Subject: Please Help with OpenPGP's CFB Mode

From: "Daniel Fabian" <[email-masked]>
Date: Mon, 7 Apr 2003 08:28:44 +0200

Hi,

I'm having some troubles implementing OpenPGP's CFB Mode. It seems I got the
resync step wrong. Could someone perhaps be so kind and check this?

I'm trying to decrypt the following message:

This is the line "The MD5 hash algorithm has been found to have " from the
RFC, symmetrically encrypted with the passphrase "test".

This should be the ciphertext

191;83;158;148;73;14;80;225;210;140;157;206;228;11;143;115;163;29;177;169;76
;227;97;199;219;7;196;14;28;22;185;60;108;161;241;182;124;159;14;163;116;32;
194;186;211;137;126;169;182;73;94;122;202;242;160;45;50;134;222;231;62;46;15
8;116;186;144;236;18;90;187;91;12;122

encrypted with the symmetrical key

165;250;150;68;115;173;70;173;212;104;208;113;241;231;223;29;28;118;235;208;
188;166;157;28;51;170;81;64;96;73;144;105

and the AES256 cipher.

Here's what I do:

- I load FR 0;0;0;0;0;0;0;0;0;0;0;0;0;0;0;0 with all 0's
- I encrypt to get FRE:
67;169;145;216;194;226;251;238;246;15;184;187;87;67;190;101;
- This gives me the Plaintext:
252;250;15;76;139;236;171;15;36;131;37;117;179;72;49;22;
- Load C0-C15 into the FR:
191;83;158;148;73;14;80;225;210;140;157;206;228;11;143;115;
- FRE: 146;11;98;243;113;121;142;86;23;188;60;49;76;14;194;225;
- Plaintext: 49;22

So this part should have worked fine, because as stated in the rfc, the
bytes c14 and c15 are the same as c16 and c17. However here comes the
trouble:

- I load the FR with c2 - c17:
158;148;73;14;80;225;210;140;157;206;228;11;143;115;163;29;
- Encrypt it: FRE: 121;156;77;216;12;149;25;199;12;206;220;6;43;173;198;65;
- And get the WRONG plaintext block
200;53;1;59;109;82;194;192;200;192;192;16;146;145;170;224;

This is definitly not the UTF-8 representation of "The MD5 hash alg".
Could someone please tell me what I'm doing wrong?

Thanks in advance,
Daniel

---

From: "Hal Finney" <[email-masked]>
Date: Mon, 7 Apr 2003 10:10:07 -0700

Daniel Fabian writes:
> ...

You have done the decryption properly.  Your plaintext when expressed
in hex form is:

c8 35 01 3b 6d 52 c2 c0 c8 c0 c0 10 92 91 aa e0

You have to interpret this as PGP data per RFC2440.  C8 is the tag byte
for a Compressed Data Packet (see section 5.6).  35 is its length.  01 is
the type of compression, namely ZIP (see section 9.3).  The remaining
data is to be input to the decompression algorithm.  The output of that
will be a PGP Literal Data Packet, and the contents of that packet will
include your text.

Hal Finney