Apache OpenOffice (AOO) Bugzilla – Issue 55821
Encrypted & signed document doesn't open
Last modified: 2013-02-24 21:07:11 UTC
In latest OO 2-beta it's impossible to open a spreadsheet that has been saved with password (encrypted) and then digitally signed in ODS format. I created a spreadsheet and saved it with password. It opens OK. I created another ODS and digitally signed it with a smartcard under Windows (no password). It opens OK. I created yet another spreadsheet and saved it with password. I then saved it with password, then again digitally signed and this time it doesn't open. I always get "Read-error. Invalid password" message when opening the document. The password is correct and this has been repeated several times. All this happens under Windows XP. You can test this behaviour using these files created as described above. The password is always "abc123". http://67.15.157.7/~kabardia/echelon/OO2/Encrypted%20test.ods http://67.15.157.7/~kabardia/echelon/OO2/Signed%20test.ods http://67.15.157.7/~kabardia/echelon/OO2/Encrypted%20signed%20test.ods The last one doesn't open.
Created attachment 30344 [details] This test signed & encrypted document doesn't open (pass "abc123")
sw->mt: after entering the given password "abc123" I get the message that the password is wrong and the document isn't opened ... please have a look at this
sw, mt: is it possible to target this issue to 2.0.1? This bug would definitely lock away user's documents..
mt->mv: Happens within xLoadable->load() call, signature component is not involved. Wrong Password Exception, seems you try to open the signature stream encrypted, but it isn't...
The problem is much more dangerous, it does not happen on loading but on signing. In case of signing an encrypted document it's encryption information is errorneusly exchanged, thus the document can not be successfuly decrypted any more. Fixed.
.
Pawel Krawczyk wrote: >Does this mean the document cannot be recovered in any way? Is the >keying info preserved somewhere so that it could be recovered manually? No there is no way to get this info any more, the only way to open the document is a brutal force hacking ( means trying to get acceptable encryption initialization info ). I would say it needs even more resources than to hack a correct encrypted OOo document without knowing the password. >BTW the same bug was reported as issue 55263. Then the issue 55263 can be closed as a duplicate to this one.
Please verify the issue. re-open issue and reassign to fst@openoffice.org
reassign to fst@openoffice.org
reset resolution to FIXED
found fixed on cws fwk24 using Linux, Solaris and Windows build
*** Issue 56355 has been marked as a duplicate of this issue. ***
found fixed on master m142 using Linux, Solaris and Windows build
*** Issue 61799 has been marked as a duplicate of this issue. ***
It does'nt work for me with OOo 2.3.1 and OOo-Dev_SRC680_m239 under Kubuntu 6.06. Please reopen this issue. I went to this issue from #57249 which seems to be a duplicate of this one.
*** Issue 57249 has been marked as a duplicate of this issue. ***
this works fine for me using OOo 2.3, 2.4.1 and 3.0beta2 on Windows I cannot get a working certificate on linux / OOo, so I cannot test there. jbfaure: please reopen, if you find the issue still exists in a current version
works on linux as well (2.4.1) (although I had to start soffice.bin directly to be able to use my certificates, otherwise there were no certificates listed). A little annoying though: When another document is already open, and I open the password-protected (and signed) document via the recent document list in OOo, the password-prompt appears behind the new window (that at this time only consists of a grey background and the titlebar). But the document can be opened after entering the password.