I'm in the process of rolling out Kleopatra and wanted to verify the cipher being used. In Kleopatra, under "GnuPG System > S/MIME > use cipher algorithm NAME", the option is set to AES. Is this the cipher used for encryption and is it presumably AES128? How can I verify that?
I've encrypted a file through Kleopatra and sent it to a linux box where I ran the ciphertext through
pgpdump. Not sure what I'm looking at. I was expecting to see 'AES' here somewhere.
Old: Public-Key Encrypted Session Key Packet(tag 1)(268 bytes) New version(3) Key ID - 0xxxxxxxxxxxx95 Pub alg - RSA Encrypt or Sign(pub 1) RSA m^e mod n(2045 bits) - ... -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02 Old: Public-Key Encrypted Session Key Packet(tag 1)(268 bytes) New version(3) Key ID - 0xxxxxxxxxxxx4E Pub alg - RSA Encrypt or Sign(pub 1) RSA m^e mod n(2046 bits) - ... -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02 New: Symmetrically Encrypted and MDC Packet(tag 18)(512 bytes) partial start Ver 1 Encrypted data [sym alg is specified in pub-key encrypted session key] (plain text + MDC SHA1(20 bytes)) New: (54 bytes) partial end
gnupg --list-packets file.gpg with nothing I see as indicative of the cipher, but that's probably my ignorance showing:
$ gpg --list-packets file.gpg :pubkey enc packet: version 3, algo 1, keyid xxxxxxxx95 data: [2045 bits] :pubkey enc packet: version 3, algo 1, keyid xxxxxxxx4E data: [2046 bits] :encrypted data packet: length: unknown mdc_method: 2 gpg: encrypted with 2048-bit RSA key, ID xxxxxx4E, created 2018-11-28 "xxxxxx <xxxxxx@xxxxx>" gpg: encrypted with 2048-bit RSA key, ID xxxxxx95, created 2017-07-13 "xxxxxxxxx <xxxxxx@xxxxx>" gpg: decryption failed: secret key not available
I've also extracted the first 16 bytes of file.gpg. I read somewhere that the 4th byte should be
09 for AES, but this doesn't seem to be the case either:
$ od -t x1 file.gpg | head -1 0000000 85 01 0c 03 19 c3 9b 0a b3 f1 23 95 01 07 fd 15