3

GPG & PGP negotiate the encryption & hashing algorithm to use based on the recipient key's prioritized list of supported algorithms. The problem is DES/MD5 are forced to be included as the last choice if not already included due to the OpenPGP Standard.

Yes of course they all are quite secure and perhaps practically more secure than needed (other than quantum concerns or a major math discovery).

However, to maximize security what ordered ranking on gpg supported symmetric encryption would you choose and why?

GPG Supported Symmetric and Hashing Algorithms:

Cipher: IDEA (S1), 3DES (S2), CAST5 (S3), BLOWFISH (S4), AES (S7), AES192 (S8), AES256 (S9), TWOFISH (S10), CAMELLIA128 (S11), CAMELLIA192 (S12), CAMELLIA256 (S13)

Hash: MD5 (H1), SHA1 (H2), RIPEMD160 (H3), SHA256 (H8), SHA384 (H9), SHA512 (H10), SHA224 (H11)

Hashing algorithms are easy to order since SHAxxx family is agreed to be the best in GPG currently followed by RIPEMD160 SHA1 and MD5. It would be nice to outlaw anything but SHA-2 versions.

Riseup's Guide recommends:

personal-cipher-preferences AES256 AES192 AES CAST5

That seams wrong since you want to avoid the DES fall back as much as possible right? Why not this or a reasoned variation?

AES256 AES192 AES TWOFISH CAMELLIA256 CAMELLIA192 CAMELLIA128 CAST5 BLOWFISH 

[then DES gets added by software supporting OpenPGP]

Nice answer discussing the GPG but not much on symmetric algorithms. Top Hashing and Encryption Algorithms

3

OpenPGP enforces support for a set of basic algorithms for reasons of compatibility, and you already realized you cannot disable them entirely.

The idea is to provide as many better algorithms compared to DES and MD5 as possible, to increase chances of matches between sender and receiver. Omitting anything better than DES and MD5 is always at loss, there is no reason of doing so, given these are the worst algorithms supported. Don't just limit yourself to the "newest and best algorithms", or you could end up with the worst having known weaknesses when somebody else is using older implementations.

Also don't forget there are two places to configure those options: Your own preferences (in gpg.conf), and the one stored in your key to tell others using that key what your preferences are (gpg --edit-key, setpref ...). For latter, make sure to list preferences for all three categories, or you will limit yourself to the minimal set of algorithms enforced by the standard.

Symmetric Encryption Algorithms

Any algorithms supported by OpenPGP (apart from DES) are considered strong and no weaknesses are know. Blowfish has some problems with weak keys and might be a worse choice than others, as implementations might fail at choosing good keys.

Providing a total order for all the algorithms is difficult, as long as you put blowfish to the end. Putting AES in front seems reasonable, as it's probably the most used and analyzed algorithm among all of those.

Hashing Algorithms

Choice is easier here. MD5 is bad; SHA-1 better than MD5, but still has known problems. The other ones are considered strong.

Compression Algorithms

Compression is important, there are some esoteric attacks on the OpenPGP CFB mode prevented by compression.

The choice among those is pretty much up to you.

  • Both the OpenPGP standard & GPG were updated to render that attack mute: Based on this attack, the OpenPGP standard was apparently modified, I believe to add a message integrity component. >>Yes, the Modification Detection Code packet was formally introduced in RFC 4880 as a mechanism to defend against producing garbled decryption like that shown in the referenced paper: 'tools.ietf.org/html/rfc4880#section-5.14' – StackAbstraction Sep 5 '15 at 14:06
  • This is correct; and the attack does not seem very relevant, anyway, at least not for normal mail usage. The updated RFC and newly added packages do not really solve the original issue, but add a mechanism to detect this special attack (and transmission errors). Compression mostly prevents the attack even earlier, at least for compressible contents.. – Jens Erat Sep 5 '15 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.