We can decrypt an encrypted file with correct passphrase. But how can it know the correct initialization vector during decryption? Isn't it generated randomly during encryption?
2 Answers
OpenPGP does not really use an initialization vector (it is defined to be all-zero). Instead, it uses a block of random data afterwards, which takes the role of the initialization vector in the OpenPGP-specific OpenPGP CFB mode.
From RFC 4880, OpenPGP, 13.9. OpenPGP CFB Mode:
OpenPGP CFB mode uses an initialization vector (IV) of all zeros, and prefixes the plaintext with BS+2 octets of random data, such that octets BS+1 and BS+2 match octets BS-1 and BS. It does a CFB resynchronization after encrypting those BS+2 octets.
With other words: a construct similar to the initialization vector is included with each encrypted message, while the initialization vector is defined to be constant. So yes -- something like the initialization vector is generated during encryption, but it is stored in the encryption headers and used for decryption.
Side fact: the repetition of some octets allows early detection of wrong session keys, as it is used when trying to decrypt a message without denoted recipient (using this technique, implementations of OpenPGP can skip non-matching keys early before decrypting the whole message). On the other hand, it opens up for a rather esoteric chosen ciphertext attack as described by Mister an Zuccherato (An Attack on CFB Mode Encryption As Used By OpenPGP). One of the basic cryptographic principles is broken here: do not repeat yourself, it might open up unexpected attack vectors.
At encryption time, the IV is stored next to the ciphertext.
-
Not quite -- while OpenPGP uses a similar construct stored together with the message, the IV is defined to be all-zero. Aug 24, 2016 at 20:10
-
@JensErat: that depends on the mode, but it's still shipped next to the ciphertext no matter where– dandavisAug 24, 2016 at 21:20
-
OpenPGP only knows one specific mode of operation: the OpenPGP CFB mode, and the IV is defined to be all-zero. Although you're right in the context that a similar construct is stored within the encryption headers. Aug 25, 2016 at 6:02