# GPG symmetric encryption and javascript

I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server. The user should then be able to take the encrypted result and decrypt it with GPG on the command line. I want to use GPG as it's easily available and the AES appears to support iteration on passphrase hashing.

I'm hoping to use AES, however I don't understand what iteration count or salt GPG uses.

For example, http://cheeso.members.winisp.net/AES-Encryption.htm allows you to set parameters for AES decryption using Javascript:

Does anyone know what parameters to use to be compatible with GPG ?

-
Just a note: with your approach of encrypting at the client, your users still have to trust the server to send the right JavaScript, and not a version which gives the key to the server, too. (But they don't have to worry that someone will later force you to give out the keys, if you don't have them then.) –  Paŭlo Ebermann Aug 31 '11 at 13:38
add comment

## 2 Answers

GnuPG follows the OpenPGP format, which is a protocol in its own right -- it uses AES (among other algorithms) but is more complex than "just AES with the right parameters".

There is at least one OpenPGP implementation in Javascript (I have not tried it, though).

-
The OpenPGP implementation in Javascript seems to only support asymmetric encryption. –  Ian Purton Sep 1 '11 at 11:10
add comment

The link in the question appears to be dead. So the question of parameters for that library might be irrelevant. But there are other options to achieve the end result of gpg symmetric encryption in JavaScript.

Another answer suggests Herbert Hanewinkel's JavaScript implementation of OpenPGP. That isn't going to work for symmetric encryption. But last year, I emailed Hanewinkel, to ask if I could use the library on my site. He said this:

that's ok, thank you for your mail. Future work on PGP in Javascript will be made by www.openpgpjs.org I am no longer working on this topic.

Regards,

Herbert Hanewinkel

On the new project's website, there is a link to a github repo. This implementation does support symmetric ciphers.

https://github.com/openpgpjs/openpgpjs/tree/master/src/ciphers/symmetric

So when you want to encrypt with javascript, use one of the symmetric ciphers in this library. And when you decrypt the message, run gpp from the command line with the option --symmetric

-
I'm sorry I don't see how this answers the question. The link is useful, but the rest of the post doesn't relate to the question (as far as I can see). Maybe it was intended as a comment? –  rath Sep 24 '13 at 22:01
The other answer's suggestion is to Hanewinkel's library. This is why you should not use that library, and use this one instead. –  maxvgc Sep 25 '13 at 20:24
add comment