I know that PGP provides an hybrid scheme of encryption which can ensure both the encryption of a message and the authentication, but how it stores the secondary data, such as the object, the sender, the receiver, time, etc. on the server? Are they encrypted or stored in plaintext?


closed as off-topic by fgrieu, e-sushi Dec 13 '16 at 10:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm or protocol works, you should look into asking on Stack Overflow instead." – fgrieu, e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ This is off-topic, thus I will only comment. Classic PGP/GPG enciphers/signs only the data bytes in the file, not in alternate data streams, resource fork or similar. File name/extension can moreless be kept as the default destination file name, but that's not enciphered of signed, and easily modified. Anything else is ignored, including dates, owner, group, access permissions, sparsity, version history... $\endgroup$ – fgrieu Dec 12 '16 at 17:20
  • $\begingroup$ I'm sorry, what do you mean by "anything else is ignored"? Is it stored in plaintext? $\endgroup$ – M-elman Dec 12 '16 at 19:41
  • $\begingroup$ I mean anything else has no effect on the ciphertext or signature; and is thus lost on decryption, or/and not integrity-protected by signature. $\endgroup$ – fgrieu Dec 12 '16 at 21:26

The secondary data or metadata are stored in plaintext.

Should you receive an encrypted mail by pgp, you will notice that you have 2 files attached: noname.pgp and encrypted.asc. Thus the content of the message is hidden but not the metadata.

Why don't we also encrypt the metadata? Well how would we know who to give the mail to then? If you give your mailman a letter and don't tell him who the receiver is, how do you expect him to give it to the right person?

By the same principle, your receiver should be able to at least know what the message is about. Should you not want anyone to know, you could also leave the field blank.

Hence no, only the content is encrypted the meta data are still in clear text.

  • $\begingroup$ Are you saying there is some "secondary data or metadata" in noname.pgp ? If yes, link to what defines the content of that, please! And is not that highly specific to some PGP/GPG version or integration environment, and thus terminally off-topic? $\endgroup$ – fgrieu Dec 12 '16 at 17:30
  • $\begingroup$ tools.ietf.org/html/rfc4880#section-4 tools.ietf.org/html/rfc4880#section-11.3 If I'm not mistaken, no meta data. $\endgroup$ – Biv Dec 12 '16 at 18:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.