When creating a secret key with GnuPG, you are asked for a password to protect it. Which encryption algorithm is used to achieve this? The handbook only says that a symmetric encryption algorithm is used.
GnuPG 2.x has a separate
gpg-agent that is the custodian of secret keys and that offers no control whatsoever over the encryption parameters of the secret keys within.
--s2k are accepted but ignored when setting a passphrase or exporting a secret key.
No, that is not possible. Right now the agent always uses AES and S2K paremeters which require on the running machine about 100ms for decryption.
So I believe the current situation is that keys are held by the agent as the agent decides is best to meet its speed target on the running machine and there is no way to control it or to export differently. All exports I have tried result in key attributes that you can see like this:
$ gpg --export-secret-key DEADBEEF | gpg --list-packets iter+salt S2K, algo: 7, SHA1 protection, hash: 2, salt: ...
iter+salt tag is the string-to-key mode that GnuPG uses to convert the passphrase (string) into a key. The default value
iter+salt means that a salt is added to the passphrase and that string is hashed multiple times (a technique called key stretching which aims to increase difficulty of brute-forcing passphrases).
So that illustrates how GnuPG encrypts secret keys and highlights the fact that you have no control over it if you're using version 2.x due to its use of the
Phase 1: Symmetric Key Derivation
First, the passphrase is used to derive a key for symmetric encryption using a string-to-key function. Several settings can be fine-tuned in GnuPG considering this, like the hashing algorithm and the number of repetitions. From the GnuPG manual:
Use name as the digest algorithm used to mangle the passphrases for symmetric encryption. The default is SHA-1.
Selects how passphrases for symmetric encryption are mangled. If n is 0 a plain passphrase (which is in general not recommended) will be used, a 1 adds a salt (which should not be used) to the passphrase and a 3 (the default) iterates the whole process a number of times (see
Specify how many times the passphrases mangling for symmetric encryption is repeated. This value may range between 1024 and 65011712 inclusive. The default is inquired from gpg-agent. Note that not all values in the 1024-65011712 range are legal and if an illegal value is selected, GnuPG will round up to the nearest legal value. This option is only meaningful if
--s2k-modeis set to the default of 3.
Phase 2: Symmetric Encryption
Using this symmetric key, the private key is encrypted symmetrically. Also the encryption algorithm can be chosen, while AES-128 is the default in GnuPG.
Use name as the cipher algorithm for symmetric encryption with a passphrase if
--cipher-algoare not given. The default is AES-128.
Supported ciphers can be displayed by running
gpg --version, for example:
$ gpg --version [...] Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256
Unlike public-private-key algorithms (where GnuPG 2.1 added elliptic curves), the supported symmetric algorithms are the same among all somewhat current releases of GnuPG.
All those options can also be set up in
~/.gnupg/gpg.conf, where they're noted without the
According to this article, you can choose which cipher to use for data encryption (which I assume includes key encryption, since it's just a file, right?) from the following list:
Cypher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256
After digging around a bit in man pages and on google, you can change the default through a number of settings (see this question for details: How to change default cipher in GnuPG on both Linux and Windows?)
I can't find anything that specifically mentions encryption of private keys, so I would assume that it just uses whatever is set as the default symmetric cipher.