Why is there no '-c' option for decrypt command of GnuPG?

Question

I would like to know if there is any support for specifiying cipher algorithm in the decrypt command. Currently I don't find any such support unlike the encryption command which can be used to specify any non-default cipher algorithm from its supported list of algorithms.

Example of commands used:

---

Encryption:

cat pwd | gpg2 --pinentry-mode loopback --passphrase-fd 0 -o plaintext.enc -r "USER ID" -c --cipher-algo IDEA -e plaintext

Decryption:

cat pwd | gpg2 --pinentry-mode loopback --passphrase-fd 0 -o plaintext.dec -r "USER ID" -d plaintext.enc

---

I am a new user of GnuPG and found this post at your website very helpful for running a basic encryption/decryption at command-line. I am using an Ubuntu 20.04 VM for testing these commands.

Answer 1

I would like to know if there is any support for specifiying cipher algorithm in the decrypt command.

There is not because GnuPG follows the OpenPGP protocol for packet syntax, and the cipher algorithm used is described in the symmetrically encrypted session key packet.

See RFC 4880 section 5.3 for details.

edit

I should clarify that there are two different algorithms under consideration because encryption occurs in two parts:

When you give the command to encrypt a message, GnuPG first generates a random session key, the size of which depends on the default/preferred (or specified with --cipher-algo) symmetric algorithm, and uses this session key and algorithm to encrypt the message.

The encrypted message is placed into a Sym. Encrypted and Integrity Protected Data packet.

GnuPG then prepends the session key with an octet specifying that symmetric algorithm and encrypts it with the recipient's public key (in the case of --encrypt or -e commands, which uses the algorithm specific to that key type), and/or a passphrase (in the case of --symmetric or -c commands, which uses either the symmetric algorithm specified with the --cipher-algo option or the user's preferred symmetric algorithm).

This encrypted session key is then prepended with an octet describing the algorithm used to encrypt it, then placed into a Public-Key Encrypted Session Key packet (in the case of public key encryption) or a Symmetric-Key Encrypted Session Key packet (in the case of passphrase encryption).

This all means that the decryption algorithm is always specified inside the encrypted session key packet; The algorithm used to decrypt the session key is specified in the clear right before the encrypted session key, and the first octet in the decrypted session key specifies the symmetric algorithm used to decrypt the actual message.