8
$\begingroup$

With the same plain text to be encrypted and the same public key, OpenPGP tends to produce a different ciphertext every time I run the encryption operation. Why is this?

$\endgroup$
9
$\begingroup$

OpenPGP is a hybrid cryptosystem. The actual message is encrypted applying a symmetric cipher like AES with a random session key. This session key again is encrypted using a public/private key cryptography algorithm like RSA. This is mostly because symmetric encryption is much faster than public/private key cryptography, especially for large messages. As the session key is generated randomly, the cryptotext is different each time you encrypt something.

Another reason is that OpenPGP includes timestamps in different packets.

$\endgroup$
  • $\begingroup$ See also en.wikipedia.org/wiki/Pretty_Good_Privacy for that session key. $\endgroup$ – ott-- May 30 '16 at 17:45
  • 3
    $\begingroup$ Maybe it is a good idea to point out the idea that PGP should create semantically secure ciphertext (one of the reasons why the session key is created, apart from different recipients of course). $\endgroup$ – Maarten Bodewes May 31 '16 at 14:28
  • $\begingroup$ Agreed with @MaartenBodewes. While this explains how, why it's crucial is just as important. $\endgroup$ – Stephen Touset Feb 13 '17 at 9:52
6
$\begingroup$

It is desirable that an encryption scheme produce different ciphertexts from the same plaintext; if that's not the case, it its trivial to check if two plaintexts are identical, which is a potentially damaging information leak.

Different ciphertexts from the same plaintext is especially necessary for public-key encryption. Otherwise, it is possible to verify a guess of the plaintext, which is an issue in even more circumstances; e.g. when plaintext is known to be the name of a person in a known list, it is possible to determine which person (by encrypting each name in the list and checking which result matches the ciphertext).

In the case of OpenPGP asymmetric encryption, the difference (from one ciphertext to the other for same plaintext) comes in part from drawing a different random symmetric key at each encryption (which is then enciphered using the recipient's public key).

$\endgroup$
0
$\begingroup$

OK for different random keys for the AES leading to different ciphertexts for the same plain text but we should also have different and random IVs, even with the same key when using the CBC mode and others.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.