- The sender creates a message.
- The sending OpenPGP generates a random number to be used as a session key for this message only.
- The session key is encrypted using each recipient's public key. These "encrypted session keys" start the message.
- The sending OpenPGP encrypts the message using the session key, which forms the remainder of the message. Note that the message is also usually compressed.
- The receiving OpenPGP decrypts the session key using the recipient's private key.
- The receiving OpenPGP decrypts the message using the session key. If the message was compressed, it will be decompressed.
Where is the PKCS v1.5 or OAEP padding? Where is the hash/hmac integrity check? Where is the signature?
Can someone detail the actual modern PGP process or point me to a more complete explanation of the process?