I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I was wondering if a stolen encrypted file such as one encrypted with GnuPG can be cracked much much faster than a bcrypt hash of the same password assuming it is 10 char long using A-Za-z0-9!~?
To encrypt a piece of data, you need an encryption key. An encryption key has to be a long, random string. Passwords do not fit this criteria. So if you want to use a password as an encryption key, you need to use a key derivation function. Strong password hashing algorithms like
scrypt are key derivation functions.
So to answer your question, it depends. It depends on which KDF the application is using to stretch the password into an encryption key. GnuPG does use a KDF function (controlled by the
--s2k-* set of flags).