When I use gpg --symmetric --s2k- and press tab some options appear:


What do those options do?


--s2k-mode sets mode of operation:

  • 0: Simple (hash applied one time to password)
  • 1: Salted (hash applied one time to password+8 byte salt)
  • 3: Iterated and Salted (hash applied chosen number of times to password+8 byte salt)

--s2k-digest-algo sets hash function used for password hashing

--s2k-count sets number of rounds this hash function will be applied

--s2k-cipher-algo chooses cipher for encrypting private key with hashed password

In GnuPG 1.4.12 defaults are (found experimentally):

--s2k-mode = 3
--s2k-digest-algo = SHA1 (supports MD5, RIPEMD-160, SHA2s too)
--s2k-count = 65536 (supports from 1024 to 65011712)
--s2k-cipher-algo = CAST5 (supports 3DES, CAST5, Blofish, AES, Twofish, Camellia too)

You can see how your existing keys are encrypted by typing gpg --list-packets ~/.gnupg/secring.gpg

But all algorithms supported by GnuPG can be efficiently automated at GPUs. So I suggest to use side implementation of bcrypt or scrypt instead of --s2k-* options and then give it's result as passphrase to GnuPG with --s2k-mode set to 0.

  • thanks for ur reply, but how i can use ' bcrypt or scrypt instead of --s2k-* ' by the way i only use 'gpg -c' to encrypt files IF u can give me the ultimate secure code to use to encrypt my files that would be cool ^_^
    – rezx
    Jun 4 '12 at 17:35
  • @rezx It seems (because of downvotes) that I was incorrect when I wrote that bcrypt should be used instead of --s2k-* options. --s2k-* are OK too Jun 4 '12 at 19:15
  • @rezx I've asked a question about bcrypt vs --s2k-* and bcrypt is really better. Jul 17 '12 at 9:52
  • 7
    Just a note to anyone reading this question, the --s2k options may not do what you think if you have GPG 2.x (see this issue in the bugtracker).
    – starfry
    Jan 23 '17 at 9:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.