OpenPGP Smartcard + signing email = two signatures?

[Pete Stephenson]

On 10/11/2013 10:40 PM, John Clizbe wrote:
> Nothing nefarious going on, nor is it a bug. Take a look at the source of your
> PGP/MIME signed email.
> 
>> This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
>> --===============0134039850==
>> Content-Type: multipart/signed; micalg=pgp-sha512;
> ----------------------------------^^^^^^^^^^^^^^^^^
>>  protocol="application/pgp-signature";
>>  boundary="hORQu9nh08cKrD0xFen8m9Kf4P5mAgQLH"
>>
>> This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
>> --hORQu9nh08cKrD0xFen8m9Kf4P5mAgQLH
>> Content-Type: text/plain; charset=ISO-8859-1
>> Content-Transfer-Encoding: quoted-printable
>>
> <message>
> <boundary>
> <signature attachment>
> <boundary>
>> --===============0134039850==
> 
> In order for Enigmail to generate the outside email header
> (multipart/signed...), it has to know the digest that will be used later to
> construct the signature part, in this case SHA-512, but all the message
> processing happens in a single pass with the signature part at the end.
> 
> To do this, a small test message is signed and then examined for the digest
> that was used. This is the first time you are asked for your PIN. The second
> is when the message signature part is being generated.

Aha, that explains it! Many thanks.

I never really made the connection between that section in RFC 3156 and
this behavior.

> We used to see this on the Enigmail list a lot as folks started using
> gpg-agent instead of Enigmail's more limited internal passphrase caching.
> With no PIN/passphrase caching in effect, I'd expect you to be asked twice on
> PGP/MIME messages, but only once on inline OpenPGP.

Oddly, this doesn't always happen, even with the "force signature PIN"
bit set on the smartcard.

That is, in-line signing only requires one PIN entry. PGP/MIME
often requires the PIN to be entered twice, but not always.

Some informal testing over the last few minutes seems to suggest that
I'll be prompted for the signature PIN twice when sending the first
PGP/MIME message of a particular Thunderbird session. If I don't exit
Thunderbird and send other PGP/MIME messages then I will only be
prompted once for each signed message. Exiting Thunderbird and
re-opening it resets stuff, so I'm again prompted for two signature PINs
on the first PGP/MIME message but only one on following messages.

Does Enigmail cache the hash type used for the signature for a length of
time (say, the duration that Thunderbird remains open) so it doesn't
need to prompt for two signature PINs?

> HTH,
> 
> -John

It does indeed. Thank you.

Cheers!
-Pete