What exactly does s2k do in gpg

Question

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is s2k even supposed to mean?

Could someone explain to me the purpose and detailed function of s2k?

1. Is --s2k-cipher-algo even necessary in a symmetric encryption scenario where you define the cipher separately?
2. What exactly does --s2k-count do?
3. What does the number after --s2k-count do? What does it indicate and why is 65 million the highest number? 65 million of what? What is done so many times?

Answer 1

The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a symmetric encryption or MAC algorithm.

Turning passwords into keys is tricky business because passwords that human can remember and accept to type tend to be weak with regards to exhaustive search (often called "dictionary attacks" in that context, since we are talking about words). Thus, we need a "strengthened" process which is often called "password hashing" or "password-based key derivation". To be brief, a good password hashing process must:

1. be unique to each case, to prevent precomputations and cost sharing;

2. be awfully expensive, in a configurable way.

Read this answer for an introduction to the relevant concepts of password hashing.

---

The s2k-count parameter is used only when the s2k method is "3", i.e. Iterated and Salted S2K in OpenPGP terminology. This password hashing method basically hashes together multiple copies of the salt and the password, concatenated, until the total byte count reaches the specified value. With the maximum value (65011712), about 65 MB worth of data are thus hashed; a modern machine (even a "small" one like a smartphone) should be able to do that in a fraction of a second (say, less than half a second), so this is tolerable from a user interface point of view. However, the attacker will also need to do that heavy hashing for each trial of a potential password; and for him, there is a huge difference between half a second and a millionth of a second, because he has many potential passwords to try.

Now that S2K is not the best in town, because smart attackers will get a substantial boost in their attack by using some GPU (GPU are very good at running hash functions like SHA-1). But this is the best one defined so far in the OpenPGP format.

The --s2k-cipher-algo is about informing the S2K transform about the kind of key it must produce: while symmetric keys are mostly bunches of bits, their length still depends on the intended algorithm (e.g. a key for AES-256 must have 256 bits in length).

Answer 2

s2k = "string to key", so a password is transformed into a key for a symmetric cipher. It's documented in RFC4880. The "count" is the number of bytes hashed in each hashing step, which is only relevant for the most secure and default s2k-version, salted and iterated.