# How does gpg know what cipher algorithm is needed for decryption?

I am using gpg to make encrypt a tar.gz.

• My first try uses --verbose --symmetric and then the decryption is done with --verbose --decrypt. The --verbose shows that encryption was done with CAST5 and then the decryption uses CAST5.
• I check all the file contents as a sanity check
• My second try uses --verbose --cipher-algo AES256 --symmetric. But I don't change the decrypt command... but somehow it knows to use AES256.
• I check all the file contents as a sanity check

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5?

p.s. Does gpg embed what cipher algorithm was used, yes/no? wouldn't it be "better" to not tell anyone what encryption type was used?

• Not telling the encryption method is not better - that would be security-through-obscurity. That doesn't improve security at all. – tylo Sep 22 at 19:16
• @tylo thank you for referencing the "security-through-obscurity" i was going to ask ""is NOT announcing" or "trying to hide your encryption method" just "security through obscurity"?". i guess i'll have to read about it now. – Trevor Boyd Smith Sep 22 at 23:37

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5?

The OpenPGP Symmetric-Key Encrypted Session Key Packet (RFC 4880, §5.3) says which algorithm.

wouldn't it be "better" to not tell anyone what encryption type was used?

Not really. This is a basic premise of essentially all serious cryptography for more than a century starting with Auguste Kerckhoffs in the 1880s: a cryptosystem should remain secure as long as the key is secret, even if everything about the method is known to the adversary.

The standard security goal for an unauthenticated cipher is IND-CPA, short for ciphertext indistinguishability under chosen-plaintext attack, meaning essentially that an adversary can't tell the ciphertexts of two distinct messages apart—even if they can choose the two messages, and even after studying the ciphertexts of any other messages of their choice.

Consequently, e.g., an adversary can't learn anything about the content of an email you've exchanged. But they can still look at the email header, which tends to have a lot more information about your conversation (including who you were corresponding with, which can be extremely juicy information!) anyway than which algorithm GnuPG chose to encrypt it with.

If you wanted to conceal whether there is a message at all in some other stream, as in steganography, then you might want to avoid identifying information like this. But that's not the setting that OpenPGP was designed for, and that's much costlier to implement.

• i went to the wikipedia page about security through obscurity. i guess what you are saying is "yes pgp file format tells you what encryption algorithm is used and hiding that information is not better because that would be security through obscurity... 'the security of a system should depend on its key, not on its design remaining obscure'" is this a good paraphrase/restatement? – Trevor Boyd Smith Sep 22 at 23:51
• @TrevorBoydSmith Sure—concealing the choice of cipher doesn't keep the content of the message any more confidential (see also Kerckhoffs' principle); it only serves purposes like steganography, concealing whether there is a message at all, that OpenPGP does not aim to serve anyway. – Squeamish Ossifrage Sep 23 at 18:37
• re Kerckhoff's principle: i think the intro covers exactly what i was wondering about "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.". – Trevor Boyd Smith Sep 24 at 19:17