Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I gather, from reading the GPG manual, that symmetric encryption based on a password uses one of a variety of Key Derivation Functions (KDF). Although not explicitly mentioned I assume that PBKDF2 is the default as the other options appear to be legacy algorithms from the PGP standard.

However I can't find any information on the number of iterations that the KDF does by default of whether there is a way to change that value manually. I want to know this because it would have an impact on the required complexity for the password (e.g. number of words generated using the diceware method) to achieve a given level of security.

share|improve this question
$2^{16}$ iterations according to my reading of the source a while ago. I don't remember whether there's a way to change that. – Gilles Aug 26 '13 at 14:11
[+1] to @Gilles for his comment and reference. Looking around at crypto.SE, I detected "Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?" which might be interesting to read too (especially "2." of the question and it's related answer) if you're looking for a general insight on the KDF. – e-sushi Aug 26 '13 at 15:43
Thank you both for the answers. I was just hoping that I could get some "free" bits of security margin by upping the iteration count in the same way as you can choose the block cipher manually. I'll use a more complex password (7 diceware words gives 2^90). – Quinton G Aug 26 '13 at 16:20
up vote 5 down vote accepted

Use gpg --s2k-mode 3 --s2k-count N, where N is the number of iterations you want to use. The manual page says the default is 65536, and you can use any number between 1024 and 65011712.

If you like to tweak the defaults, I suggest making this number as large as you can bear it, without introducing noticeable slowdown (e.g., ideal would be to make the passphrase mangling process take about a second or so).

See also this answer to a different question, and the following questions/answers on IT Security.StackExchange:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.