Purpose of --s2k-cipher-algo switch

MindFuq mindfuq@comcast.net
Thu Oct 17 17:59:02 2002


* Timo Schulz <twoaday@freakmail.de> [2002-10-17 08:23]:
> 
> > I should be able to do that using this command:
> > 
> >   gpg --clearsign --cipher-algo RSA text_msg
> > 
> > but I get an error:
> > 
> >   gpg: selected cipher algorithm is invalid 
> 
> You *can't* select the asymmetric cipher for the message! How shall
> this be possible? It would mean GPG needs to create a key pair in
> time and where is it stored and a lot of more questions.
> 
> 
> The key pair has an algorithm and this algorithm is always used.
> I mean a key generated with --gen-key...

I'm starting to realize this.  It seems --cipher-algo and
--s2k-cipher-algo both specify the symmetric key.

I was thinking that a key is just a block of random bits, and as long
as the key is large enough, any algorithm should be able to use it.
And this is probably true of symmetric ciphers, but I overlooked the
fact that every asymmetric algorithm expects to find numbers from each
key that satisfy an equation.  Since the equation is different for
every cipher, a key pair must only work for a specific
equation.. Unless someone is clever enough to make one that works in
multiple algorithms.

Now I'm trying to make sense out of the --s2k-cipher-algo switch.
It's described as the "cipher algorithm used to protect secret keys."
Since the secret (symmetric) key is encrypted with the public
(asymmetric) key, there should be no way to select the algorithm to
protect the symmetric key.  It should then be forced to use the
algorithm the public key is bound to.  Then it lists BLOWFISH as a
default, which is not an asymmetric algorithm.

I'm suspecting that the developers meant something different.
Generally the accepted terminology in crypto is as follows:

  secret key = symmetric key
  private key = secret asymmetric key
  public key = public asymmetric key

I've noticed a few places where the GPG docs use "secret key" when
they mean "private key."  It's looking like that may be what the
developers did when documenting the --s2k-cipher-algo switch.  

So are we saying that the --s2k-cipher-algo switch enables me to
choose which symmetric algorithm uses my password to encrypt my
private key?