I'm trying to encrypt a file using AES algo and sign it using my private key in GPG. The command I'm using is

gpg --encrypt --symmetric --cipher-algo aes256 --armor --sign input-file

It asks me for the symmetric key and then the passphrase to unlock my secret key for signing. Perfectly fine until now. It further asks the public key of the recipient and if I do not enter any, the whole step fails. Since I'm using symmetric encrypion, why do i still need to provide the recipents identity. That should have been asked when I use only the --encrypt option.

The man page of gpg states that when using --symmetric option, the recipient could decrypt the contents using either the symmetric key or his private key. This sounds like there is an option here. In this case, if i do not provide any recepients identity, the process should ignore that part and should proceed. But the whole process fails.

Someone please clarify.


In this tutorial it is stated:

Symmetric encryption has its problems. It doesn't let you simultaneously sign the message to indicate that it hasn't been tampered with or replaced with another file that someone else generated! (You can, however, sign it manually later using the techniques in the Signing Messages section, but it's theoretically possible that an attacker can replace that file in the brief time between when you encrypted it and when you signed it.)

So you need to do it in two steps.

| improve this answer | |
  • Ya, the explaination was right. Performing encrption and signing in two seperate steps might let an attacker come in the middle of these steps. But in my question, It wasn't about tampering the message. I was merely concerned about gpg requesting the recipients public key for encryption even when I selected symmetric encryption. – Pelo Nov 23 '14 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy