Thanks very much for your detailed reply which was very helpful. On Mar 6, 2013, at 12:57 PM, Peter Lebbing <[email protected]> wrote:
> On 05/03/13 19:52, Phillip Gardner wrote: >> gpg2 --symmetric --force-mdc --cipher-algo AES256 backup20130405.tar > >> Is it a problem using the same key when encrypting multiple files which will >> all be stored together? These files were very similar in content prior to >> being encrypted. > > 1) It is irrelevant that the files were similar. The passphrase you choose is > used to encrypt a random session key, and the random session key encrypts the > data. So the passphrase never "comes into direct contact" with the data > cryptographically. > > 2) While in theory there are attacks thinkable that can exploit the fact that > the passphrase is the same each time, the passphrase is also salted before > being > used as keying material, so the actual key used changes each time. The > material > being encrypted also changes each time (the random session key with an > algorithm > specifier prepended), and is very small. > > I doubt an attacker would gain something by having multiple Symmetric-Key > Encrypted Session Key packets all created with the same passphrase. But some > of > the experts here might know a sweet attack. Or some of those nasty experts > that > don't share it here but rather go after your data. > > I think you're safe. But why don't you just create a keypair and encrypt to > yourself? It does obviously mean you should have a good backup of it > somewhere, > outside Florida, even though you love in Florida. Spread the love! ;) > > There is the slight thingy that someone can replace your encrypted data with > other, also correctly decrypting data, since your public key is usually > public. > So you should sign then too if you're worried about that. > > HTH, > > Peter. > > -- > I use the GNU Privacy Guard (GnuPG) in combination with Enigmail. > You can send me encrypted mail if you want some privacy. > My key is available at <http://digitalbrains.com/2012/openpgp-key-peter> _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
