Jtdylktuy

I'm in the process of rolling out Kleopatra and wanted to verify the cipher being used. In Kleopatra, under "GnuPG System > S/MIME > use cipher algorithm NAME", the option is set to AES. Is this the cipher used for encryption and is it presumably AES128? How can I verify that?

I've encrypted a file through Kleopatra and sent it to a linux box where I ran the ciphertext through pgpdump. Not sure what I'm looking at. I was expecting to see 'AES' here somewhere.

Old: Public-Key Encrypted Session Key Packet(tag 1)(268 bytes)

    New version(3)

    Key ID - 0xxxxxxxxxxxx95

    Pub alg - RSA Encrypt or Sign(pub 1)

    RSA m^e mod n(2045 bits) - ...

        -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02

Old: Public-Key Encrypted Session Key Packet(tag 1)(268 bytes)

    New version(3)

    Key ID - 0xxxxxxxxxxxx4E

    Pub alg - RSA Encrypt or Sign(pub 1)

    RSA m^e mod n(2046 bits) - ...

        -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02

New: Symmetrically Encrypted and MDC Packet(tag 18)(512 bytes) partial start

    Ver 1

    Encrypted data [sym alg is specified in pub-key encrypted session key]

        (plain text + MDC SHA1(20 bytes))

New:    (54 bytes) partial end

I've tried gnupg --list-packets file.gpg with nothing I see as indicative of the cipher, but that's probably my ignorance showing:

$ gpg --list-packets file.gpg 

:pubkey enc packet: version 3, algo 1, keyid xxxxxxxx95

    data: [2045 bits]

:pubkey enc packet: version 3, algo 1, keyid xxxxxxxx4E

    data: [2046 bits]

:encrypted data packet:

    length: unknown

    mdc_method: 2

gpg: encrypted with 2048-bit RSA key, ID xxxxxx4E, created 2018-11-28

      "xxxxxx <xxxxxx@xxxxx>"

gpg: encrypted with 2048-bit RSA key, ID xxxxxx95, created 2017-07-13

      "xxxxxxxxx <xxxxxx@xxxxx>"

gpg: decryption failed: secret key not available

I've also extracted the first 16 bytes of file.gpg. I read somewhere that the 4th byte should be 09 for AES, but this doesn't seem to be the case either:

$ od -t x1 file.gpg | head -1

0000000 85 01 0c 03 19 c3 9b 0a b3 f1 23 95 01 07 fd 15

In GnuPG, under listed algorithms, such as the following output of gpg --version, you can see the supported block ciphers of your build.

Supported algorithms:

Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA

Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,

        CAMELLIA128, CAMELLIA192, CAMELLIA256

Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224

Compression: Uncompressed, ZIP, ZLIB, BZIP2

Unlike the Camellia family, AES-128 is simply listed as AES. This is likely due to how ubiquitous AES-128 is; it is often referred to as just AES because currently, most applications don't benefit that much security-wise from using AES-192 or AES-256.

^{Moderators: This post should be on Super User, rather than on Cryptography, where it was originally posted. OP is a new user, please let them know that Cryptography Stack Exchange is for discussion of the mathematics of cryptography and development of software rather than the use of software.}