We can decrypt an encrypted file with correct passphrase. But how can it know the correct initialization vector during decryption? Isn't it generated randomly during encryption?

2 Answers 2


OpenPGP does not really use an initialization vector (it is defined to be all-zero). Instead, it uses a block of random data afterwards, which takes the role of the initialization vector in the OpenPGP-specific OpenPGP CFB mode.

From RFC 4880, OpenPGP, 13.9. OpenPGP CFB Mode:

OpenPGP CFB mode uses an initialization vector (IV) of all zeros, and prefixes the plaintext with BS+2 octets of random data, such that octets BS+1 and BS+2 match octets BS-1 and BS. It does a CFB resynchronization after encrypting those BS+2 octets.

With other words: a construct similar to the initialization vector is included with each encrypted message, while the initialization vector is defined to be constant. So yes -- something like the initialization vector is generated during encryption, but it is stored in the encryption headers and used for decryption.

Side fact: the repetition of some octets allows early detection of wrong session keys, as it is used when trying to decrypt a message without denoted recipient (using this technique, implementations of OpenPGP can skip non-matching keys early before decrypting the whole message). On the other hand, it opens up for a rather esoteric chosen ciphertext attack as described by Mister an Zuccherato (An Attack on CFB Mode Encryption As Used By OpenPGP). One of the basic cryptographic principles is broken here: do not repeat yourself, it might open up unexpected attack vectors.


At encryption time, the IV is stored next to the ciphertext.

  • Not quite -- while OpenPGP uses a similar construct stored together with the message, the IV is defined to be all-zero.
    – Jens Erat
    Aug 24, 2016 at 20:10
  • @JensErat: that depends on the mode, but it's still shipped next to the ciphertext no matter where
    – dandavis
    Aug 24, 2016 at 21:20
  • OpenPGP only knows one specific mode of operation: the OpenPGP CFB mode, and the IV is defined to be all-zero. Although you're right in the context that a similar construct is stored within the encryption headers.
    – Jens Erat
    Aug 25, 2016 at 6:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .