# What exactly does s2k do in gpg

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is s2k even supposed to mean?

Could someone explain to me the purpose and detailed function of s2k?

1. Is --s2k-cipher-algo even necessary in a symmetric encryption scenario where you define the cipher separately?
2. What exactly does --s2k-count do?
3. What does the number after --s2k-count do? What does it indicate and why is 65 million the highest number? 65 million of what? What is done so many times?
• – Rukako Jul 6 '17 at 18:43
• I´ve read this ! – Richard R. Matthews Jul 6 '17 at 18:53
• What in man gpg is confusing / unclear about these options? – puzzlepalace Jul 6 '17 at 19:00
• The description for --s2k-count n pretty clearly answers questions 2 through 4... – puzzlepalace Jul 6 '17 at 19:01

The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a symmetric encryption or MAC algorithm.

Turning passwords into keys is tricky business because passwords that human can remember and accept to type tend to be weak with regards to exhaustive search (often called "dictionary attacks" in that context, since we are talking about words). Thus, we need a "strengthened" process which is often called "password hashing" or "password-based key derivation". To be brief, a good password hashing process must:

1. be unique to each case, to prevent precomputations and cost sharing;

2. be awfully expensive, in a configurable way.

The s2k-count parameter is used only when the s2k method is "3", i.e. Iterated and Salted S2K in OpenPGP terminology. This password hashing method basically hashes together multiple copies of the salt and the password, concatenated, until the total byte count reaches the specified value. With the maximum value (65011712), about 65 MB worth of data are thus hashed; a modern machine (even a "small" one like a smartphone) should be able to do that in a fraction of a second (say, less than half a second), so this is tolerable from a user interface point of view. However, the attacker will also need to do that heavy hashing for each trial of a potential password; and for him, there is a huge difference between half a second and a millionth of a second, because he has many potential passwords to try.
The --s2k-cipher-algo is about informing the S2K transform about the kind of key it must produce: while symmetric keys are mostly bunches of bits, their length still depends on the intended algorithm (e.g. a key for AES-256 must have 256 bits in length).