Subject: private key CFB

From: Douglas Maus <[email-masked]>
Date: Mon, 17 Nov 2003 07:54:26 -0500 (EST)

Two beginner questions:

1. In Private Key packets (tag 5, section 5.5.3), what is the bitsize of the CFB mode used in encrypting the secret MPI? For example, AES256 may be performed in CFB 1bit, CFB 8bit and CFB 128bit (1bit, 1octet, and 1block). Is this noted somewhere in the RFC that I'm missing?

2. Could someone please help me confirm a key from salt and passphrase?
keysize of 256 (AES 256 - algorithm 9 in section 9.2)
Iterated and salted mode (3.7.1.3)
SHA1 hash (algorithm 2 in section 9.4)
salt of 0x61f8a7c834124c3a
coded count 96 (count then 65536)
passphrase: 'passphrase'

I get
0x66913d886546e5e352edaddff30255d26a4f0b969603131df274720b68d78f6f

(unfortunately this doesn't work in decrypting my MPI)

Thanks,
Douglas Maus

---

From: Michael Young <[email-masked]>
Date: Mon, 17 Nov 2003 13:03:10 -0500

I made a quick tweak to my implementation (to emit the raw session
key),
so there's some chance I've goofed, but I got:
     1d.43.a2.ec.02.75.db.29.c1.30.d9.a1.24.28.b6.c6.

Sadly, GnuPG (1.2.2)'s --show-session-key doesn't seem to work on
symmetrically encrypted packets, but it might be easy to tweak.

Good luck!

---

From: David Shaw <[email-masked]>
Date: Mon, 17 Nov 2003 14:03:46 -0500

>     1d.43.a2.ec.02.75.db.29.c1.30.d9.a1.24.28.b6.c6.

Isn't that too short for a 256-bit key?

I got BD3511280C74BC56D12E066DF12C5E22E1D9776B068F3A276017D59C39397794

> symmetrically encrypted packets, but it might be easy to tweak.

That's not what show-session-key is for.  It's for, well, showing
session keys ;)

David

---

From: Michael Young <[email-masked]>
Date: Mon, 17 Nov 2003 16:04:08 -0500

> Isn't that too short for a 256-bit key?

Indeed, my post included a 128-bit key computation.  (I also
used MD5, rather than SHA1 as asked.)  Sorry about that.

For a 256-bit key, based on SHA1, I get:
     53.f2.fd.a7.69.7d.0b.a6.c0.ee.18.4f.89.db.1d.f8.
     14.6c.d4.ad.36.1b.8c.4e.63.13.ab.68.75.a7.ad.0b.

I also generated a 64k-sized file and tested with "sha1sum",
getting the same first 20 bytes.

 > That's not what show-session-key is for.  It's for, well, showing

I think you may have misread my comment as wanting to produce the
session key that protects a secret key, based on the original
context.
I did not. I was talking about a "conventionally encrypted" message,
using a Symmetrically Encrypted Data Packet.  If the S2K doesn't
include an (*optional*) encryption of the session key, then the S2K
computation result *is* the session key; I was simply trying to use
that feature to generate an S2K output to check mine.

I think that the intended purpose of GnuPG's session key feature is
equally applicable here.  If you disagree, I'd be happy to discuss it
in a GnuPG forum.  In any case, it's not an OpenPGP issue.

---

From: David Shaw <[email-masked]>
Date: Mon, 17 Nov 2003 17:00:16 -0500

> session key that protects a secret key, based on the original

Given that the original poster was asking about decrypting his secret
key MPIs, I'm uncertain where a discussion of conventionally encrypted
messages came from.  Context is generally important in having a
discussion as it ties together various thoughts about the sunrise,
which was very pretty this morning.  If there is a GnuPG feature you
want, bring it up on one of the GnuPG lists.  I'll confess I'm not too
sure what behavior you are arguing for.

David