When I use gpg --symmetric --s2k- and press tab some options appear:


What do those options do?


1 Answer 1


--s2k-mode sets mode of operation:

  • 0: Simple (hash applied one time to password)
  • 1: Salted (hash applied one time to password+8 byte salt)
  • 3: Iterated and salted (hash applied chosen number of times to password+8 byte salt)

--s2k-digest-algo sets hash function used for password hashing

--s2k-count sets number of rounds this hash function will be applied

--s2k-cipher-algo chooses cipher for encrypting the plaintext using the hashed password

In GnuPG 1.4.12 defaults are (found experimentally):

--s2k-mode = 3
--s2k-digest-algo = SHA1 (supports MD5, RIPEMD-160, SHA2s too)
--s2k-count = 65536 (supports from 1024 to 65011712)
--s2k-cipher-algo = CAST5 (supports 3DES, CAST5, Blofish, AES, Twofish, Camellia too)

You can see how your existing keys are encrypted by typing gpg --list-packets ~/.gnupg/secring.gpg

But all algorithms supported by GnuPG can be efficiently automated at GPUs. So I suggest to use side implementation of bcrypt or scrypt instead of --s2k-* options and then give its result as a passphrase to GnuPG with --s2k-mode set to 0.

  • thanks for ur reply, but how i can use ' bcrypt or scrypt instead of --s2k-* ' by the way i only use 'gpg -c' to encrypt files IF u can give me the ultimate secure code to use to encrypt my files that would be cool ^_^
    – rezx
    Commented Jun 4, 2012 at 17:35
  • @rezx It seems (because of downvotes) that I was incorrect when I wrote that bcrypt should be used instead of --s2k-* options. --s2k-* are OK too Commented Jun 4, 2012 at 19:15
  • @rezx I've asked a question about bcrypt vs --s2k-* and bcrypt is really better. Commented Jul 17, 2012 at 9:52
  • 7
    Just a note to anyone reading this question, the --s2k options may not do what you think if you have GPG 2.x (see this issue in the bugtracker).
    – starfry
    Commented Jan 23, 2017 at 9:26
  • The man page of GPG 2.2.32 states that the default of --s2k-cipher-algo is AES-128. Commented Nov 20, 2021 at 13:22

Not the answer you're looking for? Browse other questions tagged .