3
$\begingroup$

If I run the command 'gpg -a -e < input.txt > output.txt' with completely different inputs (e.g. from /dev/urandom), the first 19 characters are always the same. What is this header? Is it identifying in any way?

For example:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.11 (GNU/Linux)

hQEMA5QidX3vO49mAQf/dZzGGqfxC/7T7sOM+ome1i7Cwd1e2dOiTvRIA2LYZXpi

and

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.11 (GNU/Linux)

hQEMA5QidX3vO49mAQgAkz+xM9ojPvOBUtDRvCecr344PJbmbaMFxJrpJBICnywE
|improve this question
$\endgroup$
  • $\begingroup$ Have you tried reading the specifications? $\endgroup$ – Maarten - reinstate Monica♦ Sep 8 '13 at 19:42
  • 1
    $\begingroup$ Post the characters you are referring to. I presume you don't mean the PEM header but the characters in the base64 encoding? In that case you need to base64 decode and read about the packet format deployed by gpg. $\endgroup$ – Maarten - reinstate Monica♦ Sep 8 '13 at 19:57
  • $\begingroup$ I believe this question has already been answered in Security.SE although I can't find it right now. Anyway, this question is a better fit for that site as it's about specific software and not about crypto per se. I'll flag so a moderator can move it over there, you don't need to do anything (just create an account on Security.SE so you can accept answers if the question gets moved). Cheers $\endgroup$ – rath Sep 8 '13 at 20:21
  • 2
    $\begingroup$ @rath: I think this question is what you're looking for $\endgroup$ – Reid Sep 9 '13 at 6:00
  • 1
    $\begingroup$ @Reid, yes that question answers it. $\endgroup$ – Jeff Sep 9 '13 at 17:43
6
$\begingroup$

The first few bytes are the PGP header. They encode the format information, encryption algorithms and the recipient(s) key id. The recipient must know which key to use and how GPG/PGP has encrypted the session key and payload and how the MAC was generated. Like TLS/SSL the OpenPGP standard has a couple of cipher suites and hash algorithms.

The format is defined in RFC 4880 (http://www.ietf.org/rfc/rfc4880.txt). You can inspect the data with the tool pgpdump

$ gpg -a -e test.txt

$ pgpdump -g test.txt.asc 
Old: Public-Key Encrypted Session Key Packet(tag 1)(524 bytes)
        New version(3)
        Key ID - 0x59C8FAE9A25222C6
        Pub alg - RSA Encrypt or Sign(pub 1)
        RSA m^e mod n(4095 bits) - ...
                -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02
New: Symmetrically Encrypted and MDC Packet(tag 18)(110 bytes)
        Ver 1
        Encrypted data [sym alg is specified in pub-key encrypted session key]
                (plain text + MDC SHA1(20 bytes))
|improve this answer
$\endgroup$
  • $\begingroup$ What means m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02 ? thank you $\endgroup$ – Alexander.It Sep 6 '15 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.