Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I understand that gpg 1.4.9 computes a MDC code by default. According to my research this corresponds to to Sym. Encrypted and Integrity Protected Data Packet (tag 18) in the PGP spec. If the file is signed doesn't this also provide modification protection (in addition to providing proof of sender's identity)?

I think this might be the case because I wrote code using the BouncyCastle API and and noticed that when one verified a signed file, a signature is computed from the encrypted data stream and compared against the one recorded in the file.

I'm trying to understand whether there is some redundancy here or if these two mechanisms serve different purposes.

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Yes, all versions of GPG signatures provide modification protection. When you sign a document, it creates a hash of the document (which algorithm it uses depends on the preferences you have set). The hash is then encoded using your private key. Anybody can use your public key to decode the hash, assuring them that you are the one who sent the message. In addition, they know that the message has not been altered in the time after you signed it.

In addition, when encrypting a document, whether you sign it or not, an MDC hash is created. This is to provide modification protection in case the document is not signed. The RFC 4880 gives an explanation of why this may be useful:

The obvious way to protect or authenticate an encrypted block is to digitally sign it. However, many people do not wish to habitually sign data, for a large number of reasons beyond the scope of this document. Suffice it to say that many people consider properties such as deniability to be as valuable as integrity.

It seems that if you both encrypt and sign a message, then you have redundancy, although the signature gives you more information, assuring you about the identity of the sender in addition to the integrity of the message.

share|improve this answer
    
Thanks - this helps. What I am also trying to figure out is the purpose of the MDC which seems to be computed even if the file is not signed. –  Shane Mcpherson Jan 16 '12 at 10:42
    
Edited, now that I understand better what you want to know. –  Nathan Grigg Jan 16 '12 at 15:25
    
Thanks, exactly what I was looking for. Sorry it took so long for me to get around to accepting your answer, this question slipped my mind for a while. –  Shane Mcpherson Feb 18 '12 at 4:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.