Suppose I encrypt a file, of, say, 10 MB, with a secure, suitable passphrase, and the command:
gpg --symmetric my_file.txt
What level of expertise and hardware would be required, in broad terms, to break the encryption?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
AES256 will be used by gpg (GnuPG) 2.2.27 for that.
It does some iterated and salted key stretching to derive the AES key. So the amount of entropy present in the passphrase is crucial.
a secure, suitable passphrase
"Secure" means the passphrase is not stored in another place where it is available to the attacker. "Suitable" is all about entropy.
By Kerckhoffs we anticipate that the attacker knows or can usefully assume the generative method that created the passphrase. For example, if you always generate a passphrase by rolling dice to find a page and line number in a certain book, we assume the attacker also has a copy of that book and can brute his way through it.
To the extent that you're hashing 256 bits worth of passphrase entropy when deriving that key, then even an attacker with nation-state hardware resources couldn't reveal the plaintext in your lifetime. If you're using a passphrase like "colorless green ideas", then an attacker with expertise about you and your generating process could reveal the plaintext in an afternoon using a laptop. The key derivation approach forces the attacker to spend some milliseconds to produce each key, but if there's low source entropy then bruting through plausible passphrases will still be effective.