

umgfoin

Hi @sebastian,
sent you a pm with link to wbxml log.
++umgfoin.

aheinecke

What are the next steps here?
Should we move to a ticket? I’m not sure into which category this falls.

As you support S/MIME somehow I think it might not be such a huge step to support OpenPGP in a similar way. GpgOL’s whole MIME support is based on “faking to be S/MIME” ;-)

Btw. would it help If I would ask my reporter to report this issue somehow as a customer?

fbartels

@aheinecke said in PGP Encrypted mail with Gpg4win and Kopano from Outlook:

Btw. would it help If I would ask my reporter to report this issue somehow as a customer?

If you want something to get a higher priority this always helps.

GeeGee

I hope this will be solved soon.

fbartels

Hi @aheinecke ,

I just remembered this thread, did your customer get in contact with our support?

umgfoin

Hello all / @aheinecke,

recent changes seem to have solved above problems for encryption - gpg-signatures still are broken:

Gpg4win + Outlook + Kopano OL + Z-Push + Kopano-core + Kopano-webapp produces valid output for GpgOL generated mails.

Tested 2018-06-19 15:17 CEST with :

core kc-git-master 8.6.80.1128
webapp git-master 3.4.15final.221-ga3347f1
z-push 2.4.3.beta1+6
GpgOL 2.06
KOE 3.0.305
Outlook 16.0.4639

WebApp received representation of a mail composed in Outlook with GpgOL as below:
++umgfoin

umgfoin

Malheureusement, the above said is valid for gpg-encryption, only.
If the mail ist gpg-signed, too or only, the mail arrives with an attachment unknown_content_type.bin containing either the pgp-signature, or the string Version: 1. Additionally, the decrypted body contains MIME-tags.

fbartels

@umgfoin said in PGP Encrypted mail with Gpg4win and Kopano from Outlook:

Malheureusement, the above said is valid for gpg-encryption, only.
If the mail ist gpg-signed, too or only, the mail arrives with an attachment unknown_content_type.bin …

Yes, that is what I also was able to observe.

umgfoin

…and now the ~~good~~ better news:

gpg-encryption & signature works ~~as expected~~ for PGP/Inline-messages with GpgOL v2.2.0, which is part of recent Gpg4win 3.1.2 .

It still fails with wrongly constructed/ parsed MIME-multipart elements (unknown_content_type.bin), unencrypted attachments etc. as soon as Content-Type: multipart/mixed MIME-structures are involved.

++umgfoin.

rolf

This post is deleted!

rolf

Hi,

how is the actual state of this point? Is it solved?

I’m wondering if this problem maybe could be a problem of gpb4win and not kopano: there is a alternative gpg plugin existing for outlook 2016 (and other versions) called gpg4o that works perfectly with outlook and kopano.

If you need further data, please let me know…

Kind regards

Rolf

fbartels

@rolf as you can see in the reply from @umgfoin it seems to work now (that is what I also experienced when I tried it the last time)

rolf

@fbartels thats unfortunately just 50%.

It still doesnt work when sending crypted (and optionally signed) messages with attachments.
with attachments it just works when receive
the way to use pgp/inline is just a workaround and NOT a solution.

sorry, but the bug is still existing and prevents the usage of a lot of pgp usecases.

is there the possibility that this may be solved this year? That’ll be great :-)

Kind regards

Rolf

fbartels

@rolf said in PGP Encrypted mail with Gpg4win and Kopano from Outlook:

thats unfortunately just 50%.

Ah, I wasn’t aware since I just briefly tried it out myself.

@rolf said in PGP Encrypted mail with Gpg4win and Kopano from Outlook:

is there the possibility that this may be solved this year? That’ll be great :-)

PGP currently isn’t a priority for us at Kopano. If an external developer want to dive into this then patches are welcome.

robgnu

Hello,
I just want to ask if there are any news on this topic. I have a client who licensed a new Kopano subscription (30 Users). My client has the same problems as described above. The use of GPG/PGP encryption is a must have in this case.

I hope we can find a solution on this topic?