When using Pretty Good Privacy (PGP) to digitally sign a message, the signature is created in a two- step process. First, the message to be signed is…

The creation of a Pretty Good Privacy (PGP) digital signature involves two main steps. First, a cryptographic hash function is used to create a fixed-size message digest from the original message. Second, this digest is encrypted using the sender's private key. The OpenPGP standard, defined in RFC 4880, specifies several hash algorithms for this purpose, including the Secure Hash Algorithm 1 (SHA-1). While newer, more secure algorithms like SHA-256 are now recommended, SHA-1 was a standard and widely implemented hash function within PGP for generating the message digest required for a digital signature.

A. Blowfish: Blowfish is a symmetric-key block cipher used for encrypting message content for confidentiality, not for creating a message digest for a signature.

B. DES: DES is a symmetric-key block cipher. While its successor, Triple DES (3DES), is supported by PGP for encryption, it is not a hash algorithm.

D. Cast: CAST-128 (also known as CAST5) is a symmetric-key block cipher that was the default encryption algorithm in many versions of PGP, but it is used for confidentiality, not hashing.

---

1. Callas

J.

Donnerhacke

L.

Finney

H.

Shaw

D.

& Thayer

R. (2007). OpenPGP Message Format. RFC 4880

The Internet Society.

Section 9.4

"Hash Algorithms": This section explicitly lists the hash algorithms used in OpenPGP. SHA-1 is assigned the ID number 2

confirming its use. The document states

"OpenPGP implementations MUST implement SHA-1."

Section 9.2

"Symmetric-Key Algorithms": This section lists Blowfish

DES (as TripleDES)

and CAST5 as symmetric ciphers for data encryption

distinguishing them from hash algorithms.

2. Rivest

R. (2017). 6.857 Computer and Network Security

Lecture 11: PGP and PEM. MIT OpenCourseWare.

Slide 10

"PGP Digital Signature": The lecture slide presents a diagram of the PGP digital signature process. It explicitly shows the message being processed by a "Hash Function (SHA-1)" to produce a hash code

which is then encrypted with the sender's private key.

3. Boneh

D. (2023). CS255: Introduction to Cryptography

Lecture 14: E-mail Security and Pretty Good Privacy (PGP). Stanford University.

Slide 22

"OpenPGP Signatures": The lecture notes describe the signature process as signing the hash of the message

Sign(kpriv

h(m)). The notes further clarify that OpenPGP supports various hash functions

including SHA-1 and the SHA-2 family.