GnuPG Hacks

GnuPG does a lot more than just encrypt and decrypt e-mail and attachments.
Quick and Clean Encryption

Want to encrypt a file, but don't know where to start? Here's a quick and clean introduction to file encryption using GnuPG:

$ gpg -c test.txt
Enter passphrase:
Repeat passphrase:

When encrypting, GnuPG asks for a passphrase twice, just like when you set a new password. The new encrypted file has the same name, but with the extension .gpg added. The original file is left intact.

The -c stands for conventional encryption, also known as symmetric encryption. Normally, GnuPG defaults to public key encryption, but we haven't generated or loaded any public keys, so for now we have to stay with conventional.

This type of encryption is most useful only if you want to decrypt your files, but you don't trust where your files are stored. For example, easily lost or stolen storage can be protected with this type of encryption. This type of encryption is especially useful for off-site backups.

To extract the encrypted file, simply type:

$ gpg filename.gpg

GnuPG automatically detects that the file is encrypted with a passphrase and asks for that passphrase. Then it writes the decrypted data to a file with the same name but without the .gpg extension. As with encrypting, the encrypted file is left intact. If you want the output file to be written to a different filename, use standard redirection, exactly as with the --dearmor example. Note that both input and output redirection must be used, or GnuPG becomes confused:


$ gpg < filename.gpg > filename.txt

If you want someone else to decrypt the file, you have to tell this person the passphrase without leaking the passphrase to anyone else. A simple and straightforward way to do this is in person. That might seem not very useful, as the original file also could be given in person. But that passphrase can now be reused safely multiple times on different files in the future. Just like passwords, however, passphrases should be changed regularly. Never reuse a passphrase with other people, unless you want them to decrypt all of the files you ever encrypted with that passphrase.

Note: this warning is normal when using passphrase encryption in GnuPG. This can be avoided with public key encryption:

gpg: WARNING: message was not integrity protected

Passphrases

The passphrase is a secret that keeps the other secrets, which makes it the most important part of GnuPG security. Unfortunately, in practice, passphrases are also the weak part. This is because creating good passphrases is difficult, and remembering them is even more difficult.

I highly recommend Diceware, but if it doesn't appeal to you, take a look at the Wikipedia article (see Resources) or the passphrase Web pages recommended by your favorite Web search engine.

Regardless of what method you choose, a simple guide to passphrase security is that longer is usually better (Table 1).

Table 1. Password and passphrase strengths compared with estimated time to crack.

TypeLengthBitsTotal BitsTime to Crack
Single word of any language8 characters2424Seconds
Random mono-case letters8 characters4.737Minutes
Random mono-case letters16 characters4.775Decades
base64 [A-Za-z0-9+/=]10 characters660Months
base64 [A-Za-z0-9+/=]20 characters6120Uncrackable?
Completely random printable6 characters6.540Minutes
Completely random printable8 characters6.552Hours
Completely random printable12 characters6.578Decades
Completely random printable15 characters6.597Centuries
Completely random printable20 characters6.5130Uncrackable?
Diceware passphrase2 words12.926Seconds
Diceware passphrase4 words12.951Hours
Diceware passphrase6 words12.978Decades
Diceware passphrase8 words12.9120Uncrackable?

The time estimates in Table 1 are wide, because money and time can be traded evenly. Computing power keeps getting cheaper, so time to crack keeps getting shorter. Cracking costs start at free and go up.

If you cannot remember a GnuPG passphrase, the data encrypted with that passphrase is probably gone forever. There are no known back doors in GnuPG nor any way to recover a lost passphrase short of guessing. How long it takes depends on how good the passphrase was. A good 20-character passphrase could take billions of years to guess, even using all current and future computers.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

wrong correction?

Anonymous's picture

> The stdin (file descriptor 0) of the gpg process is filename txt,
rather than passphrase.txt, so your (intended) passphrase is never actually used!

Then how come the decryption worked?

I like this article

felipe1982's picture

i've been using GPG for a few years, and never knew about the --enarmor option (it isn't even in man page for version 1.2.6. I also like the built-in RNG, which I never knew existed. I enjoyed this tutorial did not include information about public key crypto, which is much more common on the web. That makes this article (and ones like it) in shorter supply == more valuable.

Thanks!

GPG should not be used here

Anonymous's picture

GPG should not be used here at all. According to the man page, the input password is not even hashed.
Have a look at aesloop instead. (Or maybe openssl enc alternatively)

gpg --passphrase-fd 0 doesn't do what you think it does

Anonymous's picture

The following command, as given in the article, has a problem.

cat passphrase.txt | gpg --passphrase-fd 0 -c < filename.txt > filename.gpg

The stdin (file descriptor 0) of the gpg process is filename txt,
rather than passphrase.txt, so your (intended) passphrase is never actually used!

Use this instead:

gpg --passphrase-fd 3 -c 3<passphrase.txt < filename.txt > filename.gpg

You failed to spot the problem simply because the decryption command
has the same problem...

(The unescaped less-than character in my 2 previous posts seem to have caused problems.Please delete them/ignore them)

gpg --passphrase-fd 0 doesn't do what you think it does

Anonymous's picture

The following command, as given in the article, has a problem

cat passphrase.txt | gpg --passphrase-fd 0 -c < filename.txt > filename.gpg

The stdin (file descriptor 0) of the gpg process is filename txt,
and not passphrase.txt, so your (intended) passphrase is never actually used!

Use this instead:

gpg --passphrase-fd 3 -c 3 < passphrase.txt < filename.txt > filename.gpg

You failed to spot the problem simply because the decryption command
has the same problem...

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState