What is the difference between a key algorithm and the encryption algorithm?

Question

I just starting to learn about PGP encryption. One thing that confuses me is the difference between a key algorithm, and an encryption algorithm.

For example, lets say I have a trading partner (EDI Trading Partner) who has a 1024 bit RSA public key. Is this key itself encrypted? Is that why it is called an RSA key?

Now, if I use that key to encrypt a message, can any algorithm be used?

The reason I am asking is that I am having trouble getting messages correctly decrypted by the trading partner that I encrypt using his key. So I am trying to better understand what is happening in the encryption process.

Answer 1

Your trading partner has both a public key and private key. Under normal circumstances, the public key is used by you to encrypt files that your trading partner decrypts with their private key. A public key is made widely available so that anyone can send encrypted content to that person.

The keys are an asymmetrical pair in that you can not decrypt the message with the key you used to encrypt it. Otherwise everyone with the public key could decrypt message.

If your trading partner has sent you an encrypted message and they have said they have used "RSA" or "PGP" then they have used what they consider to be your public key to encrypt the message and expect you to use your private key to decrypt it. If you don't have a key pair, then you need to tell them they may not have encrypted it with any key you currently have a copy of.

RSA is the initials of the people who (publicly) discovered the mathematical qualities of large prime numbers that allows for a key that encrypts a message to be different from the key that can decrypts the message. The computer algorithm to create these keys and their format is commonly called RSA.

PGP is a software encryption suite initially created in the 1990s that can perform both asymmetric encryption (such as using RSA key pairs) and symmetric encryption (which is faster or "stronger" but less convenient). In practice, PGP or similar software will attempt to hide away the complexity of the underlying process - which is pretty complex.

Whilst RSA private keys are often encrypted with a password in case someone steals the computer they are on, RSA public keys are not encrypted otherwise no one could use them. The key that encrypted your message would not itself have been encrypted; although your software may have asked for a password if it stored public and private keys in the same place. However it could have also asked for a password if you were actually using symmetric encryption which does not necessarily use or need asymmetric RSA keys.

When PGP or similar tools allow you to encrypt a file for someone, they will ask for a public key and symmetric algorithm (AES, Blowfish, TEA, etc) as asymmetric is very slow and unsuited for large messages - so PGP creates a random symmetric key, encrypts the message with that and then encrypts the symmetric key with the asymmetric public key.

So you will need to check that you are using the correct private key to decrypt the file. Depending on the software tool, it may not tell you if you entered password protecting the private key correctly.

Answer 2

OpenPGP uses a hybrid encryption approach. Public-key encryption (commonly, RSA is used, but there are also other algorithms) has the advantage of a different public and private key set, but is getting really slow over time.

The public key is the one used for encrypting to the recipient, who can decrypt using his private key. This public key is usually referred to as the "OpenPGP key" of a person, most of the time specified as "public OpenPGP key". This is what you call a "key algorithm".

Assymetric encryption algorithms like RSA have one disadvantage. This is why OpenPGP additionally uses symmetric encryption algorithms like AES (and others): these are very fast for encrypting large sets of data, but both sides must agree on a key. To do so, whenever you're encrypting something to an OpenPGP user, a new random, symmetric key is created, and encrypted using the recipient's public key (so he can read it). This might be called "encryption algorithm", but is no common wording. In the end, both the asymmetric and symmetric algorithms are cryptographic algorithms.

---

Choosing from the possible algorithms depends on which are supported by the OpenPGP implementations used. Usually, you don't have to do anything, and your OpenPGP implementation (eg. GnuPG or PGP) will choose the appropriate settings for you, given the public key of the recipient is available. If one of you is using very old implementations you might to modify these settings; but it would be more recommended to switch to a more recent one.

Answer 3

Think of a padlock, and the keys that open it. You don't need a key to close a padlock, just to open it. Your PGP Public Key is similar to the padlock. You give out padlocks (without keys) to other people, and they use it to lock something inside a small box. (And we know that padlocks are not that safe, are easy to break, but let's assume they are very safe.)

Once the padlock is locked by the sender, nobody else than you can open it anymore, even the sender himself! (If the sender wants to know what he has sent to you, he needs to keep a local copy that is either not encrypted or encrypted with his own key.) You are the only one who can unlock the padlock, having the key to open it. That is the PGP Private Key.

So someone sends you an email which is encrypted with your public key, and only you can open it with your private key.

Credits: Why King George III Can Encrypt