sending works, but receiving does not work: Exception: org.signal.libsignal.protocol.InvalidMessageException: invalid Whisper message: decryption failed (ProtocolInvalidMessageException)

[Wikinaut]

• signal-cli --version 0.12.8
• Sending: works
• Receiving: does not work

[After 108 days not running the receive command, ] now I see this when receiving a message:

How can I fix this issue?

signal-cli -u +YY receive
Envelope from: “X” +XX (device: 3) to +YY
Timestamp: 1716293968492 (2024-05-21T12:19:28.492Z)
Server timestamps: received: 1716293968558 (2024-05-21T12:19:28.558Z) delivered: 1716293968561 (2024-05-21T12:19:28.561Z)
Sent by unidentified/sealed sender
Exception: org.signal.libsignal.protocol.InvalidMessageException: invalid Whisper message: decryption failed (ProtocolInvalidMessageException)

Envelope from: “X” +XX (device: 3) to +YY
Timestamp: 1716293968853 (2024-05-21T12:19:28.853Z)
Server timestamps: received: 1716293969955 (2024-05-21T12:19:29.955Z) delivered: 1716293969957 (2024-05-21T12:19:29.957Z)
Received a receipt message
  When: 1716293969955 (2024-05-21T12:19:29.955Z)
  Is delivery receipt
  Timestamps:
  - 1716293968853 (2024-05-21T12:19:28.853Z)

[m-ueberall]

@Wikinaut: Depending on where you got your installation of signal-cli from, did you already try to switch to a current version (v13.3 at the time of writing)?

[Wikinaut]

See my other issue which prevents running >= 13.0

@Wikinaut: Depending on where you got your installation of signal-cli from, did you already try to switch to a current version (v13.3 at the time of writing)?

#1531

[Wikinaut]

Is there a way to restart the ratcheting....? I could not find a command.

[m-ueberall]

See my other issue which prevents running >= 13.0
#1531

Ah, I missed that. For Debian 12/Bookworm, you currently have two options (depending on your architecture, that is): Either upgrade to JDK21 using external packages (see, e.g., https://computingforgeeks.com/install-java-jdk-or-openjdk-21-on-debian/) or use a signal-cli binary produced with GraalVM (see https://github.com/AsamK/signal-cli/wiki/Binary-distributions).
For other/currently unsupported architectures, you best bet would be to backport Open JDK 21 based on testing/Trixie packages; on Ubuntu, a backport for 20.04/Focal exists since January (which suggests that it's not an impossible task).

[AsamK]

You can try to reset the session with send -e

[Wikinaut]

You can try to reset the session with send -e

This worked from the server Y to my smartphone X (I see a message there that the secure session was reset).
But it did not help to receive.

I still got

Envelope from: “X" XX (device: 3) to Y
Timestamp: 1716389047416 (2024-05-22T14:44:07.416Z)
Server timestamps: received: 1716389047603 (2024-05-22T14:44:07.603Z) delivered: 1716389047605 (2024-05-22T14:44:07.605Z)
Sent by unidentified/sealed sender
Exception: org.signal.libsignal.protocol.InvalidMessageException: invalid Whisper message: decryption failed (ProtocolInvalidMessageException)

[thomas725]

I'm using signal-cli-native installed through the apt repository listed on https://packaging.gitlab.io/signal-cli/installation/standalone/ on my arm aarch64 debian11 pi4 machine.

It works fine for sending, but now that I wanted to add receiving features I am stuck on the same problem as described by @Wikinaut. Do I understand the above thread correctly that switching to the signal-cli-jre version should help (as long as I have java21 installed on the machine?)

UPDATE: installed java21 (as described here) and to circumvent the jre21 package dependency, signal-cli-jre version using:

apt-get download signal-cli-jre
dpkg --force-all -i signal-cli-jre_0.13.9+morph027+1_arm64.deb

But sadly I see no difference in it's behavior compared to the signal-cli-native version. The receive command never finishes, uses 100% of one CPU core/thread, terminating with signal 15 ("SIGTERM") often takes minutes and in it's output I can see when a message is received and from whom, but not if via direct message or via which group, and not the message's content.

example stderr with "--verbose" passed once:

[Thread-2] INFO  LibSignal - [OkHttpWebSocketConnection]: [unidentified:855830535] Sending keep alive...
[main] DEBUG o.a.s.m.h.IncomingMessageHandler - Failed to decrypt incoming message
org.signal.libsignal.metadata.ProtocolInvalidMessageException: org.signal.libsignal.protocol.InvalidMessageException: invalid Whisper message: decryption failed
        at org.signal.libsignal.metadata.SealedSessionCipher.decrypt(SealedSessionCipher.java:232)
        at org.whispersystems.signalservice.api.crypto.SignalSealedSessionCipher.decrypt(SignalSealedSessionCipher.java:70)
        at org.whispersystems.signalservice.api.crypto.SignalServiceCipher.decryptInternal(SignalServiceCipher.java:202)
        at org.whispersystems.signalservice.api.crypto.SignalServiceCipher.decrypt(SignalServiceCipher.java:144)
        at org.asamk.signal.manager.helper.IncomingMessageHandler.handleEnvelope(IncomingMessageHandler.java:145)
        at org.asamk.signal.manager.helper.ReceiveHelper.receiveMessagesInternal(ReceiveHelper.java:213)
        at org.asamk.signal.manager.helper.ReceiveHelper.receiveMessages(ReceiveHelper.java:104)
        at org.asamk.signal.manager.internal.ManagerImpl.receiveMessages(ManagerImpl.java:1288)
        at org.asamk.signal.manager.internal.ManagerImpl.receiveMessages(ManagerImpl.java:1260)
        at org.asamk.signal.commands.ReceiveCommand.handleCommand(ReceiveCommand.java:86)
        at org.asamk.signal.commands.CommandHandler.handleLocalCommand(CommandHandler.java:35)
        at org.asamk.signal.App.handleLocalCommand(App.java:278)
        at org.asamk.signal.App.handleCommand(App.java:179)
        at org.asamk.signal.App.init(App.java:144)
        at org.asamk.signal.Main.main(Main.java:56)
        at java.base@21.0.2/java.lang.invoke.LambdaForm$DMH/sa346b79c.invokeStaticInit(LambdaForm$DMH)
Caused by: org.signal.libsignal.protocol.InvalidMessageException: invalid Whisper message: decryption failed
        at org.signal.libsignal.internal.Native.SessionCipher_DecryptSignalMessage(Native Method)
        at org.signal.libsignal.protocol.SessionCipher.lambda$decrypt$2(SessionCipher.java:176)
        at org.signal.libsignal.internal.FilterExceptions.filterExceptions(FilterExceptions.java:362)
        at org.signal.libsignal.protocol.SessionCipher.decrypt(SessionCipher.java:169)
        at org.signal.libsignal.metadata.SealedSessionCipher.decrypt(SealedSessionCipher.java:275)
        at org.signal.libsignal.metadata.SealedSessionCipher.decrypt(SealedSessionCipher.java:230)
        ... 15 common frames omitted
[main] DEBUG o.a.s.m.h.IncomingMessageHandler - Received invalid message, requesting message resend.
[main] DEBUG o.a.s.manager.helper.ReceiveHelper - Checking for new message from server
[main] DEBUG o.a.s.manager.helper.ReceiveHelper - Retrieved 1 envelopes!
[main] DEBUG o.a.s.manager.helper.ReceiveHelper - New message received from server
[main] DEBUG o.a.s.m.h.IncomingMessageHandler - Failed to decrypt incoming message

example stdout also with "--verbose" passed once, same run, unsure if from same message because I process them separately, but every message looks the same beside names and phone numbers:

Envelope from: “name” phone-number (device: 1) to my-number
Timestamp: 1729462189733 (2024-10-20T22:09:49.733Z)
Server timestamps: received: 1729462189156 (2024-10-20T22:09:49.156Z) delivered: 1731056698079 (2024-11-08T09:04:58.079Z)
Sent by unidentified/sealed sender
Exception: org.signal.libsignal.protocol.InvalidMessageException: invalid Whisper message: decryption failed (ProtocolInvalidMessageException)

@Wikinaut did you manage to solve your problem or did you give up on receiving input via signal-cli?