4

Say I have a file encrypted with GnuPG, in isolation (i.e., I don’t have the relevant keys). Can one then establish the recipients of the encryption? That is:

  • Name/E-Mail/Comment
  • Key ID

Or is this information only discernible if you have the appropriate keys?

Likewise, same question for a GnuPG signed file? (i.e., Can you at least establish the signer, without authenticating their signature, without having the key in your keyring?)

2

1 Answer 1

3

Can one then establish the recipients of the encryption?

Ordinarily, yes. The recipient's Key ID is included in the metadata.

This can be disabled if you use --throw-keyids option.

Likewise, same question for a GnuPG signed file? (i.e., Can you at least establish the signer, without authenticating their signature, without having the key in your keyring?)

Yes, and as far as I know there is no way to disable the inclusion of the signer's key ID in the signature data (it wouldn't make much sense to do so). If this information needs to be hidden, you should sign, then encrypt the signed file with the throw-keyids option.

14
  • 1
    Maybe it's worth noting that --throw-keyids has a slight inconvenience on the client side: all keys must be tried until the correct one if found. That may entail typing a passphrase multiple times. The pgpdump tool can be used for analyzing GPG packets.
    – Kate
    May 15, 2021 at 21:58
  • Thanks :) So if I want to guarantee anonymity in, say, a Git repo of encrypted files, I need to be very careful? (Along with, tangentially, making sure the commit history also doesn’t leak information.) Possibly so careful that it’s not worth the effort! May 15, 2021 at 22:08
  • 1
    @Xophmeister You could always create a new signing key just for the git repo. And anyway knowing the key ID doesn't break anonymity unless the public key is both available to adversaries and they also know your identity is connected to that key. May 16, 2021 at 1:07
  • @fuzzydrawings It's very important to realize that disabling the key ID only provides casual anonymity at best. Due to the German tank problem, it's often possible to discover what the actual key ID is. See also In OpenPGP, when encrypting with public key — is it possible to not include the RSA key id?
    – forest
    May 16, 2021 at 2:18
  • @forest I can't find information on how the German Tank Problem applies to identifying hidden recipient key IDs for Public-Key Encrypted Session Key packets under the OpenPGP protocol. But certainly when the same session key is encrypted to multiple hidden recipients, one of whom is an adversary, the adversary then knows the session key (because he can decrypt it) and from that it is trivial to show any other PKESK packet for this same session key was encrypted with a given public key. May 16, 2021 at 5:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .