Re: [gentoo-user] gpg: selftest for CTR failed - see syslog for details

[Fernando Rodriguez]

On 04/06/2017 11:10 AM, Fernando Rodriguez wrote:
On 04/05/2017 10:22 PM, Miroslav Rovis wrote:
On 170405-18:01-0400, Fernando Rodriguez wrote:
Hello,
After a recent update I'm getting this error whenever I try to encrypt
or decrypt using gnupg. Here's error:

gpg: selftest for CTR failed - see syslog for details
gpg: Ohhhh jeeee: ... this is a bug (seskey.c:61:make_session_key)
Aborted

And the syslog:

gpg[8945]: Libgcrypt warning: AES-CTR-128 test failed (plaintext
mismatch)



It started after a recent update that included gnupg and libgcrypt. The
versions before the update where libgcrypt-1.7.3 and gnupg-2.1.15. After
the update 1.7.6 and 2.1.18 respectively. I tried downgrading both
packages but it didn't help.

I tried to delete the whole ~/.gnupg directory and re-import the keys
but it fails with the same error.

I have another keyring on the same machine that I use with the --homedir
option and I have not problems with it.

When I try to generate a new key I get the following error:

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: agent_genkey failed: Missing key
Key generation failed: Missing key



Any ideas?

I tried some decryption. No issues here:

$ gpg --version
gpg (GnuPG) 2.1.20
libgcrypt 1.7.6
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/miro/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
$

It could be something else, or your Gnupg installation is somehow
broken...

I took the entire .gnupg from the same machine I exported the key from
and copied it over to this machine. Now I can at least sign messages but
encryption/decryption still fails with the same error.

And that could mean that it's been broken for a while because I rarely 
use this key for encrypting/decrypting. I use it for signing and 
verifying signatures mostly. Just before I deleted the old keyring I was 
getting an error when signing a commit. So perhaps the problem existed 
before the update and just surfaced when I deleted the old keyring.


--

Fernando Rodriguez