If a file is encrypted and signed in a single pass, you can also decrypt and verify in a single pass. In this case, the OpenPGP message is constructed of OpenPGP packets that provide the encryption layer, and inside the encryption container, the message is signed:
gpg --recipient [email protected] -o file.gpg --sign --encrypt file
But of course, one might first sign a message (for example by running gpg --clearsign file
) and then encrypt the output manually (observe that gpg
is called twize):
gpg --clearsign file | gpg --recipient [email protected] --encrypt -o file.gpg
In this case, the clearsigned file (this wraps both signature and message in a single file, instead of providing a separate signature file) is encrypted in a second run, and all OpenPGP headers are repeated.
You can analyze an OpenPGP message's structure by running gpg --list-packets <filename>
, which provides a very technical description of the OpenPGP messages including all individual OpenPGP packets and headers. Reading RFC 4880, OpenPGP will help at understanding the output.
-vvvvvv
verbosity) for all the decryptions would be very helpful