How to check s2k prefs on a key?

[Matt Vance [e-mail] [PGP-Basics]]

I recently built gnupg from source and have been changing some preferences. Some of the preferences I would like to set are related to s2k. As an example, this is similar to the command I used to set these preferences.

gpg --interactive --s2k-cipher-algo AES --s2k-digest-algo SHA512 --s2k-mode 3 --s2k-count 65000000 --edit-key 0xMyKeyID

After running this command, however, I do not know how to tell if the preferences I have set were applied. The shell did not provide any confirmation message. I also could not find any way to check the s2k settings applied to my key. I checked the man page and searched online.

1.) How can I view the s2k settings associated with a key?

2.) If there is not a way to view those settings, how can I be certain they were applied correctly?

3.) Is the command example I provided above accurate?

Thank you to everyone who participates on this group and also who help folks like me.

Matt

['Robert J. Hansen' [e-mail] [PGP-Basics]]

Post by Matt Vance ***@yahoo.com [PGP-Basics]
gpg --interactive --s2k-cipher-algo AES --s2k-digest-algo SHA512
--s2k-mode 3 --s2k-count 65000000 --edit-key 0xMyKeyID

That's ... a really annoyingly high s2k-count number, especially if you
use a reasonably strong passphrase. The default s2k, at least as of a
couple years ago (I haven't checked since), is 65,000-odd iterations.

You're talking about increasing that by a factor of a thousand. That'll
slow down a passphrase brute-forcer, sure, but it's also going to slow
down anything that requires you to unlock your certificate. And God
help you if you ever decide to try and use this certificate on a
smartphone or mobile device.

Your best bet is to use a strong passphrase and a good hash algorithm.
With those two on your side, s2k-count is pretty much irrelevant.


------------------------------------

------------------------------------

______________________________________________________________
Archives: http://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe: mailto:PGP-Basics-OT-***@yahoogroups.com
Gossamer Spider Web of Trust http://www.gswot.org

[Matt Vance [e-mail] [PGP-Basics]]

Thank for the reply Robert. I realize this is a very high s2k-count number, especially since I plan to use a strong passphrase. While I may change this to a lower count if it becomes unreasonable slow for my workflow, I am still curious as to how I can confirm the command I entered worked. Is there a way to view the s2k settings associated with a key?

Thanks again,
Matt

['Robert J. Hansen' [e-mail] [PGP-Basics]]

Post by Matt Vance ***@yahoo.com [PGP-Basics]
entered worked. Is there a way to view the s2k settings associated with
a key?

The only one I'm aware of is a kind of kludgy hack, but okay.

gpg --export-secret-key [keyID]|gpg -vvvv --import|grep "protect count"



------------------------------------

------------------------------------

______________________________________________________________
Archives: http://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe: mailto:PGP-Basics-OT-***@yahoogroups.com
Gossamer Spider Web of Trust http://www.gswot.org