A 43 character securely randomly generated mixed case alphanumeric password (with 2 extra chars to give 64 possibilities per character) would constitute 258 bits of entropy (6 * 43 = 258).

Since the gold standard in AES symmetric key lengths is 256 bits, am I right in concluding that GPG will use my 43 character securely randomly generated password to create an encrypted file that is just as secure as if I'd used a securely randomly generated 256 bit binary key directly (instead of deriving it from a passphrase)?

I'm looking for gotchas, such as whether despite specifying to the gpg command to use AES256, maybe the KDF will still only create a 128 bit key from my 258 bits of entropy?

1 Answer 1


In some versions of GPG, the default KDF is PBKDF-SHA1, which will result in a 160-bit key, I am unsure what the default KDF is for each version, however their website man page says it is RIPEMD-160 (for the current version I assume).

You can change the default to the more secure SHA512 using the command --s2k-digest-algo SHA512, which should result in a hash value truncated to whatever key size the encryption algorithm uses, 256-bits in the case of AES256.

Since you are using a full entropy random password, you should not require iterations or salting, and can use just a straight hash if you desire (mode 0).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.