I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had. Lately, I have uncovered upon own initiative a flaw in the web login interface of a bank, which flaw I plan to not further disclose in public.
The bank in question features a responsible disclosure program in which anyone can report issues over email, given that the message (body) in the mail is encrypted using a public PGP key provided. As such, I have formulated the report and encrypted the message (Version: BCPG C# v1.6.1.0), and sent the PGP message from Gmail.
Several days later I receive a response in Gmail with no mail body, yet with 3 attachments:
- 1 format-less file containing a PGP-message
- 1 format-less file containing only "Version: 1"
- 1 .eml file that features meta-data and again, the PGP-message which I believe is the response. See attachment below.
However, I am puzzled by how I would be suppose to decrypt their response, for the simple fact I miss the private key. Furthermore, in my initial report I did not propose a new means for future communication or public key of my own to allow them to respond. I have responded with a new message, encrypted using again their public PGP key, but have received no response any more since weeks.
Lastly, I have attempted to run their message through https://cirw.in/gpg-decoder to (at least) check information-contents of the keyblock but receive a "invalid packet format".
What am I missing? Perhaps a fundamental lack of knowledge on my end makes me oversee something? Guidance or advice here is more than welcome.
EML attachment contents: