On Tue, 2006-11-14 at 16:01 -0600, [EMAIL PROTECTED] wrote: > Thanks. > > Well, my ultimate goal is to encrypt data, but I don't want to use > passphrase to do it as I believe it is not secure enough. > > So my questions are: > > 1. How to create a symmetric key or cipher? With that, I may use another > tool to encrypt/decrypt. > > 2. Can gpg be used to do key based encryption? Not passphrase based. > > Regards, > WW
I already sent you some scripts to do it off-group. I am puzzled about this though. If you looked at the mail archives, there is Seahorse for Gnome users: http://www.gnome.org/projects/seahorse/ I must confess I am baffled by your statements. 1. Creating a key, any key, without a pass-phrase is less safe (I am thinking of something like SSH or SSL) than with a pass-phrase. If you use the default key with SSH or SSL, all that is necessary is to get the key you are using. Once I can do that I can pretend to be you. But if you have a pass-phrase, even if they steal your key, they still need the pass-phrase to pretend to be you. How is that less secure? 2. A key is just a key. Hypothetically, if gpg didn't complain about you not having a key you could hypothetically use gpg to do all of the symmetric encryption you want, but even there, a pass-phrase (which SHOULD be different than the pass-phrase bound with your key) is a good thing, not a bad thing. If you encrypt a file without a pass-phrase, then I can use gpg to decrypt your file and do the same thing you did - don't use a passphrase and voila, the file you encrypted is decrypted for me without me having to type anything other than the decrypt command. 3. Your key is primarily used to sign things and for ASYMMETRIC encryption, not symmetric encryption. By asymmetric encryption I mean stuff you send to others in email, using their public key to encrypt a message you send to them. Then only they can decrypt it using their secret key (which again requires they use their pass-phrase). When you sign a file or a message you send to them, you again must use the pass-phrase bound to your secret key when you to achieve the signing. Would you want me to steal your key, sign a message to your boss and send it to him telling him that he is a dirty scum-bag? Without a pass-phrase, that is entirely possible. With a well designed pass-phrase, even if I steal your key it makes it very hard if not impossible for me to pretend to be you (and get you in hot water). I can't do it without knowing the pass-phrase that must be used with your key. I am trying to understand how a machine key that is used with something like SSL used without a password is SAFER than something encrypted WITH a password. Every extra thing you can add for verification (and a pass-phrase is one of them), security is enhanced, not downgraded. HHH PS Even the NSA has big problems with a symmetric cipher like TWOFISH or AES256. The weakness isn't the algorithm. The weakness if there is one is a BAD or even worse NO encryption PASS-PHRASE. In fact, if you use no pass-phrase with symmetric encryption, you may as well not even encrypt the file at all. _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users