Using GPG to Encrypt Your Data

For GPG symmetric encryption, the kind the article describes, here are the best options I&#x27;ve found for my typical case:<p><pre><code> gpg --symmetric \ --cipher-algo aes256 \ --digest-algo sha256 \ --cert-digest-algo sha256 \ --compress-algo none -z 0 \ --quiet --no-greeting \ --no-use-agent &quot;$@&quot; </code></pre> I keep this command here:<p><pre><code> https:&#x2F;&#x2F;github.com&#x2F;SixArm&#x2F;gpg-encrypt </code></pre> The options are chosen to balance tradeoffs of convenience, strength, and portability.

If we&#x27;re talking about GPG, please pay attention to <a href="https:&#x2F;&#x2F;www.passwordstore.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.passwordstore.org&#x2F;</a> which is really cool, open source password manager built on GPG.

Unless compatibility with gpg is a requirement, I think scrypt[0] is a much simpler tool for file encryption. The utility is meant to showcase the KDF of the same name. It&#x27;s very simple and has virtually no parameters. So:<p><pre><code> $ xz -k elrond_minutes.txt $ scrypt enc elrond_minutes.txt.xz elrond_minutes.txt.xz.enc $ signify -S \ -s vilya.key \ -m elrond_minutes.txt.xz.enc \ -x elrond_minutes.txt.xz.enc.sig $ rm elrond_minutes.txt{,.xz} </code></pre> Signing the final output is probably extraneous; I think scrypt uses a HMAC. This involves invoking multiple tools, but since each tool only does one thing it&#x27;s much easier to reason about, and I prefer this over using an omnibus tool like gpg.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;Tarsnap&#x2F;scrypt" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Tarsnap&#x2F;scrypt</a>

&gt;We suggest that you include five words of 5-10 letters in size, chosen at random, with spaces, special characters, and&#x2F;or numbers embedded into words.<p>&gt;You need to be able to recall the passphrase that was used to encrypt the file.<p>Why bother writing security guidelines which are impossible for a human to follow?<p>edit: Try recalling any passphrases generated by the command below, and that&#x27;s before the random sprinkling of punctuation.<p><pre><code> grep -E &quot;^[a-z]{5,10}$&quot; &#x2F;usr&#x2F;share&#x2F;dict&#x2F;words | shuf -n5 | tr &#x27;\n&#x27; &#x27; &#x27;</code></pre>

Key stretching is critical for password-based encryption, and gpg&#x27;s s2k options are vulnerable to GPU acceleration. Command-line tools to encrypt with bcrypt&#x2F;scrypt are common and may be a better option.

Is there a benefit in using symmetric encryption vs specifying yourself as a recipient?

The HECC site here is one of the best support sites i&#x27;ve ever seen. Very logically laid out KB, news, ask a question, etc.<p>thanks for the link

There&#x27;s the [2015] which should be included.

Why would they not use asymmetric encryption?