GnuPG - provide encryption key for AES rather than deriving it from passphrase

Question

I'd like to encrypt a file with AES256 and provide my own 32-bytes for the encryption, rather than having GPG derive it from the passphrase.

I could not find such option, but I'm thinking about a possible workaround.

Per this message:

https://lists.gnupg.org/pipermail/gnupg-devel/2018-June/033795.html

The other use of passphrases is symmetric-only encryption (command -c) but in most use cases the passphrase comes from another application or a database and is not entered manually. In this case I consider it better to use --s2k-mode=0 along with a full entropy passphrase

Is my understanding correct that I could just pass a 256-bit key as the passphrase to GPG and set some options like: --s2k-mode=0 --s2k-count=0 to get as close as possible to the goal of passing my own AES key? (I guess that some transformation still needs to happen so PGP can ensure that the key is in proper format for AES256)

Are there any extra options to make the output key as plain as possible? Are there any security implications of using it like this?

Answer 1

This is not possible with OpenPGP. The data is encrypted in a symmetrically encrypted data packet (or, more commonly, a related packet using an MDC) using a random key, and then that key is stored in a symmetric-key encrypted session key packet. The latter requires an S2K algorithm be specified, and there is no raw session key input. Effectively, some sort of passphrase is required.

GnuPG and most other programs are going to want the passphrase to not contain random newlines and NUL bytes, and as such, the simplest thing to do is to hex- or base64-encode the 32-byte string and use that. You can use --s2k-mode=0 if you want, and the passphrase will simply be hashed with a suitable hash algorithm, which is the simple S2K.

Note that the current OpenPGP internet draft forbids the use of the simple S2K at all and requires at least the salted S2K (--s2k-mode=1), even for high-entropy passphrases, so adopting that approach here would be prudent both for security and because a future version of GnuPG will likely stop accepting --s2k-mode=0.