Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

PGP and openPGP use different encryption algorithms. As I understand, PGP uses IDEA to encrypt a message, then RSA to encrypt the IDEA key. If openPGP doesn't use IDEA, how can it read PGP-encrypted messages?

share|improve this question
add comment

3 Answers

It seems to me one important question is whether you can open old PGP encrypted files. If the algorithm that was used to create it is no longer in the current PGP software it won't open. I have a similar situation, using PGP on either Windows 3 or Windows 98. In addition I can't get PGP6 won't properly install in Windows 7.

It comes down to this. An old encrypted file can only be read if it is periodically decrypted, opened and re-encrypted with a current algorithm.

share|improve this answer
add comment

PGP (the commercial product) and GnuPG are implementations of the PGP concept: that asymmetric encryption can be efficiently implemented by symmetrically encrypting data and then asymmetrically encrypting the symmetric encryption key. OpenPGP is the published specification. The oldest versions of the PGP implementation supported RSA around IDEA and the specification was evolved from the implementation.

To interoperate and allow for updates to algorithms, the software is designed with abstraction and the message format with reserved header fields to tell software implementations what algorithms were used. You want to start looking at Section 5.1 of RFC 2440.

Eugene's answer mentions some historical algorithmic details and covers the version evolution details.

Short version: because of a shared specification, interoperability issues only exist between algorithms selected or backwards-compatibility issues. Modern versions of PGP and GnuPG support many overlapping protocols. Since generated keyfiles list supported algorithms, anything should interoperate with the receiver if your software was able to encrypt a message without error.

share|improve this answer
add comment

PGP is the application which implements OpenPGP standard and adds some proprietary extensions. Consequently, as any other standard-compliant application it can interoperate with other applications which comply to the same standard.

Practically there exist old versions of PGP software which are limited in algorithms and features they support. Eg. PGP 2.6.3 used IDEA and RSA keys, while PGP 6.5 used CAST by default and Elgamal keys (if memory serves). But both these versions are outdated.

Modern versions of PGP and other OpenPGP-compatible software support probably everything the standard offers (i.e. all algorithms).

Your understanding is partially correct: if some implementation doesn't support the algorithm used in encrypted or signed message, it will fail to process this data. But as said, modern implementations (of PGP, GnuPG, our SecureBlackbox etc) handle all algorithms so problems happen only when it is old PGP used to process data encrypted or signed using modern implementations.

share|improve this answer
    
Thanks for explaining. The book I'm reading seems to be quite old and I assumed PGP had not changed its main algorithms. When you say "support probably everything" and "handle all algorithms", does this mean that the algorithm used for encryption is known, and the software can detect it and use the same algorithm for decryption? –  user420 Oct 16 '11 at 19:40
1  
@user420 OpenPGP defines a set of algorithms which are expected to be supported by all compliant implementations. So yes, if the application finds that the data was encrypted using the supported algorithm, the application easily decrypts it. The algorithm itself is specified in OpenPGP packet (the wrapper around encrypted data). –  Eugene Mayevski 'EldoS Corp Oct 17 '11 at 6:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.