Subject: bug#20030: closed (Re: bug#20030: plstore caches invalid passphrases)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 31 Mar 2015 01:18:02 +0000

Your bug report

#20030: plstore caches invalid passphrases

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
20030: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=20030
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#20030: plstore caches invalid passphrases
From: Daiki Ueno <[email-masked]>
To: Jonas Bernoulli <[email-masked]>
Cc: [email-masked]
Date: Tue, 31 Mar 2015 10:17:49 +0900
List-Id: <debbugs-submit.debbugs.gnu.org>

Jonas Bernoulli <[email-masked]> writes:

> When using symmetric encryption and
> `plstore-cache-passphrase-for-symmetric-encryption' is non-nil,
> `plstore-passphrase-callback-function' stores the passphrase entered
> by the user in `plstore-passphrase-alist'.  This happens *before* the
> passphrase is used to decrypt, and if it turns out that it was wrong,
> then it is *not* removed from the cache.

Thanks, good catch.  I've installed a fix:
http://git.savannah.gnu.org/cgit/emacs.git/commit/?id=2e4b0c98

Subject: plstore caches invalid passphrases
From: Jonas Bernoulli <[email-masked]>
To: <[email-masked]>
Date: Sat, 07 Mar 2015 15:11:36 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

When using symmetric encryption and
`plstore-cache-passphrase-for-symmetric-encryption' is non-nil,
`plstore-passphrase-callback-function' stores the passphrase entered
by the user in `plstore-passphrase-alist'.  This happens *before* the
passphrase is used to decrypt, and if it turns out that it was wrong,
then it is *not* removed from the cache.

So if caching is turned on and the user enters the wrong passphrase,
subsequent attempts to decrypt the same information will always fail,
because the cached but invalid passphrase is used.  The user has to
manually remove the invalid entry from `plstore-passphrase-alist' to
get a second chance at entering the passphrase correctly.