How to decrypt Delta Chat messages in Thunderbird?

[Iago]

Hi!

I am testing possibilities with delta chat. I have a disroot account whose emails I read in Thunderbird. Further, Disroot works with chatmail (https://providers.delta.chat/). Therefore, I try sending a message from my delta chat account to my disroot account, which I receive on thunderbird, but encrypted. How can I decrypt it? Is there some way to get the public key of delta chat account and provide it as a file to thunderbird?

Thanks!

[punkero]

I can help get you part of the way there - your export (settings, chat, export backup) from a DeltaChat app contains a SQlite file, which has a table with the PGP keypair in it. I’m not an app dev but I presume the keys are PGP/GPG standardized and can be used to decrypt. In writing this I wonder “does the private key have a passphrase?” because now I’m curious.

[Minim]

First, enable Autocrypt support in Thunderbird; I think it did have it but I’m not sure if it currently does. Autocrypt is an open standard and some mailclients support Autocrypt. You probably also want VCard import, or at least .asc file import; most mailclients with encryption have that.

You can dig into the SQL database to get the keys out without even exporting first. They used to be exportable in the UI.

You might want to talk to @seifferth about a standalone implementation of SecureJoin (the standard protocol for exchanging keys with QRcodes/URLs).

More detail (see especially the last section):

Advanced contact-adding tutorial

There is a quick guide, so try that first; this is a more detailed guide. It is possible to make contact with someone in Deltachat just like in a regular e-mail client, by typing in their e-mail address and sending them a unencrypted message. But this is not possible using the e-mail addresses Deltachat will give you automatically (Chatmail addresses), because they only work for encrypted mail. Encryption hides your messages from data harvesters, and it’s a good way to stop spam. Encrypted mai…

Example:

Is it possible to communicate with non-DC user? (interoperability with email)

let’s say, some person A isn’t yet convinced to install chatmail clients on their devices, but they use email and, if necessary, they could try a certain MUA (one supporting Autocrypt etc), and do some technical setup (import PGP keys) in advance, to connect with person B (a delta chat enjoyer). is it possible to for person B to use DeltaChat (or another chatmail client?) to communicate with person A, without person A installing any chatmail clients, relying only on well-known, established pr…

[seifferth]

In writing this I wonder “does the private key have a passphrase?” because now I’m curious.

Last time I checked, the sqlite database included in the backup contained the plain key in binary format with no passphrase. Just store this key as *.pgp and import in Thunderbird. Also note that the sqlite3 command line utility might misbehave if the key contains null characters. Last time I exported Delta Chat keys in this manner, I worked around this limitation by dumping the databse in sql format, extracting the hex-encoded key with a text editor, and decoding it with xxd.

The real problem with Thunderbird, however, is that its PGP implementation does not seem to be feature-complete enough to handle messages sent by Delta Chat. There’s two issues here where I would expect problems:

1. Delta Chat is in the process of upgrading from OpenPGPv4 packet format to OpenPGPv6 packet format defined in 2024 in RFC 9580. I believe Thunderbird does not support the latter – but I’d be extremely happy to stand corrected.
2. Delta Chat now uses a Key ID of zero in the PKESK packets in order to leak even less message metadata. This functionality is part of OpenPGP at least since 2007; see RFC 4880, section 5.1, last paragraph. Unfortunately Thunderbird does not seem to support this feature. Again I would be very happy to stand corrected.

As a side note: GnuPG also lacks support for OpenPGPv6; but Sequoia PGP is pretty good at decrypting messages created with Delta Chat. Thunderbird, of course, uses a native implementation based on RNP these days – so these issues would proably need to be fixed there in order to make it into Thunderbird at some point. Also note that Thunderbird still lacks support for RFC 9788; see Thunderbird’s bugtracker, bug 1991625. I would be very happy if Thunderbird were up to date enough to be interoperable with Delta Chat; but I’m afraid it will still take quite some time for this to happen.

[alexlehm]

The public and private key are stored in BLOB fields in the sqlite db which can be exported as .gpg files both, the private key does not have a passphrase, this means that the export file contains all info that is needed to access the account and any message (e.g. I have imported the key files for my account into gnupg and could decrypt the messages as *.asc files)

[alexlehm]

On the subject of decrypting messages in Thunderbird, there seems to be a bug in the pgp implementation that DeltaCrypt uses (or maybe a missing feature?) that some messages do not list the keyid of each recipient, they are all 0000 so that Thunderbird cannot decrypt the messsages even though they contain the key of your own email address. The same works when using gpg as local program with the mail saved as *.asc file since that tries each private key if the key id is 0000 and finds your key eventually. I had that with sending a mail to the adminstrator of one Chatmail site with pgp with Thunderbird and they replied with their Chatmail account so I got a reply that Thunderbird didn’t decrypt, but gpg did

[Minim]

Deltachat does not use GPG, but OpenPGP. The two are diverging. For compatibility, it might be better to use something like Sequoia.

[alexlehm]

I know, I am currently using DeltaChat, openpgp in Thunderbird and if that fails gpg, the results are mostly ok (but it has it’s quirks)

[Iago]

Thanks all for your answers. I didn’t have time for the moment, but when I have a moment, I’ll try to apply your suggestions.

[seifferth]

@alexlehm

there seems to be a bug in the pgp implementation that DeltaCrypt uses (or maybe a missing feature?) that some messages do not list the keyid of each recipient, they are all 0000 so that Thunderbird cannot decrypt

This is indeed a missing feature in Thunderbird. RFC 4880 “OpenPGP Message Format” from 2007 (!) states quite clearly that this is allowed. To quote from the RFC:

An implementation MAY accept or use a Key ID of zero as a “wild card” or “speculative” Key ID. In this case, the receiving implementation would try all available private keys, checking for a valid decrypted session key. This format helps reduce traffic analysis of messages.