Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I use gpg --symmetric --s2k- and press tab some options appear:

--s2k-cipher-algo
--s2k-count
--s2k-digest-algo
--s2k-mode

What do those options do?

share|improve this question

closed as off topic by Jeff Ferland, Iszi, Gilles, AviD Aug 18 '12 at 20:28

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

8  
gnupg.org/documentation/manpage.en.html Find -> "--s2k" –  Jeff Ferland Jun 4 '12 at 13:09

1 Answer 1

up vote 2 down vote accepted

--s2k-mode sets mode of operation:

  • 0: Simple (hash applied one time to password)
  • 1: Salted (hash applied one time to password+8 byte salt)
  • 3: Iterated and Salted (hash applied chosen number of times to password+8 byte salt)

--s2k-digest-algo sets hash function used for password hashing

--s2k-count sets number of rounds this hash function will be applied

--s2k-cipher-algo chooses cipher for encrypting private key with hashed password

In GnuPG 1.4.12 defaults are (found experimentally):

--s2k-mode = 3
--s2k-digest-algo = SHA1 (supports MD5, RIPEMD-160, SHA2s too)
--s2k-count = 65536 (supports from 1024 to 65011712)
--s2k-cipher-algo = CAST5 (supports 3DES, CAST5, Blofish, AES, Twofish, Camellia too)

You can see how your existing keys are encrypted by typing gpg --list-packets ~/.gnupg/secring.gpg

But all algorithms supported by GnuPG can be efficiently automated at GPUs. So I suggest to use side implementation of bcrypt or scrypt instead of --s2k-* options and then give it's result as passphrase to GnuPG with --s2k-mode set to 0.

share|improve this answer
    
thanks for ur reply, but how i can use ' bcrypt or scrypt instead of --s2k-* ' by the way i only use 'gpg -c' to encrypt files IF u can give me the ultimate secure code to use to encrypt my files that would be cool ^_^ –  rezx Jun 4 '12 at 17:35
    
@rezx It seems (because of downvotes) that I was incorrect when I wrote that bcrypt should be used instead of --s2k-* options. --s2k-* are OK too –  Andrey Botalov Jun 4 '12 at 19:15
    
got it, thanks. –  rezx Jun 5 '12 at 8:20
    
@rezx I've asked a question about bcrypt vs --s2k-* and bcrypt is really better. –  Andrey Botalov Jul 17 '12 at 9:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.