GPG – How to Specify AES-256 Algorithm When Creating GPG Key

encryptiongpgpassword-store

Pardon me if this is not possible. My goal is to utilise pass. From the conducted research, it appears that the pass command utility will require a GPG key before you can store your sensitive data.

Now, in order to generate a GPG key, one would run the following command

gpg --full-generate-key

which is a pre-requisite to using pass.

From the output, we can see that the options to choose from are as follows:

gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: directory '/home/user1/.gnupg' created
gpg: keybox '/home/user1/.gnupg/pubring.kbx' created
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
  (14) Existing key from card
Your selection?

As you can see, you can use RSA or DSA, despite GPG specifying that you can use AES256.

gpg (GnuPG) 2.2.27
libgcrypt 1.8.8
Copyright (C) 2021 Free Software Foundation, Inc.
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/user1/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

Does that mean it is impossible to secure your passwords in pass using AES256 encryption method?

Best Answer

What you are trying to do is unfortunately not possible.

Note that AES256 is listed under the options for "Cipher", not "Pubkey".

That said, I can understand that you would prefer the higher security level of AES256 over RSA. It seems however that the ECDSA and ED25519 algorithms can provide similar security to AES256.

To enable it in gpg2, you will need to specify the --expert option. When asked "what kind of key you want", choose

(9) ECC and ECC

with either NIST P-256 or Curve 25519, respectively. Both curve algorithms provide the same level of security, with ED25519 being a tiny bit faster than ECDSA.

Related Question