Symmetric Key Encryption with GnuPG

Password-only encryption with GnuPG works exactly as it did in 2009, and the output is still readable by any OpenPGP implementation. Two things changed around it: GnuPG 2.1 and later ask for the passphrase through pinentry, a dialog that does not exist in a cron job or a bare SSH session, so scripts need --pinentry-mode loopback; and while GnuPG 2.2 and 2.4 both pick AES-256 for symmetric mode on their own, spelling --cipher-algo AES256 out costs nothing and makes a file produced on an older or oddly configured machine exactly what you think it is.

Encrypt a file

gpg --symmetric --cipher-algo AES256 -o backup.zip.gpg backup.zip

You are asked for the passphrase twice. The result is a binary OpenPGP file; add --armor to get ASCII text that survives email and chat:

gpg --symmetric --cipher-algo AES256 --armor -o backup.zip.asc backup.zip

Decrypt

gpg -d -o backup.zip backup.zip.gpg

gpg: AES256 encrypted data
gpg: encrypted with 1 passphrase

Encrypt a directory on the fly

tar writes the archive to standard output, gpg encrypts the stream; nothing unencrypted touches the disk:

tar czpf - SomeFiles/ | gpg --symmetric --cipher-algo AES256 -o backup.tar.gz.gpg

And back, in one pipeline:

gpg -d backup.tar.gz.gpg | tar xzvf -

From a script or over SSH (no pinentry)

Put the passphrase in a file that only you can read, and tell gpg to take it from there instead of opening a dialog:

( umask 077 && echo 'correct horse battery staple' > ~/.backup-pass )
gpg --batch --yes --pinentry-mode loopback --passphrase-file ~/.backup-pass --symmetric --cipher-algo AES256 -o backup.tar.gz.gpg backup.tar.gz
gpg --batch --yes --pinentry-mode loopback --passphrase-file ~/.backup-pass -d -o backup.tar.gz backup.tar.gz.gpg

--batch disables all prompts, --yes overwrites an existing output file, --pinentry-mode loopback lets --passphrase-file (or --passphrase-fd 0 to read it from a pipe) supply the secret. Do not use --passphrase 'text' on the command line on a shared machine: it shows up in ps and in your shell history.

Check what you made

gpg --list-packets backup.tar.gz.gpg

:symkey enc packet: version 4, cipher 9, aead 0,s2k 3, hash 2

Cipher 9 is AES-256. The ciphers your build supports are in gpg --version:

gpg --version | grep Cipher

Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256

On first use gpg prints gpg: keybox '~/.gnupg/pubring.kbx' created; that is it creating the (empty) keyring symmetric mode does not need, not an error.

When a passphrase is not enough

Symmetric mode is the right tool for a backup you will decrypt yourself and for files handed over on a channel where you can speak the passphrase out of band. For anything sent to another person, use their public key (gpg -e -r them@example.com), and for whole-disk or whole-directory protection on a live system use LUKS or the companion recipe on encrypted CDs and DVDs.

If you ever want to quickly protect a file by encrypting it with a simple password, you can use GnuPG and symmetric key encryption for the job. Using this method, you can use industry strength encryption like AES256 and not have to worry about public and private keys. Just remember your password and use PGP compatible software to decrypt the files when needed.

For example, this is how you can encrypt a zip file called backup.zip and output the result to a new file called backup.zip.gpg.

gpg --symmetric --cipher-algo aes256 -o backup.zip.gpg backup.zip

Enter passphrase: *******

Repeat passphrase: *******

To decrypt the file, the following will work.

gpg -d -o backup.zip backup.zip.gpg

gpg: AES256 encrypted data

Enter passphrase: *******

gpg: encrypted with 1 passphrase

For fun, here’s how to create a Gzip Tar archive (tar.gz) and encrypt it on the fly.

tar czvpf - SomeFiles/ | gpg --symmetric --cipher-algo aes256 -o backup.tar.gz.gpg

Enter passphrase: *******

Repeat passphrase: *******

To decrypt and extract in a single command, the following also works.

gpg -d backup.tar.gz.gpg | tar xzvf -

gpg: AES256 encrypted data

Enter passphrase: *******

gpg: encrypted with 1 passphrase

If you’re curious to know what other ciphers are available to you, simple use the gpg --versioncommand.

gpg --version | grep Cipher

Cipher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH