I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K (string-to-key) function simple S2K, which basically means that the entered passphrase is only hashed once with the specified message digest algorithm. So I created the new key-pair using the command:
gpg --gen-key --s2k-digest-algo MD5 --s2k-mode 0
I was able to verify that the key was created with the right specs by using:
gpg --list-packets secring.pgp
The partial output is:
:secret key packet: version 4, algo 1, created 1397496587, expires 0 skey: [1024 bits] skey: [17 bits] simple S2K, algo: 3, SHA1 protection, hash: 1 protect IV: 06 8a d3 02 e9 df 49 8a encrypted stuff follows
The 'hash: 1' should mean that MD5 is used and simple S2K means hashed once, no salt. You can find this information in the RFC 4880 Section 3.7.
I used the passphrase 'test' which should result in the MD5 hash '098f...b4f6'. The problem is I am not able to find this hash in the secring.gpg file. I used a HexViewer and was able to find the string FE 03 00 01, which means (following the RFC):
FE = initiate the algo specs
03 = symmetric cipher (CAST5)
00 = simple S2K
01 = MD5
Which also confirms that the right spec is used. Something that made me curious is that I found this string twice (for the master and the sub-key, I think). But still there should be somewhere my hashed passphrase.
Am I not understand something? Or am I looking in the wrong place?