Following from, What information is leaked from an OpenPGP encrypted file?, which was very helpful, I'd like to ask a similar question regarding symmetric encryption. For example, in a file encrypted with

gpg -c --cipher-algo AES256 --armor -o file.asc file.txt

Is the passphrase hash (with salt and iterations as specified by --s2k-count) stored in the file.asc? How does gpg know a passphrase is correct?

  • 1
    In short, GPG uses authenticated encryption. When trying to decrypt a blob with the wrong key, this causes a failure rather than decrypting the ciphertext to garbage, as would happen with a simple stream cipher like AES in CTR mode. Mar 25, 2014 at 18:15
  • Thanks for the info Stephen. Where did you find that GPG uses AEAD? I.e. where can I find more info regarding this. I can see in RFC4880 that it does not, and the only places where AEAD is documented on GnuPG website is in the gcrypto library. Mar 25, 2014 at 19:05

1 Answer 1


The answer is given in RFC4880, http://www.ietf.org/rfc/rfc4880.txt in section "5.7. Symmetrically Encrypted Data Packet (Tag 9)" In short, the key generated from the passphrase is used to encrypt a block of random data, and two last octets of the data are repeated. This encrypted data is included in every symmetrically encrypted message, in the packet. GPG first decrypts this block with a given key derived from the passphrase (see string-to-key in the RFC), and checks that the last two octets are repeats of the previous two octets. If not, the passphrase is definitely not correct. If yes, the passphrase MAY be correct. Then the decryption of data occurs.

Hence, no hash is stored in the data packet.

  • I'm not accepting this answer yet in case someone more skilled wants to give a more clear explanation Mar 26, 2014 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .