I have some questions concerning how GnuPG operates when encrypting and signing messages.

By default:

  • Which cipher and mode-of-operation is used for symmetric encryption?
  • What encryption scheme is used for the encryption of the session key?
  • Which hash function and signature scheme is used in a signed message?

GnuPG implements the OpenPGP standard which contains most of the answers you are looking after. Namely:

  • Symmetric encryption uses CFB mode (with full-block feedback). Supported block ciphers are IDEA, CAST5, 3DES, Blowfish, AES and Twofish. Other algorithms may be supported in the future.
  • The session key is encrypted with the recipient's public key, using whatever algorithm is appropriate for the used key type. OpenPGP supports RSA and ElGamal. There is room for other algorithms but the standard mandates only these two.
  • Signatures use an algorithm which depends on the signer's key type; the standard describes formats for RSA and DSA. There again, there is room for other future algorithms. The hash function used with the signature algorithm can be MD5, RIPEMD-160, SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512.

See section 9 for the lists of supported algorithms.

GnuPG implements most of the above; some of the algorithms may be absent, depending on how it was compiled. Most recent pre-compiled GnuPG packages will lack support for the IDEA block cipher (because it was patented until quite recently), but will include support for the block cipher Camellia in addition to the standard ones (despite the fact that Camellia is patented, but available under a royalty-free license).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.