With OpenSSL, I can select a what type of block cipher to use for encrypting a file.

For example, if I want to encrypt a file with AES256 CBC block cipher mode:

openssl aes-256-cbc -a -salt -pass pass:MYPASSWORD -in secrets.txt -out secrets.txt.enc

In gpg2, I try to encrypt a file with the following:

gpg2 --cipher-algo AES256 -a --no-use-agent --passphrase MYPASSWORD -c secrets.txt

There are two problems I could get some help with:

  • There is no option to specify what cipher block to use. What if I want AES256 CTR or XTS instead of CBC? What cipher block does --cipher-algo AES256 use and how do I specify something specific?

  • The command completely fails if I don't enter the passphrase in the gnu password agent (I'm trying to supply the passphrase in the command with --passphrase and --no-use-agent, for possible automation on a trusted machine):

    gpg: WARNING: "--no-use-agent" is an obsolete option - it has no effect

    gpg: problem with the agent: Invalid card

    gpg: error creating passphrase: Operation cancelled

    gpg: symmetric encryption of `secrets.txt' failed: Operation cancelled

  • Note that recent GnuPG versions use the agent to perform crypto operations; you cannot disable it. – user1686 Sep 7 '14 at 2:58
  • @grawity So it's not possible to automate gpg2 enc/dec operations? It seems like I have to manually type in my passphrase into the agent. – vcipq Sep 7 '14 at 3:35
  • Man page... With gpg2 you must use the --batch option instead of --no-use-agent. – rsaw Sep 7 '14 at 4:49
  • Maybe it would help if you explained what you're trying to achieve. I can tell it's some kind of automation but not really sure about your scenario – markovuksanovic Sep 7 '14 at 8:19

Cypher Mode

OpenPGP enforces one given mode, a modified CBC mode as defined in RFC 4880. You cannot change it to something else.

GPG agent

As already noted by @grawity in the comments, more recent versions of GnuPG 2 extracted some cryptographic functions to the agent, so the passphrase and private key don't leave this smaller program with lower probability for vulnerabilities.

I guess that using gpg-preset-passphrase (documentation for GnuPG 2.1) to set the passphrase programatically is the way to go for batch operation in GnuPG 2. An alternative might be to use the `--passphrase[-fd, file] options which still seem to be available in GnuPG 2.1.


To get a list of supported ciphers you can use gpg2 --version. On my machine I get the following output:


I don't see a way to change to CTR or XTS, though.

I also don't see the option to specify passphrase in the command line but maybe you could try encrypting with a secret key instead of a passphrase.

  • I thought the secret key was generated from the passphrase? – vcipq Sep 7 '14 at 3:37
  • @vcipq: No; merely encrypted using it. – user1686 Sep 21 '14 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy