3

This question is admittedly artificial. Its purpose is only to help me understand aspects of gnupg that I can't figure out from reading the documentation.

One thing that puzzles me about gnupg is that the passphrase plays qualitatively very different roles in asymmetric and symmetric encryption.

In gnupg's asymmetric encryption scheme, the passphrase is used only to protect the private key. It is not used for encryption and decryption per se; for that one uses the public and private keys, respectively. These keys, in turn, are generated by gpg2 itself (i.e. gpg2 ... --gen-key ...), using what appear to be pretty high cryptographic standards. In particulars, in contrast to the passphrase, these keys are not of the user's invention.

The situation is very different gnupg's symmetric encryption scheme, where the (user-invented) passphrase is used to actually carry out the encryption and decryption. In contrast to the cryptographic-grade keys that one generates with gpg2 ... --gen-key ..., and uses for asymmetric encryption/decryption, the passphrase used for symmetric encryption/decryption can be any old silly passphrase, like "mysecret".

As I said, I find this difference really confusing.

My question is: what is the most direct way to have gpg2 generate a passphrase for symmetric encryption that is comparable in cryptographic strength to the keys that one would generate using gpg2 ... --gen-key ...?

Here's at least one way to do it: generate a a standard asymmetric encryption keypair using gpg2 ... --gen-key ..., discard the private key, dump the public key of the pair with --armor, and use this as one's passphrase for symmetric encryption.

Does gpg2 support a less convoluted approach?

Improve this question
2
  • 1
    I'm not sure what you mean. The passphrase you use to encrypt the private key (the private key itself is generated randomly) is used in the exact same way as the passphrase used to directly encrypt files with symmetric encryption. There's no fundamental difference between them.
    – forest
    Commented Jan 6, 2019 at 4:26
  • @forest: what I mean is that, in asymmetric mode, the passphrase is used only to encrypt the private key; subsequent "content" is encrypted using the public key. In symmetric mode, however, what I just referred to as "subsequent content" is encrypted using the (possibly totally insecure) passphrase. The role of the passphrase is very different in the two schemes.
    – kjo
    Commented Jan 6, 2019 at 14:19

1 Answer 1

Reset to default
6

gpg symmetric encryption creates a random symmetric key and encrypts that key using the passphrase along with a random salt. The random symmetric key is used to encrypt the file or message.

Here's a simple example:

Create a symmetric encrypted message

gpg --symmetric --armor
Hello there!

-----BEGIN PGP MESSAGE-----

jA0ECQMCMvT60tBO0Hj/0kIBF8YvdNeI61L/GSib25ZU1bkeNLTvkwSMfOFUma9u
YjFN5vKzpv8xclcuUT5huIiDlVyDVwON3tbiflavACeiJg4=
=Nt35
-----END PGP MESSAGE-----

The password is 1234

View the message components

gpg --list-packets

gpg: Go ahead and type your message ...
-----BEGIN PGP MESSAGE-----

jA0ECQMCMvT60tBO0Hj/0kIBF8YvdNeI61L/GSib25ZU1bkeNLTvkwSMfOFUma9u
YjFN5vKzpv8xclcuUT5huIiDlVyDVwON3tbiflavACeiJg4=
=Nt35
-----END PGP MESSAGE-----
gpg: AES256 encrypted data
gpg: encrypted with 1 passphrase
# off=0 ctb=8c tag=3 hlen=2 plen=13
:symkey enc packet: version 4, cipher 9, s2k 3, hash 2
    salt 32F4FAD2D04ED078, count 65011712 (255)
# off=15 ctb=d2 tag=18 hlen=2 plen=66 new-ctb
:encrypted data packet:
    length: 66
    mdc_method: 2
# off=36 ctb=a3 tag=8 hlen=1 plen=0 indeterminate
:compressed packet: algo=1
# off=38 ctb=cb tag=11 hlen=2 plen=19 new-ctb
:literal data packet:
    mode b (62), created 1546881253, name="",
    raw data: 13 bytes

As can be seen through basic inspection of the dissected message, the symmetric passphrase is not used directly to encrypt the plain text nor even the random symmetric key.

Additional information addressing OP comments.

To decrypt the above message

gpg -d

<--- copy and paste the message in the terminal and type in 1234 for the passphrase --->

<--- to exit, press enter and then ctrl-d --->

Result:

-----BEGIN PGP MESSAGE-----

jA0ECQMCMvT60tBO0Hj/0kIBF8YvdNeI61L/GSib25ZU1bkeNLTvkwSMfOFUma9u
YjFN5vKzpv8xclcuUT5huIiDlVyDVwON3tbiflavACeiJg4=
=Nt35
-----END PGP MESSAGE-----gpg: AES256 encrypted data
gpg: encrypted with 1 passphrase
Hello there!

Encrypted Symmetric keys using Passphrase and Salt

There is no need for gpg to keep track of anything. The message itself includes all the needed items for decryption except the passphrase. The passphrase may not be very good, meaning having low entropy. However, that's why salts are used.

Salts are non-secret strings that are appended or pre-pended to user passwords/passphrases or the like in order to increase the entropy of the user generated secret. This may sound like it doesn't work very well; adding a non-secret component to a secret. But it does work.

For further reading on salts:

Wikipedia Salt(cryptography)

Improve this answer
5
  • Thank you +1, that was really instructive. Would you mind adding to your answer the commands to decrypt the message you just encrypted? One lingering confusion is: if gpg creates a random symmetric key for each message, how can the user later decrypt the results? Does gpg keep a persistent record of these one-time keys?
    – kjo
    Commented Jan 9, 2019 at 14:18
  • @kjo ... see current edit
    – RubberStamp
    Commented Jan 9, 2019 at 14:37
  • I think I may have misinterpreted the statement "gpg symmetric encryption creates a random symmetric key". I thought you meant that it creates such a random symmetric key for each message it encrypts. In light of what you just wrote, I have to conclude that this can't be the case. Specifically, I have to conclude that the symmetric key is generated deterministically (i.e. not randomly) from the passphrase. Right?
    – kjo
    Commented Jan 9, 2019 at 15:11
  • Each message has its own random symmetric key... furthermore the salt is also random and different for each message. You can try it yourself. symmetrically encrypt the same message multiple times with the same passphrase each time... In every case, the resulting PGP encrypted message will be different and each gpg --list-packets of each message will show a different salt. As I wrote above, there is no need keep a persistent record of anything within any local database or the like... Each encrypted message contains all the information to decrypt each message, except for the passphrase.
    – RubberStamp
    Commented Jan 9, 2019 at 15:27
  • Thank you for your patience. I still don't understand, but I figure that my remaining questions are best put forward in a separate thread: security.stackexchange.com/questions/201155/….
    – kjo
    Commented Jan 10, 2019 at 1:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .