How can I change the default symmetric cipher used by GnuPG from CAST5 to another?
I'm using GPG4Win on Windows, but would also be interested in a solution for Linux.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If there is no option in the graphical user interface, edit GnuPG's configuration file instead. In the end, graphical user interfaces for GnuPG don't do anything else but calling the GnuPG command line.
There are two options to set the used algorithms for encrypting to other people:
cipher-algo [algorithm] and
personal-cipher-preferences [algorithm]. Latter is preferred, as it both takes the other user's algorithm capabilities and preferences into account, and complies to the OpenPGP standard; while
cipher-algo enforces a given algorithm.
You can look up available algorithms by running
gpg --version, on Windows you might have to call
gpg.exe --version and
cd to the installation directory before. An example output might include:
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256
To enforce the use of
AES256, edit your
gpg.conf file and add following line:
You can also set preferences which algorithms you want others to choose when they send encrypted messages to you. This might only be available on the command line, but will have affect no matter what client application the other is using (but remember: it is only a proposal of your preferences, and not enforced, compare with
Start the edit menu using
gpg --edit-key [key-id] (replacing
[key-id] with your key id, and you might have to use
gpg.exe again as described above). Inside, you can use
showpref to list the currently set up preferences, and
setpref to change them. The user interface for doing so is horrible, and you have to provide a long list of cipher, digest and compression algorithms, while the preferred ones always have to be listed first.
An article on debian-administration.org also describes this procedure, and proposes following preferences, which seem reasonable:
setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
Updated: For Gpg4win, I see two options:
@jens-erat has already more knowledgeably described the latter, but I will offer the following inputs based on playing with it myself:
gpg2 --versionand looking for the line like
Original (non-GUI) answer:
If you're using the command line gpg, then the --cipher-algo argument will allow you to choose your cipher, and you can use --version to see which ciphers are available.
(Test shown here on Linux, should be equivalent for Windows)
$ gpg --version gpg (GnuPG) 1.4.16 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: ~/.gnupg Supported algorithms: Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 $ file test* test1.txt: ASCII text test2.txt: ASCII text $ gpg --cipher-algo TWOFISH -c test1.txt Enter passphrase: Repeat passphrase: $ gpg --cipher-algo AES256 -c test2.txt Enter passphrase: Repeat passphrase: $ file test* test1.txt: ASCII text test1.txt.gpg: GPG symmetrically encrypted data (TWOFISH cipher) test2.txt: ASCII text test2.txt.gpg: GPG symmetrically encrypted data (AES256 cipher) $