0

Is it possible to sort of verify a PGP message?

Alice sends a PGP Encrypted message to Bob.

I know Alice and Bob's public key, and I have their encrypted and plaintext message.

  1. Can I confirm that the PGP Encrypted message is the same as the plaintext message without knowing any of their private key?

  2. Can I confirm that the PGP Encrypted message is from alice or bob with only their public key?

  • Confirmation of sender can only be done if the sender has signed it. Otherwise no, anyone can send a message to a certain public key. – Henno Brandsma Jul 7 at 7:44
1

No to both. Details:

  1. PGP encrypts a random symmetric key with Bob's public key, and then uses that to encrypt the message. Since you don't have that key, you can't check to see if the plaintext and ciphertext correspond under it.
  2. The public key of a message only reveals who can decrypt it. All you learn is that whoever encrypted it knew Bob's public key, which doesn't really narrow it down at all.
  • So I noticed that I can get [Bob's encrypt subkey]'s fingerprint. Can I know that from Bob's public key? – Jane Doe Mar 19 at 3:20
  • @JaneDoe Yes. That's part of his public key. – Joseph Sible Mar 19 at 3:31
  • @JosephSible: to be exact, an encrypted message normally contains (but it can be suppressed) the long keyid of the recipient's (sub)key, which is the low 8 bytes of the 20-byte fingerprint, which is calculated from (but not actually in) a v4 key. Similar security.stackexchange.com/questions/199427/… – dave_thompson_085 Mar 19 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.