I have a use case where I want to commit symmetrically encrypted source code using GnuPG (think of Coursera assignments for backup and collaboration). I encrypt/decrypt all sources in a batch with a script and was wondering, why the output is not stable.

So basically, why does

echo "plain text" | gpg --armor --symmetric --cipher-algo AES256

with password secret yield different cipher texts with each call? (Surely enough, this doesn't affect the decryption – different cipher texts may decrypt back to the same plain text.) I am not experienced with crypto algorithms, but skimming the Wikipedia article it seems the algorithm is deterministic.

So in short, my questions are:

  1. Is this behaviour a property of AES or am I using GnuPG incorrectly?
  2. If the former is the case, are there other symmetric crypto algorithms which are better suited for this use case?

3 Answers 3


Usually, symmetric encryption starts with a random initialization vector (IV). OpenPGP uses a slightly different cypher feedback mode with an all-zero IV, but the first two blocks are random.

Because of this, also the symmetric encryption is not deterministic; you cannot compare the plain text by comparing the encrypted message, the encrypted result is not deterministic any more.


In addition to the encryption initialization vector (IV), the symmetric key derivation uses a random salt to protect against offline dictionary or rainbow table attacks. Specifically, the Iterated and Salted S2K (String-to-Key) packet contains an 8-byte salt.


Approaching your second question, rather than using a different crypto algorithm, you can replace gpg in symmetric mode with openssl:

echo "plain text" | openssl enc -aes-128-cbc -nosalt -pass pass:secret


  • For sample purposes, I am providing the passphrase in the command line. See PASS PHRASE ARGUMENTS in openssl(1) for better ways of providing it.

  • As we are explicitely disabling the salt, you should a stronger passphrase that is not reused, I would use a long randomly generated passphrase that changes for each assignment,


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .