Does gpg (or openpgp in general) authenticate symmetrically-encrypted data?

Question

When using gpg --symmetric to encrypt a file/message with a passphrase, is there any cryptographic integrity check to prevent an attacker from modifying the ciphertext? E.g. does gpg (or any other common implementation of OpenPGP) include, and require, an HMAC or similar? (Obviously it can digitally sign the message, but only if you use your private key.)

The OpenPGP message format does include a CRC, but those are not cryptographically secure and I don't think it's even keyed (that is, if you modify the ciphertext I can just modify the CRC). However, doing so decrypts "successfully" (tampered with) but also produces the message WARNING: encrypted message has been manipulated! Where is it getting that from? Is there some other protection? I first thought block cipher padding, but it's using AES256-CFB, which doesn't have padding to check.

Answer 1

RFC 4880 specifies a modification detection code. Essentially, the encrypted plaintext is suffixed with an additional packet that contains a SHA-1 hash of the data and some metadata, which is also encrypted in the same way. Assuming the attacker does not already know the entire plaintext, this will prevent them from being able to modify the ciphertext without detection.

The successor to RFC 4880, which is being worked on at the moment by the OpenPGP Working Group, will use a real AEAD for this. The current proposal suggests EAX and OCB, although since OCB is no longer patented, it is likely that EAX will be dropped in favor of it.