Double encryption problem

[seriv]

I have a question.
I have enabled 'encryption at rest'. Now in an email client Thunderbird I can see OpenPGP-decrypted messages. But if the message was initially sent as OpenGPG encrypted, - say with 'Mailvelope' browser extension, I see it was additionally encrypted second time by Stalwart, and Thunderbird shows it as still encrypted.
I think it would be good to have some condition checking to restrict encryption at rest only if the message is not already OpenPGP-encrypted.

Regards,
Sergey Ivanov.

[mdecimus]

Stalwart should not encrypt messages that are already encrypted, if that is happening to you then it is a bug.
Please post here a sample original encrypted message before Stalwart re-encrypted and I'll have a look at it.

[seriv]

Here it is, - the message composed with Mailvelope on gmail.com:

Received: from 119074447949 named unknown by gmailapi.google.com with HTTPREST; Thu, 9 Jan 2025 09:36:34 -0500
Content-Type: multipart/mixed; boundary="----sinikael-?=_1-17364333937490.28304631087789"
From: [email protected]
To: sergey ivanov <[email protected]>
Subject: Test double-encryption from Mailvelope
Date: Thu, 9 Jan 2025 09:36:34 -0500
Message-Id: <CAAv=BDEx1vxjv2+Sjzinvc9=69L-iQd+Agm1BjukFck-x+kKmQ@mail.gmail.com>
MIME-Version: 1.0

------sinikael-?=_1-17364333937490.28304631087789
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP MESSAGE-----
Version: Mailvelope v6.0.1
Comment: https://mailvelope.com

wcFMAy3n9oegk2NSARAApgl4nuztm5uxuCe+7ISW9Ox+315/pCHZmOUibORX
xGEbUs+ZgTqKIdYMet3+zSS70ykgjZDvh+cLm1oGmD5ZzLxSMjhgLpqrA0tG
3GB3gus844irLGBjVwgTuwAKhRz/CYaqlKGOloQkvcwRwy3N8UY8KG/WqD63
g9WQKYc+8+cR4wfQ0PSzZL6HexdT2LE2mWgKxStwDbbkwZumR0qZy4OvyI6O
zFCZSaz3F3VnDGbQgo5hK8Iynf25sC54P/E0ykdG6QpJZPo/ASoWePv0XyT6
wRiqq2cx366P6lxB3CJyjn+qRCfcXz0XXYejHmuI++S6ucNS4JcIhpuoi+tv
8b7pSy/6yQEKLyUhPfUmvFLxBm10bu8E9uhsmZnpiSnBsEGkLm/l9TFbOOSd
9nK0NeEVfqfIi25bxVJtRcYryf7BpjmgEdKlmF8Efeb1RpaI8IwVc6E7AhYB
c1vz1gN6BQ5ePtlHDFKxFV3jIqBKck8h2GSFGEYOXyTT+3tgFkqv/SuAUed9
X0bCjy7v578nsNieoyy/133X1+mu7L8rdADEAHhU/WLQ9VY/xu6GhNA0vzU8
yVQfSEJ1DJ4awU9Cn1mrbVg3vD/jpQzs67Sd33gC8xMqA9ZFOmXrnR4V1wkz
Y8XobC+UY6o9qn/Oz5mEtZG8rItYJ/bPOSSlFP6kXVrBwUwD8GquMWN8AUEB
D/9IVPN/qCtuhF+9jIjrxiw+agmeqUPWBEmLLZYL6xivP7Bn5bOJb6wwgU4e
IRIoh3Q5AKLvqN26BPePM16yZ6Z6qxTP/CFT5mOQQbj+3TH6fYD1ui74FoyR
+szTfntIdUOShKqogSKoRytMXheR+4TW7/D525ohRUsz71pfdCxqYC+k/vXr
ffl7lkv/V7GkPJ5fT+CantgLqXVevCIKOMVDVBT6G92t8Zn0klqv+MfVsZ3V
6FbwcqS+GxsCNezSdT1+K2yPja0fZffQOHD6nLDyIZmcr8KrCmP1MPY5LKJw
bMVCbYz0CrRl9d6JJGZOq+yapVOc0CDxWmxhGJP3M9OiCvGoPz3l+fDdNJ0f
dmxEv8c/I5t+AELxLMBa4aPuGE3pZQj4zyzhC3gnK5n9bqFecHl2+Kz+aVsi
4B1xZXIPT+XmlXM4rgCtuMlKZ6YkGRWiAnC8jok/k4iPaN7mfKbos0xwa187
haMjKKFVP8YvXlYpGeuvP3C2/oBxwsw9WihqL2tLTEE60ZgDEKWcZ3zwVKjl
bSNeDsWXlj+vIletdDyH/AMhyDOnUDc4bTkRW7W8ntq3fi8XmpQjHzW02BEd
Wq1Y/bV7nlh97Y7d3z5zlLhQnKrrP5IyQdOkd2WGpU39cDZe6XE6arQZKGVT
upnuX3Q48Hm6oSga+cydngjShtLCFQF/MFCZVYydjhe+KtzZCYBZ8nCMRxcV
PTuACJtUqOR/z5aPgRjM14accCYDwJ0Dm51h5LuEzYFDJjcdFbVSVfvnCy5a
b9h6VBCpWieI6ubAzYKKJxGwp/OcoaQyYPjwlNQyTSb7omZPsAtFpTALNXbU
CIM2cFnD/MMvgEHCuqPZoKh0YdQxYV50p36Wa/rMvTfW+S1T2neWGD6kMDWZ
I651K+HBCQV6INrJk5ugvCt26/l8+Y75cnGEKbkyJgt+NGjULX3jjPawhvwN
0EKx8hYwASuJ3E71iAXga7oSMRemDk4ZXoz+PDngoWtcoXcdQNMiVymOt6iZ
P5ImSQXkId1XZYjS3+1t+Sk8WgUi5kvu4WP3hm1Ovjd1kXTy3lqXpfci23si
eZofjs9DLldkV5xtOwWVx/B1UkqvtD2BuwcDWgvGEm2LEn4/eXkHUTzHLs4j
T9s454HasmVfd+4/koBdD6ASDqFf5Ue14OonsXvIvLop2CgUHxDVffr1onSk
K9r0kKxe9iAFZ8KYpf2Do/FPTL8BIXjHC2vfJ05wl262xs7uNMdgWm4+NP/q
uVNOoXByZIDEPixx7jimKhlEIZx36AbsI+OB5cV1Pr5SSbO3w205ALol+xKN
TPJiaQDH8qNXX+9j4JfO8uWvDmhPUe83bm/mHg4wf/39+PNQptwmhLH9iXtC
Czqgmr1vUNd/8dLgQuqVn/R3uUbGeWmKD9cqURWcvumbq+rFWPl1N7T7VRfc
XGDnMBNBmLke2YO8XUY561lqKekfS/2fekSdz005sI2cnGmy5LLh+kPN6opz
0pA2kSskbfSQqJmEdjKQU3oGEzEgwvOXjFwT7cChevgLEmDBkQXTDuEeo3Kb
KnwaNPnodzaNXAfZh/NylEgcUFjEx6crZMN3ztl8zsvAvP4P0BPmixZ89G80
5fkw+PwLe2vPtuObvuY+ezbJGb1jV0tWZFXF
=3DaQyM
-----END PGP MESSAGE-----

------sinikael-?=_1-17364333937490.28304631087789--

it was encrypted second time:

Received: from 119074447949 named unknown by gmailapi.google.com with
 HTTPREST; Thu, 9 Jan 2025 09:36:34 -0500
From: [email protected]
MIME-Version: 1.0
Date: Thu, 9 Jan 2025 09:36:34 -0500
X-Gm-Features: AbW1kvZerBTB1FnSQGtEQ_NACDxdSIwMt2qg_XU0_LVNumqo-Vp-aFfEvWn9Scg
Message-ID: <CAAv=BDEx1vxjv2+Sjzinvc9=69L-iQd+Agm1BjukFck-x+kKmQ@mail.gmail.com>
Subject: Test double-encryption from Mailvelope
To: sergey ivanov <[email protected]>
Content-Type: multipart/encrypted;
	protocol="application/pgp-encrypted";
	boundary="18190cf9bee5c75b_15705ed2cff933e6_caff395d1d1bafce"

OpenPGP/MIME message (Automatically encrypted by Stalwart)

--18190cf9bee5c75b_15705ed2cff933e6_caff395d1d1bafce
Content-Type: application/pgp-encrypted

Version: 1

--18190cf9bee5c75b_15705ed2cff933e6_caff395d1d1bafce
Content-Type: application/octet-stream; name="encrypted.asc"
Content-Disposition: inline; filename="encrypted.asc"

-----BEGIN PGP MESSAGE-----

wcFMA/BqrjFjfAFBAQ//R4SrfZ/MLhzXGSt0I8dHlurpoGrq52HCU58v/ERLyxqG
wQJsLKiidVRtg5WRxHZHpISsbiF2Q6BTodP/x+KcbW1Z0pBPKAvdpQZwYqgj9y0W
...

[mdecimus]

The issue here is that Mailvelope is not indicating in the headers that it is an encrypted message. Stalwart will have to analyse the contents of each message just to support Mailvelope.

[mdecimus]

This has been fixed.