Suppose I encrypt a file, of, say, 10 MB, with a secure, suitable passphrase, and the command:
gpg --symmetric my_file.txt
What level of expertise and hardware would be required, in broad terms, to break the encryption?
$\begingroup$
$\endgroup$
3
-
1$\begingroup$ As of gnupg-2.1.18 uses AES-256 as the default usage with modified CFB mode. This is good for encryption. However, I'm not sure about the default key derivation. It seems SHA-1 with 65011712 iterations. If so, choose password that have good strength. And, I never liked unlisted the default values! $\endgroup$– kelalakaSep 16 at 20:36
-
$\begingroup$ @kelalaka Put that in an answer, flesh out your comment about default values for a layman such as myself, and I would accept it. $\endgroup$– chancellorofpaphosSep 16 at 21:11
-
$\begingroup$ I don't know the current default, I will not post such answer. $\endgroup$– kelalakaSep 16 at 21:13
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
AES256 will be used by gpg (GnuPG) 2.2.27 for that.
It does some iterated and salted key stretching to derive the AES key. So the amount of entropy present in the passphrase is crucial.
a secure, suitable passphrase
"Secure" means the passphrase is not stored in another place where it is available to the attacker. "Suitable" is all about entropy.
By Kerckhoffs we anticipate that the attacker knows or can usefully assume the generative method that created the passphrase. For example, if you always generate a passphrase by rolling dice to find a page and line number in a certain book, we assume the attacker also has a copy of that book and can brute his way through it.
To the extent that you're hashing 256 bits worth of passphrase entropy when deriving that key, then even an attacker with nation-state hardware resources couldn't reveal the plaintext in your lifetime. If you're using a passphrase like "colorless green ideas", then an attacker with expertise about you and your generating process could reveal the plaintext in an afternoon using a laptop. The key derivation approach forces the attacker to spend some milliseconds to produce each key, but if there's low source entropy then bruting through plausible passphrases will still be effective.
