Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The first 16 bits of the message digest in a PGP signature are translated in the clear. As we know, sending something in clear text does not sound like a very good idea from a security point of view. But PGP does this. Why clear text is used in this way in PGP?

share|improve this question

closed as unclear what you're asking by Adi, Xander, scuzzy-delta, TildalWave, Manishearth Oct 15 '13 at 16:10

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

I don't know anything about PGP, but is there a chance it's an initialization vector? If so, that's not supposed to be encrypted. – loneboat Oct 15 '13 at 15:30
Are you talking about encryption or signature ? Why do you think that "sending something in clear text does not sound like a very good idea from a security point of view" ? This comment is in the clear and doesn't pose any security issue. – Stephane Oct 15 '13 at 15:44
up vote 4 down vote accepted

RFC 4880, the standard for the format of PGP messages, says:

The high 16 bits (first two octets) of the hash are included in the
Signature packet to provide a quick test to reject some invalid

However, you are thinking it wrong. Signatures are not encryption, and signatures are not encrypted. In fact, given the value of the public key (which is public) and the signature itself, one can recompute the complete hash value of the message which is signed (at least for RSA, which is technically known as a signature algorithm with recovery). The first 16 bits are just a helper so that software can avoid many modular exponentiations when it is looking for the "correct" public key among a set of candidates; they save a few milliseconds worth of computation, that's all.

A generic note is that signatures can leak information on that which is signed; so if you sign and encrypt a confidential message, then you should, conceptually, either sign the encrypted message, or encrypt the signature along with the message contents as well. OpenPGP uses the latter method.

When a message is just signed, not encrypted, then it makes no sense to hide the message hash, since the message itself, by definition, is transmitted as cleartext.

share|improve this answer
I see. I think I got myself confused with this. So does it compromise security? – Papple. Oct 15 '13 at 16:16
No. Revealing 16 bits of a piece of information which is already publicly shown does not compromise security. – Thomas Pornin Oct 15 '13 at 17:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.