2

Is there a way to encrypt files with AES 256 in the authenticated GCM mode using GPG?

I don't see GCM in supported cipher modes. It seems that the GPG uses only one mode (its own modification of CFB), although libgcrypt supports GCM.

Edit:

GnuPG relies on Modification Detection Code (MDC) based on SHA-1 for authentication. It's unclear how the authentication performance of the MDC compares with the HMAC in GCM.

Improve this question
2
  • PGP uses a modified CFB, not CBC. Since (original) GPG is designed to be compatible with other PGP programs, it follows the standard.
    – dave_thompson_085
    Commented Apr 14, 2020 at 4:11
  • My bad, I meant CFB (they are very similar modes). Fixed!
    – eli
    Commented Apr 14, 2020 at 13:57

2 Answers 2

Reset to default
1

No, at least not in version 2.2.20 of GnuPG.

Improve this answer
4
  • How good an alternative is "encrypt and sign" to AEAD? And what if I externally MAC the encrypted file using a different program?
    – eli
    Commented Apr 13, 2020 at 12:14
  • Depends on what your goal is. If you want to communicate with someone without everybody knowing the message is from you, then "sign, then encrypt" is better.
    – user163495
    Commented Apr 13, 2020 at 12:17
  • GPG uses Sym. Encrypted Integrity Protected Data Packet, and Modification Detection Code (MDC) apparently SHA-1. They provide some protection against bit rot and tampering. Wouldn't that be a good replacement for MAC in GCM?
    – eli
    Commented Apr 13, 2020 at 12:34
  • @eli That seems like a better question for Cryptography
    – user163495
    Commented Apr 13, 2020 at 12:51
1

GnuPG is an ancient design that wasn't designed from the ground up to do authenticated encryption properly. This is, for example, one of the causes of the Efail vulnerabilities. GnuPG will output the whole plaintext for forged messages to stdout before checking its message digest code.

If you're looking for a commandline file encryption tool that follows modern best practices, age seems to be the up and comer right now. It uses ChaCha20-Poly1305, though, not AES-GCM as you're asking.

If you need public key signatures, signify is a much recommended newer tool.

Improve this answer
2
  • Yes, ChaCha via Age doesn't enjoy hardware acceleration. Any alternative using libsodium? What if I use Python bindings and write my own encryption script calling libsodium? I doesn't see any program making libsodium usable like GPG.
    – eli
    Commented Apr 13, 2020 at 21:28
  • Alternatively, I could write a script to do AES with GPG and MAC SHA256 using another program.
    – eli
    Commented Apr 13, 2020 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .