5

After I used this code to encrypt gpg.txt

$ gpg -c --cipher-algo AES256 --digest-algo SHA512 "GPG.txt"

I checked the result to see if it was encrypted with AES256 and hashed with SHA512

$ gpg --list-packets GPG.txt.gpg
symkey enc packet: version 4, cipher 9, s2k 3, ***hash 2***
gpg: AES256 encrypted data

I found Cipher=9, which is AES256 as I asked, but Hash=2, which stands for SHA1 and is not 10=SHA512 as I had wanted!

Why did this happen? Does anyone know how to force gpg to use SHA512 instead of SHA1?

Improve this question
3
  • 1
    It seems like you are looking at the key packet. That's the part of the encrypted file that holds the actual encryption key. From the looks of it, the data itself isn't hashed at all (which makes sense, you are asking for symmetric encryption). Have you tried using asymmetric encryption instead and seeing if that makes any difference?
    – user
    Commented Feb 6, 2013 at 12:55
  • From the looks of it, the data itself isn't hashed at all (which makes sense, you are asking for symmetric encryption), what u mean?
    – user195971
    Commented Feb 6, 2013 at 13:14
  • Doesn't the hash make a difference only for signatures?
    – vonbrand
    Commented Feb 6, 2013 at 18:12

1 Answer 1

Reset to default
11

I hate to say it, but read the gpg man page.

The --digest-algo option chooses a message digest algorithm ... for the message ... i.e., if you create a signature.

The --s2k-digest-algo option sets what algo is used to hash the passphrases. If you set THAT to sha512, then you'll see hash 10 on that symkey enc packet line.

In response to your questions in the below comment:

  • Use --cipher-algo to specify the symmetric cipher algorithm used to actually encrypt the message.
  • Use --digest-algo to specify the digest algorithm used to hash the message when signing.
  • Use --s2k-digest-algo to specify the digest algorithm used for hashing passphrases in various operations (e.g., the symmetric passphrase specified when using -c).
Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .