3

Say I have a file encrypted with GnuPG, in isolation (i.e., I don’t have the relevant keys). Can one then establish the recipients of the encryption? That is:

  • Name/E-Mail/Comment
  • Key ID

Or is this information only discernible if you have the appropriate keys?

Likewise, same question for a GnuPG signed file? (i.e., Can you at least establish the signer, without authenticating their signature, without having the key in your keyring?)

2
3

Can one then establish the recipients of the encryption?

Ordinarily, yes. The recipient's Key ID is included in the metadata.

This can be disabled if you use --throw-keyids option.

Likewise, same question for a GnuPG signed file? (i.e., Can you at least establish the signer, without authenticating their signature, without having the key in your keyring?)

Yes, and as far as I know there is no way to disable the inclusion of the signer's key ID in the signature data (it wouldn't make much sense to do so). If this information needs to be hidden, you should sign, then encrypt the signed file with the throw-keyids option.

14
  • 1
    Maybe it's worth noting that --throw-keyids has a slight inconvenience on the client side: all keys must be tried until the correct one if found. That may entail typing a passphrase multiple times. The pgpdump tool can be used for analyzing GPG packets. – Anonymous May 15 at 21:58
  • Thanks :) So if I want to guarantee anonymity in, say, a Git repo of encrypted files, I need to be very careful? (Along with, tangentially, making sure the commit history also doesn’t leak information.) Possibly so careful that it’s not worth the effort! – Xophmeister May 15 at 22:08
  • 1
    @Xophmeister You could always create a new signing key just for the git repo. And anyway knowing the key ID doesn't break anonymity unless the public key is both available to adversaries and they also know your identity is connected to that key. – fuzzy drawings May 16 at 1:07
  • @fuzzydrawings It's very important to realize that disabling the key ID only provides casual anonymity at best. Due to the German tank problem, it's often possible to discover what the actual key ID is. See also In OpenPGP, when encrypting with public key — is it possible to not include the RSA key id? – forest May 16 at 2:18
  • @forest I can't find information on how the German Tank Problem applies to identifying hidden recipient key IDs for Public-Key Encrypted Session Key packets under the OpenPGP protocol. But certainly when the same session key is encrypted to multiple hidden recipients, one of whom is an adversary, the adversary then knows the session key (because he can decrypt it) and from that it is trivial to show any other PKESK packet for this same session key was encrypted with a given public key. – fuzzy drawings May 16 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.