Is there a way to encrypt files with AES 256 in the authenticated GCM mode using GPG?

I don't see GCM in supported cipher modes. It seems that the GPG uses only one mode (its own modification of CFB), although libgcrypt supports GCM.


GnuPG relies on Modification Detection Code (MDC) based on SHA-1 for authentication. It's unclear how the authentication performance of the MDC compares with the HMAC in GCM.

  • PGP uses a modified CFB, not CBC. Since (original) GPG is designed to be compatible with other PGP programs, it follows the standard. – dave_thompson_085 Apr 14 '20 at 4:11
  • My bad, I meant CFB (they are very similar modes). Fixed! – eli Apr 14 '20 at 13:57

GnuPG is an ancient design that wasn't designed from the ground up to do authenticated encryption properly. This is, for example, one of the causes of the Efail vulnerabilities. GnuPG will output the whole plaintext for forged messages to stdout before checking its message digest code.

If you're looking for a commandline file encryption tool that follows modern best practices, age seems to be the up and comer right now. It uses ChaCha20-Poly1305, though, not AES-GCM as you're asking.

If you need public key signatures, signify is a much recommended newer tool.

  • Yes, ChaCha via Age doesn't enjoy hardware acceleration. Any alternative using libsodium? What if I use Python bindings and write my own encryption script calling libsodium? I doesn't see any program making libsodium usable like GPG. – eli Apr 13 '20 at 21:28
  • Alternatively, I could write a script to do AES with GPG and MAC SHA256 using another program. – eli Apr 13 '20 at 21:31

No, at least not in version 2.2.20 of GnuPG.

  • How good an alternative is "encrypt and sign" to AEAD? And what if I externally MAC the encrypted file using a different program? – eli Apr 13 '20 at 12:14
  • Depends on what your goal is. If you want to communicate with someone without everybody knowing the message is from you, then "sign, then encrypt" is better. – MechMK1 Apr 13 '20 at 12:17
  • GPG uses Sym. Encrypted Integrity Protected Data Packet, and Modification Detection Code (MDC) apparently SHA-1. They provide some protection against bit rot and tampering. Wouldn't that be a good replacement for MAC in GCM? – eli Apr 13 '20 at 12:34
  • @eli That seems like a better question for Cryptography – MechMK1 Apr 13 '20 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.