Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read a lot of articles about using gpg to encrypt email, but I would like to use it to encrypt some files - mainly a bunch of *.isos. I'm going to describe what I thought I would do, so you can shoot me or just add some suggestions.

I'm going to do

tar -cvjf myiso.iso.tar.bz2 myiso.iso

and them I plan to encrypt this myisio.tar.bz2, using a key generated by gpg (don't know exactly how to do that. I'm going to read the man page). Them, I'm going to save this generated gpg key I used for this encryption in a flash drive, and encode this key itself with a symetric key.

Is it to insane?

share|improve this question
The GPG key will already be protected by a passphrase, which I guess is used to symmetrically encrypt it anyway. (But there might be legal situations that may make another round of encryption useful.) – Ulrich Schwarz Nov 3 '11 at 6:20

You can use GPG to symmetrically encrypt a file with a passphrase (gpg -c). If the passphrase has enough entropy, you don't need an extra step of generating a secret key. What does “enough entropy” mean? Your encryption needs to withstand offline attacks, where the attacker can make cracking attempts as fast as his hardware allows it. With a small PC farm, the attacker might be able to make a couple hundred billion attempts per second, which is roughly 2^69 per decade. So with an entropy of 2^70 you'll be safe. That means if your passphrase consists of completely random letters (lower or upper case) and digits, it should be 12 characters long.

Now to store that passphrase, you can use GPG with its usual key pairs. Use gpg --gen-key to generate a key pair, and gpg -e to encrypt the passphrase used to encrypt the large file for one or more key pairs.

Here's a sketch on how to do the encryption (note that I avoid putting the passphrase on the command line or in the environment, so as to make sure another user can't find it by looking at the ps output while the command is running):

passphrase=$(pwgen -s 12 -1)
echo "The passphrase for myiso.iso.gpg is: $passphrase" |
gpg -e -r somebody -r somebodyelse >passphrase.gpg
echo "$passphrase" | gpg -c --passphrase-fd 3 3<&0 <myiso.iso >myiso.iso.gpg

and how to decrypt:

passphrase=$(gpg -d <passphrase.gpg)
echo "$passphrase" | gpg -d --passphrase-fd 3 3<&0 <myiso.iso.gpg >myiso.iso

The reason to use a passphrase (a shared secret) rather than directly encrypt is that it allows the file to be shared between several people. Only the small passphrase needs to be reencrypted if you want to add a recipient (removing a recipient only makes sense if you know the recipient hasn't had access to the plaintext and requires reencoding the ciphertext anyway).

share|improve this answer
Need to remove "e" from "-ec" otherwise you get a prompt for a user id. More details: superuser.com/questions/354890/… – Andy Smith May 13 '13 at 20:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.