A 43 character securely randomly generated mixed case alphanumeric password (with 2 extra chars to give 64 possibilities per character) would constitute 258 bits of entropy (6 * 43 = 258).

Since the gold standard in AES symmetric key lengths is 256 bits, am I right in concluding that GPG will use my 43 character securely randomly generated password to create an encrypted file that is just as secure as if I'd used a securely randomly generated 256 bit binary key directly (instead of deriving it from a passphrase)?

I'm looking for gotchas, such as whether despite specifying to the gpg command to use AES256, maybe the KDF will still only create a 128 bit key from my 258 bits of entropy?

1 Answer 1


In some versions of GPG, the default KDF is PBKDF-SHA1, which will result in a 160-bit key, I am unsure what the default KDF is for each version, however their website man page says it is RIPEMD-160 (for the current version I assume).

You can change the default to the more secure SHA512 using the command --s2k-digest-algo SHA512, which should result in a hash value truncated to whatever key size the encryption algorithm uses, 256-bits in the case of AES256.

Since you are using a full entropy random password, you should not require iterations or salting, and can use just a straight hash if you desire (mode 0).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .