# How Secure is gpg Command Using Symmetric AES-256 From Being Cracked

How secure is any data encrypted using the following command:

gpg -o *encrypted_output_file_name* --symmetric --cipher-algo AES256 *file_to_be_encrypted*


Can anyone depend on this to encrypt and archive personal content in a public store?

Please provide details as to which attacks it is vulnerable to, and describe better encryption alternatives if any exist.

• corrected the question. – Arjun Jan 7 at 8:16

GPG's AES-256 symmetric encryption is believed to be as secure as it is difficult to

• guess the passphrase
• or compromise the machine used to perform encryption and decryption.

Guessing the passphrase should be harder if one uses

gpg --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256


or equivalently puts in the gpg.conf file:

s2k-mode 3
s2k-count 65011712
s2k-digest-algo SHA512
s2k-cipher-algo AES256


These options increase (to about the maximum possible per the OpenPGP format) the amount of processing to transform a passphrase into a key, hence the resistance to brute-force passphrase search. This is not a substitute to using a hard-to-guess passphrase, but does help significantly.

When encrypting to self, it still makes a lot of sense to use asymmetric encryption: that allows to encrypt without a passphrase, limiting its possible leak to decryption. I use this for automated backups in the cloud (with a different asymmetric key to sign the backups). I can confidently say that nothing on the machines doing the backups allows to decipher the backups.

• Thanks for the quick responce fgrieu. Correct me if i'm wrong : only advantage (in this context) of the asymmetric is that it prevents us from hardcoding the password in the backup-system correct ?. Also, can you suggest a few links/books that provide a good introduction to this subject. – Arjun Jan 7 at 10:13
• @Arjun: yes, not needing the passphrase for encryption is the one good reason to use asymmetric for encryption to self, including backups. Sorry that I pass on the request for introductory doc. – fgrieu Jan 7 at 10:39
• @Arjun I don't agree that it is the only advantage; asymmetric encryption also allows you / requires you to have access to the private key. Basically, the password now wraps / unwraps the private key. However, you can move the private key to smart card or USB stick so it becomes impossible for an adversary to 1) directly attack the ciphertext (as you need the private key to decrypt) or 2) search for the password, as you can only find it by trying to unwrap the private key. – Maarten Bodewes Jan 7 at 15:05
• @MaartenBodewes: right. We can (and should) keep the passphrase-protected private key out of the server, and that a strong line of defense. – fgrieu Jan 7 at 15:56
• And store the pw in a pw manager of sorts, especially if other persons are involved. I mean, I've seen people propose passwords as "strong" passwords that are literally too bad to post. AFAIK PGP doesn't really indicate if the password is weak or not. Now assuming some passwords are strong by just looking at character frequences etc. is tricky at best, but accepting known bad passwords is definitely worse. – Maarten Bodewes Jan 7 at 16:24