On the use of gpg2 for long-term encryption

Question

I am looking for tools/libraries for symmetrically encrypting millions of files (many terabytes' worth of content).

In particular, I am exploring the possibility of using gpg2 for this¹.

One concern I have is that many years may elapse between the time these files are encrypted and the time it becomes necessary to decrypt one of them. Therefore, it is essential to preserve whatever is required for decryption all this time. I am not clear of what this would be in the case of gpg2.

This example will clarify my point.

When I type the following on my terminal

% gpg2 --symmetric > the_answer.gpg

...a dialog pops up asking for a passphrase, and after I enter it, another dialog pops up asking to confirm it². After I do all this, I can type in a message. So I continue with

% gpg2 --symmetric > the_answer.gpg
42

...and then I type Ctrl-D. At this point, the file the_answer.gpg contains an encrypted version of the message I typed in.

If I now run gpg2 --decrypt the_answer.gpg, gpg2 just goes ahead and decrypts the message immediately, without asking for a passphrase at all:

% gpg2 --decrypt the_answer.gpg                                               
gpg: AES256 encrypted data
gpg: encrypted with 1 passphrase
42

I figure that gpg2 must have stored the passphrase somewhere³.

---

Q1: If, say, 10 years in the future, I had the file the_answer.gpg, plus the original passphrase, and some other machine running some future version of gpg2, would this be enough to decrypt this file, or would I need something else? Or would I also need to have some persistent database-type files currently residing somewhere in my computer?

Q2: Since gpg2 implements an open standard (OpenPGP), are there other tools besides gpg2 that I could use to decrypt the_answer.gpg if I know the passphrase?

---

^{1 ...even though I realize that gpg2 is a tool optimized for asymmetrically encrypting an individual's email communications, a very different task from what I have in mind.}

^{2 I realize that such dialogs are a deal-breaker if one wants to encrypt millions of files. I understand that it is possible to supply the password without going through these dialogs, so I will ignore them for the purpose of this question.}

^{3 Moreover, somehow it knows that this passphrase was used for this message. Indeed, if I encrypt other messages with different passphrases, I can decrypt them too, as shown above, without ever being prompted for a passphrase.}

Answer 1

Yes, to both of your questions.

GPG uses the passphrase to programatically generate a symmetric encryption key that is used for the encryption/decryption process when the --symmetric flag is passed to the program.

Yes, any program that uses the OpenPGP algorithms can create the decryption key from the same passphrase (that algo is the special sauce, and it is part of the open code, so anyone can use it).

Also, just so ya' know, PGP/GPG encrypts everything with symmetric encryption. The difference triggered by the --symmetric flag is that normally it generates a completely random encryption key per output file, but then uses asymmetric encryption to encode this key to each listed "encrypted to" party, and includes those at the beginning of the file. That way any of the encrypted-to parties can use their private key and the first part of the file to find the symmetric decryption key. But since symmetric is so much more efficient, it is what is actually used to encrypt the payload data.