0

The gpg software supports symmetric encryption out of the box. That means, it works with a password. But apart from protecting the content it is also important to ensure the Authentication of a message. The idea is to create a hashsum of the file itself together with the password used for encryption. According to [1] a popular “Message Authentication Code” is HMAC. After entering:

gpg --hmac --armor --symmetric --passphrase pwd1 file.txt

gpg: Invalid option "--hmac"

an error message occurs that the switch is not known by the software. How can i use the MAC authentication the right way?

Manuel Rodriguez
  • 734
  • 4
  • 18

1 Answers1

0

You can't. The reason for the error message is that type of signature is not available with GPG. You'd be better off simply signing and encrypting the file with the standard GPG method. Even if you wanted to use symmetric encryption only, then the recipient would still need to use GPG to decrypt the file. The correct command would be:

gpg -o filename.txt.asc -sear $recipient_key filename.txt

This assumes you also always encrypt to your own key, otherwise the command would be:

gpg -o filename.txt.asc -sear $recipient_key -r $your_key filename.txt

If they don't have a key, you could still sign and encrypt to your own key only and then extract the session key so you could provide that for them to decrypt the file with it:

gpg -o filename.txt --show-session-key -d filename.txt.asc

Then the recipient would be able to decrypt with:

gpg -o filename.txt --override-session-key $session_key -d filename.txt.asc

If you really must use symmetric encryption only, however, you can do it in two setps.

First sign the file:

gpg -o filename.txt.asc -sa filename.txt

Then symmetrically encrypt that file:

gpg -o newfilename.asc -a -c filename.txt.asc

The recipient would then need to run the decryption command twice; first on the symmetrically encrypted file and then a second time on the file it decrypts.

The normal --verify option is only used for checking clearsigned files or files with detached signatures.

Ben
  • 3,981
  • 2
  • 25
  • 34