0

Is it possible to sort of verify a PGP message?

Alice sends a PGP Encrypted message to Bob.

I know Alice and Bob's public key, and I have their encrypted and plaintext message.

  1. Can I confirm that the PGP Encrypted message is the same as the plaintext message without knowing any of their private key?

  2. Can I confirm that the PGP Encrypted message is from alice or bob with only their public key?

1
  • Confirmation of sender can only be done if the sender has signed it. Otherwise no, anyone can send a message to a certain public key. Jul 7, 2019 at 7:44

1 Answer 1

1

No to both. Details:

  1. PGP encrypts a random symmetric key with Bob's public key, and then uses that to encrypt the message. Since you don't have that key, you can't check to see if the plaintext and ciphertext correspond under it.
  2. The public key of a message only reveals who can decrypt it. All you learn is that whoever encrypted it knew Bob's public key, which doesn't really narrow it down at all.
3
  • So I noticed that I can get [Bob's encrypt subkey]'s fingerprint. Can I know that from Bob's public key?
    – Jane Doe
    Mar 19, 2019 at 3:20
  • @JaneDoe Yes. That's part of his public key. Mar 19, 2019 at 3:31
  • @JosephSible: to be exact, an encrypted message normally contains (but it can be suppressed) the long keyid of the recipient's (sub)key, which is the low 8 bytes of the 20-byte fingerprint, which is calculated from (but not actually in) a v4 key. Similar security.stackexchange.com/questions/199427/… Mar 19, 2019 at 6:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .