2
$\begingroup$

I am currently working with GnuPG on a new project of mine. It would be very useful to know two things for that, which are not described in the manual:

  1. What is the maximum input size of a symmetric key in GnuPG?
  2. What key derivation function does GnuPG use?
$\endgroup$
4
$\begingroup$

What is the maximum input size of a symmetric key for GnuPG?

The key size of the symmetric key is defined by the cipher and is derived from a passphrase using OpenPGP's string to key function. The standard does not define a maximum input length, and I'm not aware of a limitation in GnuPG (but did not look up in the source code). Be aware that providing a passphrase as input to the string to key function longer than the symmetric key (ie., having more entropy than the symmetric key) does not increase security any more.

What key derivation function does GnuPG use?

OpenPGP calls the key derivation function "string to key function", which is defined in RFC 4880, OpenPGP, String-to-Key (S2K) Specifiers. It boils down to applying a hash function on the passphrase and optionally a salt, usually those get concatenated for a number of iterations to increase the workload for brute force attacks.

$\endgroup$
  • 1
    $\begingroup$ You mean "...providing a passphrase entropy as input to the string..." And password entropy is almost impossible to measure if you take a holistic approach. It could very well be true that longer passwords are more secure even if their actual byte length >> key size. $\endgroup$ – Paul Uszak Jul 8 '17 at 13:40
  • $\begingroup$ Richard was asking very generally for "maximum input size", which sounds more like a long, random string. But for sure, you're right that my statement is only valid for random input using the whole space of possible passphrases. $\endgroup$ – Jens Erat Jul 8 '17 at 20:51
  • 1
    $\begingroup$ "Be aware that providing a passphrase as input to the string to key function longer than the symmetric key does not increase security any more." This is not true; using a higher entropy password than the security of the key doesn't make sense. But hardly anyone will use passwords that contain 128 bits of entropy or more. $\endgroup$ – Maarten - reinstate Monica Jul 9 '17 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.