Thanks to all for offering help. I think I did not describe clearly what I need (actually for one of my friends).
Let me know if what I intend to do make no sense. The data to be protected resides on a fixed harddisk in a Windows computer. I have a tool on Windows platform that does encryption using either a passphrase or a key file. Use of a key file is recommended as it is more secure (assuming passphrases can be cracked relatively easily). The key file is expected to be stored separately in a removable disk. So I need a tool to create a key. I checked a few key tools such as java keytool and gpg, but their genkey option does not support the generation of a symmetric key/cipher. I read the script you (Henry) sent me. Though it does show how to do symmetric encryption, I don't see how it produce a symmetric cipher. Basically, I need to do the job in two steps: 1. create a symmetric key 2. encrypt/decrypt using the key Regards, Wei -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Henry Hertz Hobbit Sent: Tuesday, November 14, 2006 7:00 PM To: [email protected] Subject: Re: how to create a symmetric cipher On Tue, 2006-11-14 at 16:01 -0600, [EMAIL PROTECTED] wrote: > Thanks. > > Well, my ultimate goal is to encrypt data, but I don't want to use > passphrase to do it as I believe it is not secure enough. > > So my questions are: > > 1. How to create a symmetric key or cipher? With that, I may use another > tool to encrypt/decrypt. > > 2. Can gpg be used to do key based encryption? Not passphrase based. > > Regards, > WW I already sent you some scripts to do it off-group. I am puzzled about this though. If you looked at the mail archives, there is Seahorse for Gnome users: http://www.gnome.org/projects/seahorse/ I must confess I am baffled by your statements. 1. Creating a key, any key, without a pass-phrase is less safe (I am thinking of something like SSH or SSL) than with a pass-phrase. If you use the default key with SSH or SSL, all that is necessary is to get the key you are using. Once I can do that I can pretend to be you. But if you have a pass-phrase, even if they steal your key, they still need the pass-phrase to pretend to be you. How is that less secure? 2. A key is just a key. Hypothetically, if gpg didn't complain about you not having a key you could hypothetically use gpg to do all of the symmetric encryption you want, but even there, a pass-phrase (which SHOULD be different than the pass-phrase bound with your key) is a good thing, not a bad thing. If you encrypt a file without a pass-phrase, then I can use gpg to decrypt your file and do the same thing you did - don't use a passphrase and voila, the file you encrypted is decrypted for me without me having to type anything other than the decrypt command. 3. Your key is primarily used to sign things and for ASYMMETRIC encryption, not symmetric encryption. By asymmetric encryption I mean stuff you send to others in email, using their public key to encrypt a message you send to them. Then only they can decrypt it using their secret key (which again requires they use their pass-phrase). When you sign a file or a message you send to them, you again must use the pass-phrase bound to your secret key when you to achieve the signing. Would you want me to steal your key, sign a message to your boss and send it to him telling him that he is a dirty scum-bag? Without a pass-phrase, that is entirely possible. With a well designed pass-phrase, even if I steal your key it makes it very hard if not impossible for me to pretend to be you (and get you in hot water). I can't do it without knowing the pass-phrase that must be used with your key. I am trying to understand how a machine key that is used with something like SSL used without a password is SAFER than something encrypted WITH a password. Every extra thing you can add for verification (and a pass-phrase is one of them), security is enhanced, not downgraded. HHH PS Even the NSA has big problems with a symmetric cipher like TWOFISH or AES256. The weakness isn't the algorithm. The weakness if there is one is a BAD or even worse NO encryption PASS-PHRASE. In fact, if you use no pass-phrase with symmetric encryption, you may as well not even encrypt the file at all. _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
