How does gpg know what cipher algorithm is needed for decryption?

Question

I am using gpg to make encrypt a tar.gz.

• My first try uses --verbose --symmetric and then the decryption is done with --verbose --decrypt. The --verbose shows that encryption was done with CAST5 and then the decryption uses CAST5.
  • I check all the file contents as a sanity check
• My second try uses --verbose --cipher-algo AES256 --symmetric. But I don't change the decrypt command... but somehow it knows to use AES256.
  • I check all the file contents as a sanity check

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5?

p.s. Does gpg embed what cipher algorithm was used, yes/no? wouldn't it be "better" to not tell anyone what encryption type was used?

Answer 1

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5?

The OpenPGP Symmetric-Key Encrypted Session Key Packet (RFC 4880, §5.3) says which algorithm.

wouldn't it be "better" to not tell anyone what encryption type was used?

Not really. This is a basic premise of essentially all serious cryptography for more than a century starting with Auguste Kerckhoffs in the 1880s: a cryptosystem should remain secure as long as the key is secret, even if everything about the method is known to the adversary.

The standard security goal for an unauthenticated cipher is IND-CPA, short for ciphertext indistinguishability under chosen-plaintext attack, meaning essentially that an adversary can't tell the ciphertexts of two distinct messages apart—even if they can choose the two messages, and even after studying the ciphertexts of any other messages of their choice.

Consequently, e.g., an adversary can't learn anything about the content of an email you've exchanged. But they can still look at the email header, which tends to have a lot more information about your conversation (including who you were corresponding with, which can be extremely juicy information!) anyway than which algorithm GnuPG chose to encrypt it with.

If you wanted to conceal whether there is a message at all in some other stream, as in steganography, then you might want to avoid identifying information like this. But that's not the setting that OpenPGP was designed for, and that's much costlier to implement.