GPG Encryption: Am I using the right keys?

Question

I have a process to encrypt a bank file using OpenPGP (via BouncyCastle) and SFTP the file to the bank for financial processing.

They sent me a public key file, which I examined the key using the following command (results follow):

C:\Program Files (x86)\GNU\GnuPG>gpg2 --dry-run -vvvv --import \test\thekey.txt

gpg: using character set `CP437'
gpg: armor: BEGIN PGP PUBLIC KEY BLOCK
gpg: armor header: Version: GnuPG v1.2.6 (GNU/Linux)
:public key packet:
        version 4, algo 17, created 1232463981, expires 0
        pkey[0]: [1024 bits]
        pkey[1]: [160 bits]
        pkey[2]: [1024 bits]
        pkey[3]: [1021 bits]
        keyid: C0B18494F5B25CB6
:user ID packet: "FTP Upload Key 3 <XXXX.XXXX@XXXXXXX.com>"
:signature packet: algo 17, keyid C0B18494F5B25CB6
        version 4, created 1232463981, md5len 0, sigclass 0x13
        digest algo 2, begin of digest 23 e8
        hashed subpkt 2 len 4 (sig created 2009-01-20)
        hashed subpkt 27 len 1 (key flags: 03)
        hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)
        hashed subpkt 21 len 2 (pref-hash-algos: 2 3)
        hashed subpkt 22 len 2 (pref-zip-algos: 2 1)
        hashed subpkt 30 len 1 (features: 01)
        hashed subpkt 23 len 1 (key server preferences: 80)
        subpkt 16 len 8 (issuer key ID C0B18494F5B25CB6)
        data: [159 bits]
        data: [156 bits]
:public sub key packet:
        version 4, algo 16, created 1232463981, expires 0
        pkey[0]: [1024 bits]
        pkey[1]: [4 bits]
        pkey[2]: [1024 bits]
        keyid: 358DC68F4A83D261
:signature packet: algo 17, keyid C0B18494F5B25CB6
        version 4, created 1232463981, md5len 0, sigclass 0x18
        digest algo 2, begin of digest 28 08
        hashed subpkt 2 len 4 (sig created 2009-01-20)
        hashed subpkt 27 len 1 (key flags: 0C)
        subpkt 16 len 8 (issuer key ID C0B18494F5B25CB6)
        data: [158 bits]
        data: [160 bits]

gpg: pub  1024D/F5B25CB6 2009-01-20  FTP Upload Key 3 <XXXX.XXXX@XXXXXXX.com>
gpg: writing to `C:/Users/jholovacs/AppData/Roaming/gnupg/pubring.gpg'
gpg: using PGP trust model
gpg: key 9166F91E: accepted as trusted key
gpg: key DBA95ED9: accepted as trusted key
gpg: key DF548FCC: accepted as trusted key
gpg: key F5B25CB6: public key "[User ID not found]" imported
gpg: Total number processed: 1
gpg:               imported: 1

I took a sample text file, and encrypted it using their public key, and I examined the resultant file with this command (results follow):

C:\Program Files (x86)\GNU\GnuPG>gpg2 --list-packets <\test\bankfile.pgp
:compressed packet: algo=1
:pubkey enc packet: version 3, algo 16, keyid 358DC68F4A83D261
        data: [1019 bits]
        data: [1024 bits]
:encrypted data packet:
        length: 620
gpg: encrypted with ELG key, ID 4A83D261
gpg: decryption failed: No secret key

Here's the thing: when I upload the file to our bank, they say the file doesn't match their private key. I see the 358DC68F4A83D261 key id matches their public key, so I'm scratching my head... but I also see the ElGamal key with an ID of 4A83D261 which does not seem to be reflected in their public key file.

I am using a custom encryption solution based off of the BouncyCastle library, so it's possible there is an error in the encryption (I can't duplicate the error using my own version of Pgp4Win, however). It's also possible that there is a problem on their side. My problem is, I'm not sure how to read this feedback to determine where the problem is. Some advice would be appreciated.

Looks good to me, and is definitely encrypted for their public key. I'd say the problem is on their end. Can you ask them for more details as to what error they're getting, what key they *think* your file is for (as you've demonstrated, you can always tell what key the file has been encrypted for). And a jab at security: you really should be using at least 2048-bit keys these days, though I suspect your bank doesn't care. — Chris S, Dec 19 '13 at 18:26
@ChrisS after a phone call with them, I'm beginning to think it's a version problem. They are running a very old version of GnuPG, and I am running the latest BouncyCastle libraries... I expect that is the problem. — Jeremy Holovacs, Dec 19 '13 at 19:54

score 1 · Accepted Answer · answered Dec 23 '13 at 21:24

All right, it was the right key, and it appeared to be a version compatibility issue. Their version of OpenPGP could not support the BouncyCastle's version of data compression. I ended up disabling the compression and their software could decrypt the file.

GPG Encryption: Am I using the right keys?

1 Answers1