Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some questions concerning how GnuPG operates when encrypting and signing messages.

By default:

  • Which cipher and mode-of-operation is used for symmetric encryption?
  • What encryption scheme is used for the encryption of the session key?
  • Which hash function and signature scheme is used in a signed message?
share|improve this question
up vote 5 down vote accepted

GnuPG implements the OpenPGP standard which contains most of the answers you are looking after. Namely:

  • Symmetric encryption uses CFB mode (with full-block feedback). Supported block ciphers are IDEA, CAST5, 3DES, Blowfish, AES and Twofish. Other algorithms may be supported in the future.
  • The session key is encrypted with the recipient's public key, using whatever algorithm is appropriate for the used key type. OpenPGP supports RSA and ElGamal. There is room for other algorithms but the standard mandates only these two.
  • Signatures use an algorithm which depends on the signer's key type; the standard describes formats for RSA and DSA. There again, there is room for other future algorithms. The hash function used with the signature algorithm can be MD5, RIPEMD-160, SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512.

See section 9 for the lists of supported algorithms.

GnuPG implements most of the above; some of the algorithms may be absent, depending on how it was compiled. Most recent pre-compiled GnuPG packages will lack support for the IDEA block cipher (because it was patented until quite recently), but will include support for the block cipher Camellia in addition to the standard ones (despite the fact that Camellia is patented, but available under a royalty-free license).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.