4

As the title tells it, is it possible, using GnuPG, to do a symmetric encryption on a file, using a "null" key so when you do a gpg --output doc --decrypt foo, it'll decrypt it without asking for a password/passphrase ?

If not possible, is there a way, still with GnuPG, to make a PGP message that wouldn't need any password to decrypt it ?

Thanks!

  • 1
    Why in the universe would you want to do that? – forest Dec 23 '17 at 2:12
  • I found a file containing a PGP message that I was able to "decrypt" without using any password ( I haven't even been asked to submit something ), the file decrypted itself, so I wanted to know how to make such a thing – Lulzsec Dec 23 '17 at 2:18
  • Check it yourself ; pastebin.com/bDHKm0M6 – Lulzsec Dec 23 '17 at 7:22
  • Note that the pastebin content has been removed. – forest Mar 27 '18 at 2:51
  • pastebin.com/tb2CzgiB ;) – Lulzsec Mar 30 '18 at 12:36
5

There are two ways to create such a message. Either you can sign a message with the signature in the message and with --clearsign not specified, or you can use --store.

Signed but unencrypted

As for the specific message you provided, it is not an encrypted message, it is a signed message, not using a clear text signature. In other words, the signature and message are fused together. See section 1.1.2 of the GnuPG manual, which explains clear text signatures created with the --clearsign option. What you are seeing is a signature for an unencrypted file which is not using this type of signature. As a result, PGP-compatible software is required to read the file, despite it being unencrypted. This allows you to ensure integrity without requiring a decryption key.

You can create a message with a clear text signature easily:

$ md5sum message.txt
ecccffe1886ca709442672e65d66b409  message.txt
$ gpg --armor --sign message.txt

And then to access it again, you "decrypt" it:

$ gpg --decrypt message.txt.asc > message2.txt
$ md5sum message2.txt
$ ecccffe1886ca709442672e65d66b409  message2.txt

Or you can simply verify the signature:

$ gpg --verify message.txt.asc
gpg: Signature made Sat 30 Dec 2017 06:06:52 AM UTC using RSA key ID 8085AFFB
gpg: Good signature from "Test Key"

Store only

There is a way to create a message without a signature either, using --store. This option is effectively equivalent to symmetric encryption with a null cipher. It stores the message encoded with an RFC1991 literal data packet. If your goal is simply to create an unencrypted message, this is probably what you want. It does not guarantee either integrity or confidentiality.

Store the message in PGP format, without encryption:

$ md5sum message.txt
ecccffe1886ca709442672e65d66b409  message.txt
$ gpg --armor --store message.txt

And "decrypt" the message:

$ gpg -d message.txt.asc > message2.txt
$ md5sum message2.txt
ecccffe1886ca709442672e65d66b409  message2.txt
  • 1
    Thanks a lot for the explanation! Exactly what I was looking for :) – Lulzsec Jan 1 '18 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.