1

Following from, What information is leaked from an OpenPGP encrypted file?, which was very helpful, I'd like to ask a similar question regarding symmetric encryption. For example, in a file encrypted with 

gpg -c --cipher-algo AES256 --armor -o file.asc file.txt

Is the passphrase hash (with salt and iterations as specified by --s2k-count) stored in the file.asc? How does gpg know a passphrase is correct?

|improve this question
  • 1
    In short, GPG uses authenticated encryption. When trying to decrypt a blob with the wrong key, this causes a failure rather than decrypting the ciphertext to garbage, as would happen with a simple stream cipher like AES in CTR mode. – Stephen Touset Mar 25 '14 at 18:15
  • Thanks for the info Stephen. Where did you find that GPG uses AEAD? I.e. where can I find more info regarding this. I can see in RFC4880 that it does not, and the only places where AEAD is documented on GnuPG website is in the gcrypto library. – Fermion Portal Mar 25 '14 at 19:05
3

The answer is given in RFC4880, http://www.ietf.org/rfc/rfc4880.txt in section "5.7. Symmetrically Encrypted Data Packet (Tag 9)" In short, the key generated from the passphrase is used to encrypt a block of random data, and two last octets of the data are repeated. This encrypted data is included in every symmetrically encrypted message, in the packet. GPG first decrypts this block with a given key derived from the passphrase (see string-to-key in the RFC), and checks that the last two octets are repeats of the previous two octets. If not, the passphrase is definitely not correct. If yes, the passphrase MAY be correct. Then the decryption of data occurs.

Hence, no hash is stored in the data packet.

|improve this answer
  • I'm not accepting this answer yet in case someone more skilled wants to give a more clear explanation – Fermion Portal Mar 26 '14 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.