0

I know that s2k or string 2 key is used to encrypt the private key of an asymmetric pair, but are the s2k-* options meant to be used with the -c or the --symmetric option? Does GnuPG give you no option to change the iteration amount with symmetric encryption?

What is the difference between --cipher-algo and --s2k-cipher-algo, in terms of using symmetric encryption?

1 Answer 1

1

OpenPGP uses the string-to-key function for both encrypting the private key with a passphrase and symmetric encryption. The function is used to derive a session key (cipher block) for symmetric encryption.

You can easily analyze what options GnuPG is applying by using the --list-packets command.

Default value of AES128 (algorithm ID 7) for the cipher algorithm:

$ echo foo | gpg2 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 7, s2k 3, hash 10
    salt 6E6B107661BD9B19, count 102400 (105)
[snip]

Switching to AES256 instead using the --cipher-algo parameter (cipher ID 9):

$ echo foo | gpg2 --cipher-algo AES256 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 9, s2k 3, hash 10
    salt 44F97F3EE31F2E46, count 102400 (105)
[snip]

And by using --s2k-cipher-algo:

$ echo foo | gpg2 --s2k-cipher-algo AES256 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 9, s2k 3, hash 10
    salt 2BFDAE2630AB5D5C, count 102400 (105)
[snip]

The same applies to setting the iteration count:

$ echo foo | gpg2 --s2k-count 2048 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 7, s2k 3, hash 10
    salt 6A08AD73CC36741A, count 2048 (16)
[snip]

With other words: you can use both options, they have the same effect, and you can also use the other --s2k-* options for symmetric encryption.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .