With the same plain text to be encrypted and the same public key, OpenPGP tends to produce a different ciphertext every time I run the encryption operation. Why is this?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ Possible duplicate of Why is "semantically secure" important for cryptosystems? $\endgroup$– otusCommented May 30, 2016 at 18:12
-
$\begingroup$ @otus I half agree with you here. Yes, semantically secure is important, but that doesn't directly explain why/how PGP produces different ciphertext. $\endgroup$– Maarten Bodewes ♦Commented May 31, 2016 at 14:26
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
3
OpenPGP is a hybrid cryptosystem. The actual message is encrypted applying a symmetric cipher like AES with a random session key. This session key again is encrypted using a public/private key cryptography algorithm like RSA. This is mostly because symmetric encryption is much faster than public/private key cryptography, especially for large messages. As the session key is generated randomly, the cryptotext is different each time you encrypt something.
Another reason is that OpenPGP includes timestamps in different packets.
-
$\begingroup$ See also en.wikipedia.org/wiki/Pretty_Good_Privacy for that session key. $\endgroup$– ott--Commented May 30, 2016 at 17:45
-
3$\begingroup$ Maybe it is a good idea to point out the idea that PGP should create semantically secure ciphertext (one of the reasons why the session key is created, apart from different recipients of course). $\endgroup$– Maarten Bodewes ♦Commented May 31, 2016 at 14:28
-
$\begingroup$ Agreed with @MaartenBodewes. While this explains how, why it's crucial is just as important. $\endgroup$ Commented Feb 13, 2017 at 9:52
$\begingroup$
$\endgroup$
It is desirable that an encryption scheme produce different ciphertexts from the same plaintext; if that's not the case, it its trivial to check if two plaintexts are identical, which is a potentially damaging information leak.
Different ciphertexts from the same plaintext is especially necessary for public-key encryption. Otherwise, it is possible to verify a guess of the plaintext, which is an issue in even more circumstances; e.g. when plaintext is known to be the name of a person in a known list, it is possible to determine which person (by encrypting each name in the list and checking which result matches the ciphertext).
In the case of OpenPGP asymmetric encryption, the difference (from one ciphertext to the other for same plaintext) comes in part from drawing a different random symmetric key at each encryption (which is then enciphered using the recipient's public key).
$\begingroup$
$\endgroup$
OK for different random keys for the AES leading to different ciphertexts for the same plain text but we should also have different and random IVs, even with the same key when using the CBC mode and others.
