# GPG & Mcrypt - difference?

in short I'm learning GUI programming in python and thought it could be interesting to make a small GUI for symmetric encryption. Not being mad/mathematical/experienced (take your pick) enough to try to implement ciphers myself I figured I could create a GUI that just sits on top of an existing program (on Linux). So I found gpg and mcrypt.

I have been googling like mad but finding very little information about mcrypt other than it is "a replacement for the old crypt program in Linux". Also mcrypt seems to list Rrijndael in stead of AES (so guessing it is the Rrijndael cipher rather than the AES implementation of it?)

Now, save that mcrypt has an implementation of Serpent and gpg comes with the ability to sign/verify the encrypted file, is there any great differences or advantages/disadvantages to one or the other? currently finding mcrypt fascinating.

Any thoughts would be appreciated.

-
I can't speak to mcrypt, but my suggestion would be to stick to gpg or openssl. If you want to get ideas of how someone else implemented the same thing, take a look at pyrite. –  ryran Aug 20 at 21:14

## 1 Answer

GPG is an implementation of OpenPGP, which is a higher level protocol than e.g. mcrypt. So use GPG for PGP compatibility and mcrypt or related libraries for more direct - lower level - access to algorithms.

AES is Rijndael for a block size of 128 bits and the 128, 192 or 256 bit key sizes. So you are OK there. Learn about modes of operation and something about key management before creating the GUI. Possibly take a look at Password Based Key Derivation Functions such as PBKDF2 if you want to use a pass phrase.

-
Note that the mcrypt C library has had little maintenance over the years although apparently the developers are planning a new release. –  owlstead Aug 19 at 6:50
Thank you for the answer and comment. At least I have a general idea for v0.1a of the GUI. What of using openssl for encryption? seems like that is a possibility as well. –  Aaron W. Aug 19 at 20:30
Certainly, you should in that case preferably use the EVP_ "higher" level API of OpenSSL. –  owlstead Aug 19 at 21:23
Hmm.. I've got a lot of reading and playing around to do. Just as a last question (not exactly related but if you feel like it): Do you know of any good security reviews of CAST256/CAST6? It just caught my eye (reading through ye olde AES selection documents). While rounds != security it did seem interesting that it uses even more rounds than serpent. Anyway, thank you again. –  Aaron W. Aug 20 at 15:23
Mainly my work focusses on AES (in all it's forms) and 3DES. Unfortunately I therefore don't know much about CAST. Serpent has a good rep. though (as does AES, of course). –  owlstead Aug 20 at 16:02