0

I'm trying to encrypt a file using AES algo and sign it using my private key in GPG. The command I'm using is

gpg --encrypt --symmetric --cipher-algo aes256 --armor --sign input-file

It asks me for the symmetric key and then the passphrase to unlock my secret key for signing. Perfectly fine until now. It further asks the public key of the recipient and if I do not enter any, the whole step fails. Since I'm using symmetric encryption, why do i still need to provide the recipients identity. That should have been asked when I use only the --encrypt option.

The man page of gpg states that when using --symmetric option, the recipient could decrypt the contents using either the symmetric key or his private key. This sounds like there is an option here. In this case, if i do not provide any recipients identity, the process should ignore that part and should proceed. But the whole process fails.

Someone please clarify.

Improve this question
1
  • If I am reading this correctly -- It is because GPG uses the recipient's key to encrypt the symmetric encryption/decryption key, so the recipient can decrypt the key and use it to decrypt the actual message/payload. There would be little point in even using symmetric encryption if either side of the symmetric encryption was in plain text, since it is symmetrical. If you do not want anyone else to be able to decrypt, just designate yourself as the recipient.
    – C. M.
    Apr 15, 2022 at 22:33

3 Answers 3

Reset to default
2

gpg --encrypt --symmetric --cipher-algo aes256 --armor --sign input-file

Since I'm using symmetric encrypion, why do i still need to provide the recipents identity.

This happens because you included the --encrypt command, which is for public-key encryption.

Improve this answer
0

In this tutorial it is stated:

Symmetric encryption has its problems. It doesn't let you simultaneously sign the message to indicate that it hasn't been tampered with or replaced with another file that someone else generated! (You can, however, sign it manually later using the techniques in the Signing Messages section, but it's theoretically possible that an attacker can replace that file in the brief time between when you encrypted it and when you signed it.)

So you need to do it in two steps.

Improve this answer
1
  • Ya, the explaination was right. Performing encrption and signing in two seperate steps might let an attacker come in the middle of these steps. But in my question, It wasn't about tampering the message. I was merely concerned about gpg requesting the recipients public key for encryption even when I selected symmetric encryption.
    – Pelo
    Nov 23, 2014 at 13:40
0

The manpage indicates that you can use --encrypt and --symmetric to achieve that.

--encrypt
Encrypt data to one or more public keys. This command may be combined with --sign (to sign and encrypt a message), --symmetric (to encrypt a message that can be decrypted using a secret key or a passphrase), or --sign and --symmetric together (for a signed message that can be decrypted using a secret key or a passphrase). --recipient and related options specify which public keys to use for encryption.

I was having the same problem using similar syntax.

However this method provided by the GNU Privacy Handbook works

gpg --output doc.gpg --symmetric doc

You can also add the --cipher-algo AES-256 to get the desired bitstrength.

Improve this answer

You must log in to answer this question.