Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

When I use gpg --symmetric --s2k- and press tab some options appear:

--s2k-cipher-algo
--s2k-count
--s2k-digest-algo
--s2k-mode

What do those options do?

share|improve this question
8  
gnupg.org/documentation/manpage.en.html Find -> "--s2k" – Jeff Ferland♦ Jun 4 '12 at 13:09

closed as off topic by Jeff Ferland♦, Iszi, Gilles, AviD♦ Aug 18 '12 at 20:28

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 0 down vote accepted

--s2k-mode sets mode of operation:

  • 0: Simple (hash applied one time to password)
  • 1: Salted (hash applied one time to password+8 byte salt)
  • 3: Iterated and Salted (hash applied chosen number of times to password+8 byte salt)

--s2k-digest-algo sets hash function used for password hashing

--s2k-count sets number of rounds this hash function will be applied

--s2k-cipher-algo chooses cipher for encrypting private key with hashed password

In GnuPG 1.4.12 defaults are (found experimentally): 

--s2k-mode = 3
--s2k-digest-algo = SHA1 (supports MD5, RIPEMD-160, SHA2s too)
--s2k-count = 65536 (supports from 1024 to 65011712)
--s2k-cipher-algo = CAST5 (supports 3DES, CAST5, Blofish, AES, Twofish, Camellia too)

You can see how your existing keys are encrypted by typing gpg --list-packets ~/.gnupg/secring.gpg

But all algorithms supported by GnuPG can be efficiently automated at GPUs. So I suggest to use side implementation of bcrypt or scrypt instead of --s2k-* options and then give it's result as passphrase to GnuPG with --s2k-mode set to 0.

share|improve this answer
thanks for ur reply, but how i can use ' bcrypt or scrypt instead of --s2k-* ' by the way i only use 'gpg -c' to encrypt files IF u can give me the ultimate secure code to use to encrypt my files that would be cool ^_^ – rezx Jun 4 '12 at 17:35
@rezx It seems (because of downvotes) that I was incorrect when I wrote that bcrypt should be used instead of --s2k-* options. --s2k-* are OK too – Andrey Botalov Jun 4 '12 at 19:15
got it, thanks. – rezx Jun 5 '12 at 8:20
@rezx I've asked a question about bcrypt vs --s2k-* and bcrypt is really better. – Andrey Botalov Jul 17 '12 at 9:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.