On 05/03/13 19:52, Phillip Gardner wrote: > gpg2 --symmetric --force-mdc --cipher-algo AES256 backup20130405.tar
> Is it a problem using the same key when encrypting multiple files which will > all be stored together? These files were very similar in content prior to > being encrypted. 1) It is irrelevant that the files were similar. The passphrase you choose is used to encrypt a random session key, and the random session key encrypts the data. So the passphrase never "comes into direct contact" with the data cryptographically. 2) While in theory there are attacks thinkable that can exploit the fact that the passphrase is the same each time, the passphrase is also salted before being used as keying material, so the actual key used changes each time. The material being encrypted also changes each time (the random session key with an algorithm specifier prepended), and is very small. I doubt an attacker would gain something by having multiple Symmetric-Key Encrypted Session Key packets all created with the same passphrase. But some of the experts here might know a sweet attack. Or some of those nasty experts that don't share it here but rather go after your data. I think you're safe. But why don't you just create a keypair and encrypt to yourself? It does obviously mean you should have a good backup of it somewhere, outside Florida, even though you love in Florida. Spread the love! ;) There is the slight thingy that someone can replace your encrypted data with other, also correctly decrypting data, since your public key is usually public. So you should sign then too if you're worried about that. HTH, Peter. -- I use the GNU Privacy Guard (GnuPG) in combination with Enigmail. You can send me encrypted mail if you want some privacy. My key is available at <http://digitalbrains.com/2012/openpgp-key-peter> _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
