0

I know that s2k or string 2 key is used to encrypt the private key of an asymmetric pair, but are the s2k-* options meant to be used with the -c or the --symmetric option? Does GnuPG give you no option to change the iteration amount with symmetric encryption?

What is the difference between --cipher-algo and --s2k-cipher-algo, in terms of using symmetric encryption?

1

OpenPGP uses the string-to-key function for both encrypting the private key with a passphrase and symmetric encryption. The function is used to derive a session key (cipher block) for symmetric encryption.

You can easily analyze what options GnuPG is applying by using the --list-packets command.

Default value of AES128 (algorithm ID 7) for the cipher algorithm:

$ echo foo | gpg2 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 7, s2k 3, hash 10
    salt 6E6B107661BD9B19, count 102400 (105)
[snip]

Switching to AES256 instead using the --cipher-algo parameter (cipher ID 9):

$ echo foo | gpg2 --cipher-algo AES256 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 9, s2k 3, hash 10
    salt 44F97F3EE31F2E46, count 102400 (105)
[snip]

And by using --s2k-cipher-algo:

$ echo foo | gpg2 --s2k-cipher-algo AES256 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 9, s2k 3, hash 10
    salt 2BFDAE2630AB5D5C, count 102400 (105)
[snip]

The same applies to setting the iteration count:

$ echo foo | gpg2 --s2k-count 2048 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 7, s2k 3, hash 10
    salt 6A08AD73CC36741A, count 2048 (16)
[snip]

With other words: you can use both options, they have the same effect, and you can also use the other --s2k-* options for symmetric encryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.