How does GnuPG know the initialization vector for decryption?

Question

We can decrypt an encrypted file with correct passphrase. But how can it know the correct initialization vector during decryption? Isn't it generated randomly during encryption?

Answer 1

OpenPGP does not really use an initialization vector (it is defined to be all-zero). Instead, it uses a block of random data afterwards, which takes the role of the initialization vector in the OpenPGP-specific OpenPGP CFB mode.

From RFC 4880, OpenPGP, 13.9. OpenPGP CFB Mode:

OpenPGP CFB mode uses an initialization vector (IV) of all zeros, and prefixes the plaintext with BS+2 octets of random data, such that octets BS+1 and BS+2 match octets BS-1 and BS. It does a CFB resynchronization after encrypting those BS+2 octets.

With other words: a construct similar to the initialization vector is included with each encrypted message, while the initialization vector is defined to be constant. So yes -- something like the initialization vector is generated during encryption, but it is stored in the encryption headers and used for decryption.

Side fact: the repetition of some octets allows early detection of wrong session keys, as it is used when trying to decrypt a message without denoted recipient (using this technique, implementations of OpenPGP can skip non-matching keys early before decrypting the whole message). On the other hand, it opens up for a rather esoteric chosen ciphertext attack as described by Mister an Zuccherato (An Attack on CFB Mode Encryption As Used By OpenPGP). One of the basic cryptographic principles is broken here: do not repeat yourself, it might open up unexpected attack vectors.

Answer 2

At encryption time, the IV is stored next to the ciphertext.