9
$\begingroup$

I gather, from reading the GPG manual, that symmetric encryption based on a password uses one of a variety of Key Derivation Functions (KDF). Although not explicitly mentioned I assume that PBKDF2 is the default as the other options appear to be legacy algorithms from the PGP standard.

However I can't find any information on the number of iterations that the KDF does by default of whether there is a way to change that value manually. I want to know this because it would have an impact on the required complexity for the password (e.g. number of words generated using the diceware method) to achieve a given level of security.

Improve this question
$\endgroup$
4
  • 3
    $\begingroup$ $2^{16}$ iterations according to my reading of the source a while ago. I don't remember whether there's a way to change that. $\endgroup$
    – Gilles 'SO- stop being evil'
    Aug 26, 2013 at 14:11
  • $\begingroup$ [+1] to @Gilles for his comment and reference. Looking around at crypto.SE, I detected "Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?" which might be interesting to read too (especially "2." of the question and it's related answer) if you're looking for a general insight on the KDF. $\endgroup$
    – e-sushi
    Aug 26, 2013 at 15:43
  • $\begingroup$ Thank you both for the answers. I was just hoping that I could get some "free" bits of security margin by upping the iteration count in the same way as you can choose the block cipher manually. I'll use a more complex password (7 diceware words gives 2^90). $\endgroup$
    – Quinton G
    Aug 26, 2013 at 16:20
  • $\begingroup$ My version of gpg (Debian 11) has no support for PBKDF2. And both of them specify which algo is the default. Like here: --s2k-digest-algo name: Use name as the digest algorithm used to mangle the passphrases. The default algorithm is SHA-1. $\endgroup$
    – Jarekczek
    Apr 24, 2022 at 15:58

1 Answer 1

Reset to default
12
$\begingroup$

Use gpg --s2k-mode 3 --s2k-count N, where N is the number of iterations you want to use. The manual page says the default is 65536, and you can use any number between 1024 and 65011712.

If you like to tweak the defaults, I suggest making this number as large as you can bear it, without introducing noticeable slowdown (e.g., ideal would be to make the passphrase mangling process take about a second or so).

See also this answer to a different question, and the following questions/answers on IT Security.StackExchange:

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.