I want to change some encryption options while using GnuPG to encrypt a file symmetrically.

1) However, for choosing the cipher algorithm, GnuPG has two commands and I don't know which one to use.

Between these two, which one should I use?

--s2k-cipher-algo AES256

--cipher-algo AES256

2) Also for choosing the digest algorithm, there are two options,

Between these two, which one should I use?

--s2k-digest-algo SHA512

--digest-algo SHA512

3) Is there anything wrong with this encryption?

gpg -symmetric --cipher-algo AES256 --digest-algo SHA512 --s2k-mode 3 --s2k-count 65011712 PlainText

Edit: This is not a duplicate question, I can't find any post here on Stackexchange or any where in the net that specify the difference between --s2k-cipher-algo and --cipher-algo.

  • $\begingroup$ @Conrado It's not a duplicate. I did a lot of research before posing this question, and I have in fact already read that post before posting my question. $\endgroup$ Commented Jun 5, 2019 at 12:16
  • $\begingroup$ Welcome to crypto.stackexchange - It would be helpful for us if you could explain why the linked question does not help you find what you need to know. I checked the linked possible duplicate question, and it is not clear to me what you need to know that the linked answer doesn't help with. $\endgroup$
    – Ella Rose
    Commented Jun 7, 2019 at 21:56
  • 1
    $\begingroup$ The linked question explain the use of --s2k in GnuPG, my question is about clearing the ambiguity about the difference between two options in GnuPG that seems to do the same thing, but they have to be different otherwise why have two different options, these are --s2k-cipher-algo and --cipher-algo. $\endgroup$ Commented Jun 8, 2019 at 0:06

1 Answer 1


(1,2) You could use:

gpg2 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256 --symmetric /*file path*

According to The GNU Privacy Guard Manual, p. 71, we use --s2k-cipher-algo name when we want to apply symmetric encryption with a passphrase if --cipher-algo name or --personal-cipher-preferences string have not been set. The default is AES128 for GnuPG 2.1 and higher. The setup above is the strongest one available in the OpenPGP Proposed Standard (RFC 4880).

The result will look like this (but the salt will surely be different):

gpg2 --list-packets /*file path* gpg: AES256 encrypted data gpg: encrypted with 1 passphrase off=0 ctb=8c tag=3 hlen=2 plen=13 :symkey enc packet: version 4, cipher 9, s2k 3, hash 10 salt 406974B08EF1428B, count 65011712 (255)


Yes, there were two errors: one hyphen was left out in front of symmetric. It should be:


Secondly, after --s2k-count 65011712 one should put the path to the file. Those usually look something like this:


Keep in mind what your goals are. Perhaps you should focus on using a very strong passphrase: long, truly random, using all possible characters.

So, in short, those pairs of commands you listed do the same things, but the s2k specifiers only apply to symmetric encryption with a passphrase (note that s2k specifiers have another function: in the encryption of the secret part of private keys in the private keyring).

  • $\begingroup$ I tested encrypting a file with different options and it seems like --s2k-cipher-algo is specific to the symmetric encryption and --cipher-algo is used for both symmetric and asymmetric. However, for the digest algo, --digest-algo doesn't change the digest algo for the symmetric encryption at all, so even when if I do --digest-algo SHA512 and check using --list-packets, the hash remain the same, which means for changing the digest algo for symmetric encryption I have to use --s2k-digeset-algo $\endgroup$ Commented Jun 5, 2019 at 21:24
  • $\begingroup$ @ COLD Crypto You are basically right. You cannot use --digest-algo (name) alone in symmetric encryption with a passphrase, but you could use it in combination with --s2k-cipher-algo (name) to change the digest algorithm. Note that one cannot use --cipher-algo (name) and --digest-algo (name) together in encryption with a passphrase. GnuPG in the terminal has a well-deserved reputation for causing headaches. $\endgroup$
    – Patriot
    Commented Jun 6, 2019 at 0:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.