5

We can decrypt an encrypted file with correct passphrase. But how can it know the correct initialization vector during decryption? Isn't it generated randomly during encryption?

7

OpenPGP does not really use an initialization vector (it is defined to be all-zero). Instead, it uses a block of random data afterwards, which takes the role of the initialization vector in the OpenPGP-specific OpenPGP CFB mode.

From RFC 4880, OpenPGP, 13.9. OpenPGP CFB Mode:

OpenPGP CFB mode uses an initialization vector (IV) of all zeros, and prefixes the plaintext with BS+2 octets of random data, such that octets BS+1 and BS+2 match octets BS-1 and BS. It does a CFB resynchronization after encrypting those BS+2 octets.

With other words: a construct similar to the initialization vector is included with each encrypted message, while the initialization vector is defined to be constant. So yes -- something like the initialization vector is generated during encryption, but it is stored in the encryption headers and used for decryption.

Side fact: the repetition of some octets allows early detection of wrong session keys, as it is used when trying to decrypt a message without denoted recipient (using this technique, implementations of OpenPGP can skip non-matching keys early before decrypting the whole message). On the other hand, it opens up for a rather esoteric chosen ciphertext attack as described by Mister an Zuccherato (An Attack on CFB Mode Encryption As Used By OpenPGP). One of the basic cryptographic principles is broken here: do not repeat yourself, it might open up unexpected attack vectors.

1

At encryption time, the IV is stored next to the ciphertext.

  • Not quite -- while OpenPGP uses a similar construct stored together with the message, the IV is defined to be all-zero. – Jens Erat Aug 24 '16 at 20:10
  • @JensErat: that depends on the mode, but it's still shipped next to the ciphertext no matter where – dandavis Aug 24 '16 at 21:20
  • OpenPGP only knows one specific mode of operation: the OpenPGP CFB mode, and the IV is defined to be all-zero. Although you're right in the context that a similar construct is stored within the encryption headers. – Jens Erat Aug 25 '16 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.