I want to encrypt a tar archive and optionally a block file system (akin to DMG image). Does anyone know the pros vs cons of encrypting each with OpenSSL vs GPG?
I ask because some have stated that the OpenSSL command line is malleable and prone to attack. Therefore GPG was recommended. I'm still unclear of the reasons why. I'm also confused because GPG is asymmetric and it's unclear of this requirement for encrypting a file that only one person needs to decrypt.
If you're just encrypting it for yourself, then I don't think there's any advantage to one or the other. In either case you have a secret key you need to protect.
If you're encrypting to send to someone else then I believe PGP is preferable because you never have to share the secret key needed to decrypt the data with the other person, though the other person's public key does need to be shared. Please understand that PGP is hybrid encryption, using both RSA and symmetric encryption (I would suggest you use AES).