Gpg4win 4.3.1

GnuPG: D-TRUST ECC smart cards are now supported. [T7000,T7001]
Kleopatra: The WKD lookup does now also work if the mail addresses are surrounded by spaces. [T6868]
Kleopatra: The WKD lookup now works even if no keyserver is configured. [T6868]
GnuPG: The Windows system root CAs are now trusted when checking CRL. [T6963]
GnuPG: For a full list of the backend changes between GnuPG 2.4.4 in Gpg4win-4.3.0 and GnuPG 2.4.5 in Gpg4win-4.3.1 please see: https://dev.gnupg.org/T6960

Kleopatra: A new mail viewer mode has been added, allowing crypto mails received by mail clients without PGP/MIME or S/MIME support to be decrypted. This means that you can open an SMIME.p7m file or openpgp-encrypted-message.asc attachment with Kleopatra, and it will be displayed as a mail. [T6199]
Kleopatra: It is now possible to certify multiple certificates at once using the group interface. [T6469]
Okular (GnuPG Edition): This PDF reader has received a lot of updates and is now ready for everyday's use.
GnuPG: Support for proxy authentication using the Negotiation method has been added. [T6719]
GnuPG: Keyserver can now be configured to the value "none" to avoid unnecessary queries to non-existing keyservers that would slow down the system. [T6708]
GnuPG: Es kann nun der Wert "none" als Schl?sselserver verwendet werden, um unn?tige Abfragen gegen nicht existierende Server zu vermeiden, die das System verlangsamen w?rden. [T6708]
GnuPG: A new option has been added to ignore specific CRL extensions. This can help as a workaround for problems with specific CRLs. [T6545]
GnuPG: Automatic proxy detection has been improved. [T5768]
Kleopatra: The start time of Kleopatra has been drastically improved on throttled systems with third-party software installed, which manipulates system calls. The number of system calls to start Kleopatra has been roughly halved. [T6259]
Kleopatra: The advanced options in the certification view are now automatically visible if they were open in the last certification. [T6480]
Kleopatra: Windows dark mode is now fully supported. [T4066]
Kleopatra: Some invalid operations, such as signing with an expired certificate, which would have resulted in errors, can no longer be triggered. The reason for this is indicated, too. [T6742 T6788]
Kleopatra: The support for Telesec signature cards has been improved. [T6830]
Kleopatra: When exporting or publishing certificates, the user is now informed if there are uncertified certificates in the export. This is especially useful when exporting groups. [T6766]
Kleopatra: Expiry dates after 19.01.2038 (year 2038 bug) are now possible. [T6736]
Kleopatra: The dialog to extend OpenPGP certificates has been improved and redundant options removed. [T6621]
Kleopatra: When creating archives, they are now written out as a .part file to improve error handling and canceling the operation without leaving a broken archive in the file system. [T6584]
Kleopatra: Updating certificates now also looks for updates in a Web Key Directory if one exists for the domain. [T5951]
Kleopatra: Progress bars are now also properly shown for S/MIME file operations. [T6534]
GpgOL: Added support for RFC2231 encoded attachment filenames, which increases compatibility with Apple Mail. [T6604]
GpgOL: Draft encryption with S/MIME certificates now skips CRL checks and is much faster and reliable. [T6827]
GpgOL: The error handling was improved if a preference for S/MIME is set and signing selected but no signing certificate can be found. See: https://gnupg.com/vsd/registry-settings.html (smimeNoCertSigErr) on how to add a custom message to instruct users what to do in this case. [T6683]
GpgOL: It is now possible to encrypt to S/MIME certificates that are untrusted or cannot be validated because of CRL errors. In this case a warning dialog is shown, allowing the user to override the errors. This is not VS-NfD compliant but can be used for unrestricted encryption. [T6701]
GpgOL: Mails without the correct MIME type but which still look like crypto mails are now decrypted. This improves compatibility with Apple Mail and various mail gateways that modify the structure of crypto mails in transit. [T6701]
GpgOL: The internal attachments are now called "GpgOL_MIME_structure.mime" instead of "GpgOL_MIME_structure.txt" to make it easier to link them to Kleopatra. This is, for example, visible for users when using the Outlook web interface. [T6656]
GpgOL: The initialization has been moved to avoid the incorrect message that GpgOL is causing a slow start of Outlook. This message might still be shown, since Outlook shows this sometimes regardless of actual timings, but the delay should be 0ms. [T6856]
GpgOL: The security approval dialog has been improved to better show problems with the available certificates in case a compliant encryption is not possible. [T6742 T6743 T6744]
GpgOL: The security approval dialog now increases its size based on the number of recipients to avoid having to use a scroll bar. [T6837]
Kleopatra: The state of Kleopatra is now properly stored in configuration files when Kleopatra is shut down on user log out. [T6667]
Kleopatra: Importing a certificate with Kleopatra will now open the main window of Kleopatra. [T6671]
Kleopatra: No longer unnecessarily watches the clipboard for changes; this could have caused issues with password managers that would empty the clipboard as soon as a third-party application tried to access it. [T6531]
Kleopatra: It is no longer possible to set expiry dates in the past. [T6519]
Kleopatra: Importing multiple certificates at once can no longer cause Kleopatra to lock up. [T6323]
Kleopatra: When generating keys on a smart card in compliance mode, only compliant algorithms are offered. [T6750]
Kleopatra: Fixed an issue where certificate tags would not be displayed correctly after reloading certificates. [T6768]
GpgOL: The security approval dialog now correctly updates the compliance status after switching protocols. [T6600]
GpgOL: The security approval is now always shown and displays the correct state for groups containing untrusted or otherwise non-compliant certificates. [T6401]
GpgOL: Fixed an issue with S/MIME opaque signed mails where the contents of invalid signed mails would not be shown. [T6624]
GpgOL: When generating a key through the security approval dialog, the configured default algorithms from GnuPG are now used. [T6805]
GpgOL: Generating keys through the security approval dialog now works as intended. [T6813 T6823 T6566]
GpgOL: A crash issue has been resolved that could occur when switching between different Outlook views, for example, from the calendar back to the mail view, while a crypto mail was open. This crash was only happening in Outlook versions older than Outlook 2019 or when the "always preview messages" setting was enabled. This potential crash affected all modern versions of GpgOL. (T6861)
GnuPG: For a full list of the backend changes between GnuPG 2.4.3 in Gpg4win-4.2.0 and GnuPG 2.4.4 in Gpg4win-4.3.0 please see: https://dev.gnupg.org/T6578

Okular (GnuPG Edition): Gpg4win has been extended with the popular Okular PDF Viewer. Although our Okular version is currently considered experimental and therefore not installed by default, this provides the ability to legally sign and verify documents with the S/MIME certificates and smart cards GnuPG supports. The GnuPG Edition of Okular is optimized to be lightweight and to provide as little attack surface as possible. It does not support any active content like javascript or media files in PDF documents. It should therefore be more suitable in high security environments than other PDF readers. See: https://www.gpg4win.org/version4.2.html
GnuPG: The new component "keyboxd" is now enabled by default for new users of Gpg4win. keyboxd stores certificates (public keys) in an sqlite database and keeps it in memory. The resulting performance improvement can be quite large especially for users with large keyrings. Adventuresome users can enable it manually: Select all certificates in Kleopatra and export them with a right click. Add a file %APPDATA%gnupgcommon.conf with the contents "use-keyboxd" (without the quote marks), then restart Kleopatra and import your certificates again. As usual we caution to make a backup of the %APPDATA%gnupg directory before modifying files in there. To switch back to the old behavior, add a "#" character in front of the "use-keyboxd" and restart Kleopatra. Where applicable you have to export the certificate before and import them again after the restart.
mkportable has been removed. Please see: https://wiki.gnupg.org/Gpg4win/PortableVersion on how to create a portable version of Gpg4win.
Kleopatra: Folder encryption and decryption (gpgtar) has been completely reworked so that it now has roughly the same performance as on the command line. The new architecture also allows for further performance improvements in the future and is much more robust. And solves several issues. [T5478 T6488 T6499 et.al.]
Kleopatra: The progress indicator now also works for very large data files. [T6534]
Kleopatra: It is now possible to rename the output file, if a file with the same name already exists, instead of just overwriting or canceling. [T6372]
Kleopatra: It is now offered to delete the secret key on the computer after it was successfully transferred to a smart card. [T5836]
Kleopatra: Added warnings when your certificate or other certificates in your keyring are about to expire. The warnings are configurable and should allow a smoother switch to a new or extended certificate. [T6452]
Kleopatra: The Notepad now also uses the last chosen certificates for signing and self-encryption as default. The values are shared with file encryption.[T6415]
Kleopatra: The startup time of Kleopatra has been slightly improved. [T6259]
Kleopatra: The certificate selection input and dropdown fields are now alphabetically sorted. [T6492, T6514]
Kleopatra: Backed up subkeys can now be restored through the UI even when they were used from a smart card in between. [T3456, T3391]
Kleopatra: For certifications of public keys it is now possible to configure a default validity period. [T6452]
Kleopatra: When extending the validity period of a certificate, the default for new ones is now preset. [T6479]
Kleopatra: The default validity of new certificates is now three years instead of two. This can be changed through configuration. [T2701]
GpgOL: Now offers to create a OpenPGP certificate, if none with signing capability exists and only signing is requested. [T5869]
GnuPG: The PKCS#12 (.p12 files) parser has been rewritten to increase compatibility with other PKCS#12 implementations. [T6536]
GnuPG: S/MIME certificate listings have been sped up on Windows. [rG08ff55bd44]
GnuPG: A new option "ADSK" has been added to signal the intention that messages should be encrypted to multiple subkeys. [T6395, https://gnupg.org/blog/20230321-adsk.html]
GnuPG: There are now more compressed formats detected for which GnuPG then automatically disables its builtin compression. This can result in significant speed ups. [T6332]
Kleopatra: An accidental timeout when creating checksum files has been removed. This could result in empty or incomplete checksum files. [T6573]
Kleopatra: The validity period of all subkeys is now extended even if the primary key was already expired. This fixes the case where seemingly extended keys were no longer usable for encryption. [T6473]
Kleopatra: A rare occurrence, where encryption only keys would be offered as signing keys, has been fixed. [T6456]
Kleopatra: Some obsolete configuration options have been removed. [T6326 T6327]
Kleopatra: The button "What's this" in the right upper corner has been removed, since it was only used in very few places. [T6318]
Kleopatra: Canceling file operations now reliably cancels the underlying backend operations, too. [T6524]
Kleopatra: A number of encoding problems when displaying output from the backend have been solved. [T5960]
Kleopatra: A cause for longer loading time of the certificate list at startup was fixed. [T6261]
Kleopatra: Selecting cancel when exporting a secret subkey now properly cancels instead of creating a file without the secret part. [T5755]
Kleopatra: When importing secret keys you do not want to mark as your own, it is no longer asked multiple times if it is your own key. [T6474]
GnuPG/Kleopatra: Error handling for permission and write errors has been improved across the board. [T6528]
GpgOL: An issue has been fixed where crypto mails would show up empty if text/plain display was preferred. [T6357]
GpgOL: Fixed a crash that occurred when encrypting a mail with an attachment without a file name. [T6546]
GpgOL: Category and flag changes now work again if the mail is not displayed in a decrypted state when they are made. [T4127]
GpgOL: Added safeguards against a plain text leak back to the server in a specific unusual configuration. (dd3ff839)

GPA: So long, and thanks for all the fish. To reduce maintenance and overall quality of Gpg4win we have decided to retire GPA. Over the last decade Kleopatra has made large improvements in quality and is very well maintained and the focus of our development. [rW3f7ed3834f]
GnuPG: Improve signature verification speed by a factor of more than four. Double detached signing speed. [T5826]
GnuPG: Import stray revocation certificates to improve WKD usability.
GnuPG: New option --add-revocs for gpg-wks-client. [rG2f4492f3be]
GnuPG: Ignore expired user-ids in gpg-wks-client. [T6292]
GnuPG: Support the Telesec Signature Card v2.0 in OpenPGP. [T6252]
GnuPG: For the new AEAD Format we now only allow the fast OCB mode. The EAX mode may still be used for decryption. [rG5a2cef801d]
Kleopatra: Support the import of non-standard conforming UTF-16 encoded text files with certificates. [T6298]
Kleopatra: New Option to delete the locally stored secret key after a transfer to a smart card. [T5836]
Kleopatra: Improve the display of keys in the group edit dialog. [T6295]
Kleopatra: Simplify changing the owner trust of keys. [T6148]
Kleopatra: Allow selecting ECC with supported curves when generating new keys for smart cards. [T4429]
GnuPG: Update the X.509/CMS library Libksba to version 1.6.3 to fix a security problem in the CRL signature parser. [T6230]
GnuPG: Fix trusted introducer for mbox only user-ids. [T6238]
GpgOL: IMAP access to encrypted mails works again. [T6203]
Kleopatra: Don't report success if the key signing job was canceled. [T6305]
Kleopatra: Report failed imports immediately when receiving the result. [T6302]
Kleopatra: Do not offer invalid S/MIME certificates for signing or encryption. [T6216]
Kleopatra: Don't ask user to certify an imported expired or revoked OpenPGP key. [T6155]
Kleopatra: Do not crash when closing details widget while certificate dump is shown. [T6180]
Kleopatra: Improve usability and accessibility of the notepad operations. [T6188]

Kleopatra: A crash that occured when exiting the Application has been fixed. (T5962)
GnuPG: Security update to 2.3.7 to fix CVE-2022-34903. (T6027)
GnuPG: Improved import of PKCS#12 containers. (T6037,T5793,T4921,T4757)

GpgOL: Added support for encrypting Outlook elements such as forwarded mails or contacts and events. (T4184)
GpgOL: The "conflicting crypto preferences" warning now ignores more undocumented states. (T5335)
Kleopatra: Added a "Groups" feature where you can define recipient groups that can then be selected as a whole when doing operations. (T5175 T5241)
Kleopatra: Encryption works again with Windows shared file system paths. (T5216)
Kleopatra: The check for elevated execution is now only a warning and no longer a hard error. (T5248)
Kleopatra: The combined export of S/MIME and OpenPGP certificates has been improved. (T5002)
Kleopatra: Search no longer shows all results as uncertified. (T5388)
Kleopatra: Added support for additional CardOS Smartcards. (T4876)
Kleopatra: Automatically imports public keys for the inserted Smartcard from an Active Directory / LDAP Server. (T4876)
Kleopatra: The certify dialog now allows to certify a key as the certification authority for a specific domain. This enables Public Key Infrastructures where the certification is delegated. (T5245)
Kleopatra: The Smartcard view has been improved for better usability. (T4876)
Kleopatra: Complex LDAP Keyserver entries can now be entered without corruption. (T5404)
Kleopatra: Very large Archives no longer lead to crashes on decryption. (T5475)
Kleopatra: The performance when decrypting archives has been improved. (T5478)
Kleopatra: Encrypting folders with files larger then 4GB no longer leads to truncated archives. (T5475)
Kleopatra: Searching on LDAP / Active Directory for OpenPGP keys can now show multiple keys and shows details. (T5441)
GnuPG: Importing OpenPGP keys from LDAP no longer strips third party signatures. (T5387)
GnuPG: Files encrypted with S/MIME (CMS) but only with a password can now be decrypted.
GnuPG: Special characters (non 7bit) are now handled again. (T4398)

GpgOL: Fixed a critical issue since Gpg4win-3.1.12 where the selection of "No Key" for a recipient could lead to arbitrary keys selected instead. (T5223)
GpgOL: auto-key-retrieve in the GnuPG config now no longer leads to "No Data" errors when viewing signed mails. (T5164)
GpgOL: The error "No Data" now leads to more useful output in the mail view. (T5164)
GpgOL: The name for VS-NfD compliance is now configurable through libkleopatrarc.
Kleopatra: The dialog to create new keys has been simplified and makes it easier to create keys without protection. This can be disabled by setting "enforce-passphrase-constraints" in the gpg-agent configuration. (T5181)
Kleopatra: Name and e-mail for new keys are now obtained through active directory if they are available. (T5181)
Kleopatra: Creating S/MIME CSRs for OpenPGP Smartcards has been further improved. (T5127)
Kleopatra: Tag support for certifications has been greatly improved and is now also available when adding keys in the file encrypt dialog. (T5174)
Kleopatra: Elevated execution of Kleopatra (run as Administrator) is now prevented to avoid accidental permission problems in the GnuPG data folder. (T5212)
Kleopatra: Setting the initial SigG PIN for NetKey cards now also works if the generic PIN is not set. (T5220)
GnuPG: Now supports system wide configuration files in "%ProgramData%\GNU\etc\gnupg" so Administrators can both set defaults and enforce a specific configuration. The Format is the same as the user configuration under "%AppData%\gnupg" with additional syntax to enforce some options and ignore other options. (T4788)
GnuPG: OpenPGP certificates can no be obtained automatically over Active Directory.
GnuPG: The scheme for LDAP access has been improved.
GnuPG: Updated to 2.2.27 See: https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000452.html Announcement for 2.2.26: https://lists.gnupg.org/pipermail/gnupg-announce/2020q4/000451.html

GnuPG: Updated to 2.2.23 to fix CVE-2020-25125. ( https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html )
GpgOL: Fixed an issue where unencrypted drafts of mails were stored on the an Exchange Server and could be restored through the "recently deleted items" option. Especially if the draft encryption, introduced in Gpg4win-3.1.8, is used this can be a security issue. (T5022) Gpg4win cannot offer guarantees that Outlook does not send data which is entered *before* the encryption to Microsoft or an Exchange Server. Under Windows with Outlook this is impossible to control. The draft encryption option is our best effort to avoid this.
GnuPG:           2.2.23
Kleopatra:       3.1.12
GPA:             0.10.0
GpgOL:           2.4.7
GpgEX:           1.0.6
Kompendium DE:   4.0.1
Compendium EN:   3.0.0

GpgOL: Fixed a possible plaintext leak to the mail server, which could occur when opening and closing mails while the mail was also visible in the message list. (T4622 T4621)
GnuPG: Ignore all key-signatures received from keyservers. This change is required to mitigate a DoS due to keys flooded with faked key-signatures. The old behaviour can be achieved by adding keyserver-options no-self-sigs-only,no-import-clean to your gpg.conf. (T4607) See: https://wiki.gnupg.org/WKD for an alternative to the keyservers.

• The cryptography library libgcrypt has been updated to version 1.6.6 to include a fix a problem with the random number generator.

When S/MIME is disabled in GpgOL it now also ignores sent mails.
Problems causing the start of Kleopatra and GPA from GpgEX and GpgOL have been fixed.
Various regressions in 2.3.1 are now again fixed.

- GpgOL now has an option dialog where S/MIME can be disabled.

- GpgOL now supports the 64 Bit version of Microsoft Outlook.

- GpgOL can be switched to the new, experimental, MIME aware behavior in the
Options Dialog.

- GpgOL now reverts temporary changes made to MIME mails. So that they an be
opened with other clients again.

- GpgEX no longer blocks the Windows Explorer while it starts GPA or
Kleopatra.

- GpgOL now supports reading PGP/MIME and S/MIME mails, the standard
format for Crypto Mails as sent by Thunderbird/Enigmail, GPGMail
or KMail. For details see: https://wiki.gnupg.org/GpgOL/MIMESupport

- GpgOL now supports Outlook 2016.

- AES-NI Instructions for faster encryption and decryption with AES
are now supported. (GnuPG Bug #1919)

- The decrypt/verify window of GpgOL no longer moves and resizes
erratically. (KDE Bug #355140)

- Bulk import of more then a hundred keys no longer fails when Kleopatra
is running. (GnuPG Bug #2135)

- French and Chinese localisation has been added to the installer,
GpgEX and GpgOL. Thanks to Oliver Serve and Mingye Wang.

- Several apparently random crashes in GpgOL have been fixed
(GnuPG Bug #1837)

- GpgOL now handles attachments in PGP/MIME and S/MIME mails with non ASCII
characters in the filename correctly.

- A vulnerability in the Gpg4win-installer has been fixed.
See [security advisory 2015-11-25] for details: http://lists.wald.intevation.org/pipermail/gpg4win-announce/2015-November/000066.html

- Included Gpg4win components are:
GnuPG: 2.0.29
Kleopatra: 2.2.0-gitfb4ae3d
GPA: 0.9.9
GpgOL: 1.3.0
GpgEX: 1.0.3
Kompendium DE: 3.0.0
Kompendium EN: 3.0.0

Claws Mail has been removed from the package. Users of Claws Mail should switch to the version maintained by the Claws Mail initiative available on: http://www.claws-mail.org/win32/
GnuPG has been updated to Version 2.0.29.
X509 Certificate requests can now again generated with default options.
GPA has been updated to Version 0.9.9.

GnuPG has been updated to version 2.0.28. See release notes on www.gnupg.org for details.
A potential crash during certificate search has been fixed.
Kleopatra no longer queries revocation information for X509 certificates during startup. This will drastically improve the startup time for some users. Revocation information is still checked once a certificate is used.
Kleopatra now uses the same defaults as GnuPG for new OpenPGP certificates.
Third party libraries included in Gpg4win have been updated.
GnuPG: 2.0.28
Kleopatra: 2.2.0-gita3c9200
GPA: 0.9.7
GpgOL: 1.2.1
GpgEX: 1.0.2
Claws-Mail: 3.9.1
Kompendium DE: 3.0.0
Kompendium : 3.0.0

The vanilla installer has been fixed by including GnuTLS.
Creation of portable versions with mkportable has been fixed.
GPA now works again under Windows XP.
Verification of a detached signature without specifying what should be verified may now show a warning and has been disabled in batch mode.
Tar archives can now include files and folders that use special characters (e.g. umlauts) which can be encoded in the native Windows 8-Bit codepage.
Kleopatra now handles preprocessing (e.g. archiving) errors and safely aborts the operation.
GPA has been updated to version 0.9.6.
A security problem in the libksba library has been fixed.

- GnuPG:
* Fixed possible infinite recursion in the compressed packet
parser. [CVE-2013-4402]

* Support for SPR332 and 532 pinpads.

- Kleopatra:
* Kleopatra no longer crashes when using Microsoft Office IME.

- Included Gpg4win components are:

GnuPG: 2.0.22
Kleopatra: 2.2.0
GPA: 0.9.4
GpgOL: 1.2.0
GpgEX: 1.0.0
Claws-Mail: 3.9.1
Kompendium DE: 3.0.0
Kompendium EN: 3.0.0

Included Gpg4win components in Version 2.2.0 are:
· GnuPG: 2.0.21
· Kleopatra: 2.2.0
· GPA: 0.9.4
· GpgOL: 1.2.0
· GpgEX: 1.0.0
· Claws-Mail: 3.9.1
· Kompendium DE: 3.0.0
· Kompendium EN: 3.0.0

New:

GpgEx:
· Now with Windows 64 bit support!

GpgOL:
· Rudimentary support for Outlook 2010 and 2013.
The following crypto functions are already available via the new GpgOL ribbon rsp. Outlook's context menu (no MIME parsing, yet):
· Encrypting/decrypting mail bodys
· Saving and decrypting attachments
· Attaching and encrypting files
· Signing and signature verification (of opaque signatures)

· GpgOL for Outlook 2003 and 2007 is unaffected by these changes.

Kleopatra:
· Kleopatra no longer crashes when started by a regular user on terminal servers (Windows Server).

Pinentry:
· Pinentry now allows to paste in the passphrase.

GnuPG-Backend:
· Gpg-agent may now be used as Pageant (PuTTY authentication agent)
· replacement with additional smartcard support.
· Updated to GnuPG 2.0.21.

GPA:
· Fixed crash when copying a key in the clipboard (gnupg bug #1525).

Installer:
· Updated license page.
· Removed S/MIME HOWTO page (still easily accessible via Gpg4win's program menu entry).

Gpg4win portable Version:
· Added mkportable.exe as a new tool to create a portable installation.