This OpenPGP key is not usable.

[RainOrigami]

Hello

When trying to import the public PGP-Key from https://www.datenschutz-berlin.de/ueber-uns/kontakt/ I am getting an error message "This OpenPGP key is not usable.". No further reason specified why it's not usable and when searching for this exact error message on google, I get zero results.

It would be very nice if I could import the public PGP-Key of the data protection authority of my residence. They, unfortunately, have not updated their key in the FlowCrypt key server since it expired in 2020, which means I can not send them any mails unless I import their PGP-Key, which doesn't work. Meaning, I can't send them any signed or encrypted mails at all, or receive any mails from them.

I'd love to know what I can do about this issue, so I can send them mails. Thank you!

[tomholub]

Hello,

you will be able to send them send, unencrypted emails even if you don't have their public key, or if your copy of their public key is expired.

Could you confirm that is the case?

Of course, encryption or verification of their signed messages won't work.

As to the specific issue, I ran the key through our compatibility test at FlowCrypt Settings -> Additional Settings -> Experimental -> OpenPGP compatibility, and got the following:

(1) Primary keys found: 1  
(2) ----- Testing key 0 -----  
(3) PK 0 > Key type: openpgp  
(4) PK 0 > Is Private?: [-] false  
(5) PK 0 > User id 0: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) <...>  
(6) PK 0 > Primary User: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) <...>  
(7) PK 0 > Fingerprint: E60A A848 A60A 423A 9F1C 2D08 87E8 7B1C F73B 7E44  
(8) PK 0 > Subkeys: [-] 2  
(9) PK 0 > Primary key algo: [-] dsa  
(10) PK 0 > Usage flags: [-] [sign_data, certify_keys]  
(11) PK 0 > Primary key verify: [-] valid  
(12) PK 0 > Primary key creation?: [-] 1578645704 or 2020-01-10T08:41:44.000Z  
(13) PK 0 > Primary key expiration?: [-] 1706507329 or 2024-01-29T05:48:49.000Z  
(14) PK 0 > Encrypt/Decrypt test: Got error performing encryption/decryption test: Error: Error encrypting message: Could not find valid encryption key packet in key 87e87b1cf73b7e44: elgamal keys are considered too weak.:   
(15) PK 0 > SK 0 > LongId: [-] 494C302729F36F64  
(16) PK 0 > SK 0 > Created: [-] 1578645704 or 2020-01-10T08:41:44.000Z  
(17) PK 0 > SK 0 > Algo: [-] elgamal  
(18) PK 0 > SK 0 > Usage flags: [-] [encrypt_communication, encrypt_storage]  
(19) PK 0 > SK 0 > Verify: [-] OK  
(20) PK 0 > SK 0 > Subkey object type: [-] PublicSubkeyPacket  
(21) PK 0 > SK 0 > Subkey getBitSize: [-] 4096  
(22) PK 0 > SK 0 > Subkey decrypted: [-] null  
(23) PK 0 > SK 0 > Binding signature length: [-] 2  
(24) PK 0 > SK 0 > SIG 0 > Key flags: [-] 12  
(25) PK 0 > SK 0 > SIG 0 > Version: [-] 4  
(26) PK 0 > SK 0 > SIG 0 > Public key algorithm: [-] 17  
(27) PK 0 > SK 0 > SIG 0 > Sig creation time: [-] 1578645704 or 2020-01-10T08:41:44.000Z  
(28) PK 0 > SK 0 > SIG 0 > Sig expiration time: [-] 1578645704 + 63072000 seconds, which is: 1641717704 or 2022-01-09T08:41:44.000Z  
(29) PK 0 > SK 0 > SIG 0 > Verify: [-] valid  
(30) PK 0 > SK 0 > SIG 1 > Key flags: [-] 12  
(31) PK 0 > SK 0 > SIG 1 > Version: [-] 4  
(32) PK 0 > SK 0 > SIG 1 > Public key algorithm: [-] 17  
(33) PK 0 > SK 0 > SIG 1 > Sig creation time: [-] 1639115357 or 2021-12-10T05:49:17.000Z  
(34) PK 0 > SK 0 > SIG 1 > Sig expiration time: [-] 1578645704 + 127861653 seconds, which is: 1706507357 or 2024-01-29T05:49:17.000Z  
(35) PK 0 > SK 0 > SIG 1 > Verify: [-] valid  
(36) PK 0 > SK 1 > LongId: [-] 96325E3E012F611E  
(37) PK 0 > SK 1 > Created: [-] 1578646166 or 2020-01-10T08:49:26.000Z  
(38) PK 0 > SK 1 > Algo: [-] dsa  
(39) PK 0 > SK 1 > Usage flags: [-] [sign_data]  
(40) PK 0 > SK 1 > Verify: [-] OK  
(41) PK 0 > SK 1 > Subkey object type: [-] PublicSubkeyPacket  
(42) PK 0 > SK 1 > Subkey getBitSize: [-] 3072  
(43) PK 0 > SK 1 > Subkey decrypted: [-] null  
(44) PK 0 > SK 1 > Binding signature length: [-] 2  
(45) PK 0 > SK 1 > SIG 0 > Key flags: [-] 2  
(46) PK 0 > SK 1 > SIG 0 > Version: [-] 4  
(47) PK 0 > SK 1 > SIG 0 > Public key algorithm: [-] 17  
(48) PK 0 > SK 1 > SIG 0 > Sig creation time: [-] 1578646166 or 2020-01-10T08:49:26.000Z  
(49) PK 0 > SK 1 > SIG 0 > Sig expiration time: [-] 1578646166 + 63072000 seconds, which is: 1641718166 or 2022-01-09T08:49:26.000Z  
(50) PK 0 > SK 1 > SIG 0 > Verify: [-] valid  
(51) PK 0 > SK 1 > SIG 1 > Key flags: [-] 2  
(52) PK 0 > SK 1 > SIG 1 > Version: [-] 4  
(53) PK 0 > SK 1 > SIG 1 > Public key algorithm: [-] 17  
(54) PK 0 > SK 1 > SIG 1 > Sig creation time: [-] 1639115358 or 2021-12-10T05:49:18.000Z  
(55) PK 0 > SK 1 > SIG 1 > Sig expiration time: [-] 1578646166 + 127861191 seconds, which is: 1706507357 or 2024-01-29T05:49:17.000Z  
(56) PK 0 > SK 1 > SIG 1 > Verify: [-] valid  
(57) PK 0 > expiration: [-] 1706507329000  
(58) PK 0 > internal dateBeforeExpiration: [-] undefined  
(59) PK 0 > internal usableForEncryption: [-] false  
(60) PK 0 > internal usableForSigning: [-] false  
(61) PK 0 > internal usableForEncryptionButExpired: [-] false  
(62) PK 0 > internal usableForSigningButExpired: [-] false  

In particular this stands out:

(14) PK 0 > Encrypt/Decrypt test: Got error performing encryption/decryption test: Error: Error encrypting message: Could not find valid encryption key packet in key 87e87b1cf73b7e44: elgamal keys are considered too weak.:

Unfortunately not much we can do here, other than lowering the expectations we have of the key (allow encrypting for weak keys).

However, at least the error message could have been clearer. I'll file an issue for a clearer error message in the future.

[tomholub]

As to what to do in the meantime, I could suggest to try another OpenPGP software that is willing to encrypt for weaker keys.

[RainOrigami]

Thank you for the analysis of the problem. I am indeed able to send unencrypted emails, however for the type of communication I am engaged in, they require me to receive PGP. Sending encrypted mails was only possible after importing another (S/MIME) certificate from them, because FlowCrypt would completely refuse to send encrypted mails if there was no valid public key available for them.

I shall let them know that their key is considered too weak to be used in FlowCrypt. In their documents they suggest to use Mailvelope, but it is currently not compatible with Gmail. 🙄

[tomholub]

I was going to suggest mailvelope too, but I didn't know there were compatibility issues recently.

Have you tried a signed-only message? It's still an OpenPGP message, but only signed (you verify your identity and the content of the message), not en encrypted one. Like this:

FlowCrypt should allow you to do this even if their key is expired/not usable.