6
$\begingroup$

How secure is any data encrypted using the following command:

gpg -o *encrypted_output_file_name* --symmetric --cipher-algo AES256 *file_to_be_encrypted*

Can anyone depend on this to encrypt and archive personal content in a public store?

Please provide details as to which attacks it is vulnerable to, and describe better encryption alternatives if any exist.

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
9
$\begingroup$

GPG's AES-256 symmetric encryption is believed to be as secure as it is difficult to

  • guess the passphrase
  • or compromise the machine used to perform encryption and decryption.

Guessing the passphrase should be harder if one uses

gpg --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256

or equivalently puts in the gpg.conf file:

s2k-mode 3
s2k-count 65011712
s2k-digest-algo SHA512
s2k-cipher-algo AES256

These options increase (to about the maximum possible per the OpenPGP format) the amount of processing to transform a passphrase into a key, hence the resistance to brute-force passphrase search. This is not a substitute to using a hard-to-guess passphrase, but does help significantly.

When encrypting to self, it still makes a lot of sense to use asymmetric encryption: that allows to encrypt without a passphrase, limiting its possible leak to decryption. I use this for automated backups in the cloud (with a different asymmetric key to sign the backups). I can confidently say that nothing on the machines doing the backups allows to decipher the backups.

Improve this answer
$\endgroup$
8
  • $\begingroup$ Thanks for the quick responce fgrieu. Correct me if i'm wrong : only advantage (in this context) of the asymmetric is that it prevents us from hardcoding the password in the backup-system correct ?. Also, can you suggest a few links/books that provide a good introduction to this subject. $\endgroup$
    – Arjun
    Jan 7, 2019 at 10:13
  • $\begingroup$ @Arjun: yes, not needing the passphrase for encryption is the one good reason to use asymmetric for encryption to self, including backups. Sorry that I pass on the request for introductory doc. $\endgroup$
    – fgrieu ♦
    Jan 7, 2019 at 10:39
  • $\begingroup$ @Arjun I don't agree that it is the only advantage; asymmetric encryption also allows you / requires you to have access to the private key. Basically, the password now wraps / unwraps the private key. However, you can move the private key to smart card or USB stick so it becomes impossible for an adversary to 1) directly attack the ciphertext (as you need the private key to decrypt) or 2) search for the password, as you can only find it by trying to unwrap the private key. $\endgroup$
    – Maarten Bodewes ♦
    Jan 7, 2019 at 15:05
  • $\begingroup$ @MaartenBodewes: right. We can (and should) keep the passphrase-protected private key out of the server, and that a strong line of defense. $\endgroup$
    – fgrieu ♦
    Jan 7, 2019 at 15:56
  • 1
    $\begingroup$ @fgrieu: What's the point of AES 256 with RSA? The default GPG RSA 3072 has security level of AES 128. The RSA 4096 doesn't add much to 3072 (perhaps 18 bits). $\endgroup$
    – eli
    Mar 28, 2020 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.