[linux-elitists] pgp -m with gpg

David Shaw dshaw@jabberwocky.com
Mon Dec 10 08:51:35 PST 2001


On Mon, Dec 10, 2001 at 04:40:17PM +0000, M. Drew Streib wrote:
> On Sun, Dec 09, 2001 at 11:54:00PM -0800, Marc MERLIN wrote:
> > > Try forcing the issue:
> > > 
> > >   gpg --cipher-algo idea -d < file
> > 
> > Sure enough, this worked.
> > 
> > My bad for assuming it would autodetect it :-)
> > (but good to hear that the next version will)
> 
> I'd actually rather hope that it _couldn't_. A good symmetric algorithm
> should produce a seemingly random stream of bytes, not something that
> should be detectable by simple inspection.
> 
> If gpg is truly encrypting the stream, and not adding any funny headers
> to the output (I'd hope not), then autodetection should be out of the
> picture.

It can't autodetect it.  The "Symmetrically Encrypted Data Packet"
used for symmetric encryption has no headers.  GnuPG just assumes if
you don't tell it what cipher to use, it's IDEA.

Headers don't compromise the security of the message.  When using
public key encryption, all OpenPGP variants include which symmetric
cipher is in use.  As you say, though, headers do reveal that the data
isn't a random block of bits.  There was a program at one point (I
forget what it was called) that attempted to hide the fact that a
given file was a PGP message by playing various games with the headers
and file structure.

David

-- 
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 486 bytes
Desc: not available
Url : http://allium.zgp.org/pipermail/linux-elitists/attachments/20011210/8bcbd32f/attachment.pgp 


More information about the linux-elitists mailing list