The blast struck at one of Egypt's most popular and crowded tourist attractions
Security services in Cairo believe a small Islamist cell carried out Sunday's deadly bombing, according to reports in the pro-government press.
Three people have so far been arrested, but no charges have been brought, and there are no claims of responsibility.
Investigators are focusing on a three- or four-member cell, according to Egypt's leading daily al-Ahram.
It was the first attack on foreigners in Egypt since 2006. A French student was killed and 24 people were wounded.
Analysts are quoted saying the bombing was an unsophisticated attack and was unlikely to signal a wide resurgence of Islamist militancy in Egypt.
It did not compare with the bombings which killed more than 100 people in tourist resorts in Sinai between 2004 and 2006, reports say.
Al-Ahram said the bomb was home-made and weighed up to 1.5kg, containing nails and metal fragments. It was detonated with a timer and had been placed on a marble bench.
A second device failed to explode. The al-Ahram account contradicts previous eyewitness statements that the bomb with exploded had been thrown from a rooftop.
There are no shortage of possible triggers in Egypt for freelance militant attacks, analysts say.
These could include the tough economic times and political repression, as well as the unpopularity of the government's stance on helping Israel blockade the Gaza Strip.
The early evening explosion happened near the Hussein mosque and the well-known Khan al-Khalili bazaar, which are popular attractions for local people and tourists alike.
Khan al-Khalili was targeted in 2005, when three people - including an American and a French tourist - were killed in a blast.