I would like to be able to check which (inner) symmetric algorithm was used to encrypt a file with GPG using a public key.

Somewhere I've read this can be done with --list-packets, so I tried

$ gpg --list-packets encrypted_file.asc 
gpg: encrypted with 256-Bit ECDH key, ID 0865135E90D1AF38, created 2020-03-20
      "First Last <[email protected]>"
# off=0 ctb=84 tag=1 hlen=2 plen=94
:pubkey enc packet: version 3, algo 18, keyid 0865135E90D1AF38
    data: [263 bits]
    data: [392 bits]
# off=96 ctb=d2 tag=18 hlen=3 plen=1965 new-ctb
:encrypted data packet:
    length: 1965
    mdc_method: 2
# off=118 ctb=a3 tag=8 hlen=1 plen=0 indeterminate
:compressed packet: algo=1
# off=120 ctb=cb tag=11 hlen=2 plen=0 partial new-ctb
:literal data packet:
    mode b (62), created 0, name="_CONSOLE",
    raw data: unknown length

I thought the symmetric encryption algorithm was encoded in mdc_method, but whatever algorithm I use to encrypt, it always displays 2 there. So this doesn't seem to be the correct approach.

How can I find out the symmetric algorithm?

1 Answer 1


The trick is to add option -vv --show-session-key to the command:

$ gpg -vv --show-session-key --list-packets encrypted_file.asc 

This adds a line like the following to the output:

gpg: AES192 encrypted data
gpg: session key: '8:32050C047C47C519E76901EFC47FDFED0CD87CDB85809AFE'

The number before the colon (8 here) is the symmetric algorithm used to encrypt the file contents according to this list (taken from GnuPG sources):

typedef enum
 CIPHER_ALGO_BLOWFISH = 4, /* 128 bit */
 /* 5 & 6 are reserved */
 CIPHER_ALGO_TWOFISH = 10, /* 256 bit */

So in this case, the file was encoded using AES-192.

Note that AES means AES-128.

  • What does it mean when the number before the colon (:) is 9.2, instead of 9? Does it mean it's using some variant of AES256? Sep 30, 2022 at 22:16
  • @CuriousLearner That's weird, I haven't seen that yet. Maybe it means AES256-GCM as opposed to AES256-CBC? What does the line above say? Would be worth a new question!
    – not2savvy
    Oct 1, 2022 at 15:52
  • The line immediately above that says "gpg: AES256.OCB encrypted data". I thought of posting a question, but didn't wanna post the full screenshot as one of those lines contains a session key, and I'm not sure if that information is confidential. I think it may be SHA256 of my passphrase, but I'm not too sure. Correct me if I'm wrong. Oct 1, 2022 at 18:17
  • 1
    I just did some Googling, and it turns out OCB is patented authentication mode, though it is licensed to be used in any purpose other than military. Wow, I didn't know of that. I just used open source Kleopatra (downloaded from www.gnupg4win.org) and configured it to use AES256. I have no idea why Kleopatra would use patented stuff, when non-patented alternatives are easily available. Oct 1, 2022 at 18:30
  • @CuriousLearner That’s really interesting. Wikipedia says that OCB is free to be used in open source software, and that the patents were even abandoned in 2021, so this may be why.
    – not2savvy
    Oct 1, 2022 at 23:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .