3

With OpenSSL, I can select a what type of block cipher to use for encrypting a file.

For example, if I want to encrypt a file with AES256 CBC block cipher mode:

openssl aes-256-cbc -a -salt -pass pass:MYPASSWORD -in secrets.txt -out secrets.txt.enc

In gpg2, I try to encrypt a file with the following:

gpg2 --cipher-algo AES256 -a --no-use-agent --passphrase MYPASSWORD -c secrets.txt

There are two problems I could get some help with:

  • There is no option to specify what cipher block to use. What if I want AES256 CTR or XTS instead of CBC? What cipher block does --cipher-algo AES256 use and how do I specify something specific?

  • The command completely fails if I don't enter the passphrase in the gnu password agent (I'm trying to supply the passphrase in the command with --passphrase and --no-use-agent, for possible automation on a trusted machine):

    gpg: WARNING: "--no-use-agent" is an obsolete option - it has no effect

    gpg: problem with the agent: Invalid card

    gpg: error creating passphrase: Operation cancelled

    gpg: symmetric encryption of `secrets.txt' failed: Operation cancelled

Improve this question
4
  • Note that recent GnuPG versions use the agent to perform crypto operations; you cannot disable it.
    – u1686_grawity
    Sep 7, 2014 at 2:58
  • @grawity So it's not possible to automate gpg2 enc/dec operations? It seems like I have to manually type in my passphrase into the agent.
    – vcipq
    Sep 7, 2014 at 3:35
  • Man page... With gpg2 you must use the --batch option instead of --no-use-agent.
    – rsaw
    Sep 7, 2014 at 4:49
  • Maybe it would help if you explained what you're trying to achieve. I can tell it's some kind of automation but not really sure about your scenario
    – markovuksanovic
    Sep 7, 2014 at 8:19

2 Answers 2

Reset to default
1

Cypher Mode

OpenPGP enforces one given mode, a modified CBC mode as defined in RFC 4880. You cannot change it to something else.

GPG agent

As already noted by @grawity in the comments, more recent versions of GnuPG 2 extracted some cryptographic functions to the agent, so the passphrase and private key don't leave this smaller program with lower probability for vulnerabilities.

I guess that using gpg-preset-passphrase (documentation for GnuPG 2.1) to set the passphrase programatically is the way to go for batch operation in GnuPG 2. An alternative might be to use the `--passphrase[-fd, file] options which still seem to be available in GnuPG 2.1.

Improve this answer
0

To get a list of supported ciphers you can use gpg2 --version. On my machine I get the following output:

Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256

I don't see a way to change to CTR or XTS, though.

I also don't see the option to specify passphrase in the command line but maybe you could try encrypting with a secret key instead of a passphrase.

Improve this answer
2
  • I thought the secret key was generated from the passphrase?
    – vcipq
    Sep 7, 2014 at 3:37
  • @vcipq: No; merely encrypted using it.
    – u1686_grawity
    Sep 21, 2014 at 18:18

You must log in to answer this question.