Openpgpjs: Error decrypting message: Session key decryption failed - after upgrade to 4.10.10

[fluxquantum]

Hello, thanks for your continued support of this library.

I have been using version 4.10.4 of the library to decrypt streamed data from s3.

With a recent deployment, I upgraded to version 4.10.10 and started to see this error. I haven't made any code changes to my decryption strategy and was able to see that version 4.10.4 works with testing with the same s3 file - I compared their package-lock jsons side by side.

"Error decrypting message: Session key decryption failed."

My configuration and code snippet looks like

const privateKey = Buffer.from(cosObj.pgpPr, 'base64').toString();
const passphrase = cosObj.pgpPh;

const privKeyObj = (await openpgp.key.readArmored(privateKey)).keys[0];

    let privateKeyDecryptResult;
    try {
        privateKeyDecryptResult = await privKeyObj.decrypt(passphrase);
    } catch (error) {
        logger.info("await private key decrypt error: " + error);
    }

    logger.info("Getting options");
    const options = {
        // https://github.com/openpgpjs/openpgpjs/pull/1033 - Don't keep entire decrypted message in memory while streaming
        message: await openpgp.message.read(readStream),
        privateKeys: [privKeyObj],
        format: 'binary'
    };

logger.info("****About to run file decryption******");
    const decrypted = await openpgp.decrypt(options);
    const plainTextStream = decrypted.data;
    const result = await streamToString(plainTextStream);

May I know if there some code change that happened where this approach is no longer appropriate or some other dependency I need to include for the newer version?

Thank you for your time.

[larabr]

Hi @fluxquantum , could you share the public key used to encrypt, as well as the encrypted message?
If it's an RSA key, it might be related to this issue: https://github.com/openpgpjs/openpgpjs/issues/1126#issuecomment-683868831

[fluxquantum]

Hi @fluxquantum , could you share the public key used to encrypt, as well as the encrypted message?
If it's an RSA key, it might be related to this issue: #1126 (comment)

@larabr Appreciate you for following up and the help. I am asking if policy will allow me to share the public key. Is there another standard way to check the key type myself in the meantime? The message is actually data from s3 that I am stream reading. The s3 data is just a json; I will work to get a sample shared here.

[larabr]

Yes, you can inspect the key and message yourself: given the encrypted message, look at the value of message.packets[0].publicKeyId (if that is empty, we cannot debug further).
Otherwise, try to do await key.getEncryptionKey(message.packets[0].publicKeyId) and await key.getSigningKey(message.packets[0].publicKeyId) and let me know which one returns a key :)

[larabr]

Closing on the assumption that this is the same problem as #1126, let me know if the linked comment doesn't fix your issue.