Symmetric Encryption & Decryption

What Is Symmetric Encryption?

Symmetric encryption is a method of securing data where the same password is used to both encrypt and decrypt information.

Unlike asymmetric encryption, which uses a public/private key pair, symmetric encryption relies on a single shared secret (the password). This approach is:

• Fast and efficient
• Ideal for large files or quick one-time sharing
• Best used when both parties can safely share the password

If someone intercepts the password, the encrypted data is no longer secure. Therefore, please always use strong, unique passwords and share them securely.

How It Works

1. You choose a strong password.
2. That password is used to encrypt the data.
3. Anyone with the same password can decrypt it.
4. No key pair is required, but only the shared password.

Encryption security depends entirely on the strength and secrecy of the password used.

Encrypting Data Symmetrically

To encrypt text using symmetric encryption in GpgFrontend (v2.1.9 and later):

Enable Symmetric Encryption Feature

1. Open Settings and choose Appearance.
2. Under Toolbar, in the Actions list, tick Sym. Encrypt.

Access the Symmetric Encryption Button

After enabling, you’ll see a dedicated Sym. Encrypt button on the main interface.

Enter the Text or Select a File

• Input the plaintext you wish to protect in the text editor.
• Select a file to encrypt using the file panel.

Symmetric Encryption

1. Without selecting any public key, click the Sym. Encrypt button.
2. When prompted, enter a strong, unique password.
3. This password becomes your encryption key.
4. The text or file will be encrypted into ciphertext.
5. You can save or share the encrypted result.

The recipient will need the exact same password to decrypt the message.

Decrypting Symmetric Encrypted Data

To decrypt content that was encrypted symmetrically:

1. Paste the Ciphertext: The message should begin with -----BEGIN PGP MESSAGE----- and end with -----END PGP MESSAGE-----.
2. Initiate Decryption: Choose to decrypt the message.
3. Enter the Password: Input the same password that was used for encryption.
4. View the Plaintext: If the password is correct, the original message will be revealed.

If the password is incorrect or mistyped, decryption will fail.

Technical Details: GnuPG vs rPGP

Symmetric encryption produces an OpenPGP message protected by a passphrase instead of a public key. The passphrase is run through an OpenPGP String-to-Key (S2K) function to derive the actual symmetric key, and the data is then encrypted with a symmetric cipher. How this is done depends on the active engine, and it directly affects which tools can decrypt the result.

Aspect	GnuPG engine	rPGP engine
Implementation	gpgme_op_encrypt_symmetric (GnuPG decides the details)	rPGP, fixed parameters
Symmetric cipher	GnuPG default, typically AES-256 (configurable)	AES-256
Data packet	GnuPG default (SEIPD; may use AEAD on newer GnuPG)	SEIPD v1 (CFB with an integrity check)
Key derivation	Iterated-and-salted S2K by default (configurable)	Argon2id S2K (memory-hard)
Interoperability	Broad; readable by most OpenPGP tools	Requires an RFC 9580 / Argon2-aware tool

GnuPG Engine

With the GnuPG engine, GpgFrontend asks GnuPG to perform the symmetric encryption, so the cipher, S2K function, and packet format follow your GnuPG version and configuration (for example, s2k-cipher-algo, s2k-digest-algo, and s2k-count in gpg.conf). Current GnuPG defaults to AES-256 with an iterated-and-salted S2K, which is widely understood by other OpenPGP implementations. Newer GnuPG versions may use AEAD (OCB) when configured.

rPGP Engine

With the rPGP engine, the parameters are fixed: the message is an SEIPD v1 packet encrypted with AES-256, and the passphrase is stretched into the symmetric key using an Argon2id S2K. Argon2 is a memory-hard function, which makes brute-forcing a weak passphrase considerably more expensive than the classic iterated-and-salted S2K.

rPGP symmetric output needs a modern tool

Argon2 S2K is part of the modern OpenPGP standard (RFC 9580). A message that rPGP encrypts symmetrically can only be decrypted by an rPGP-aware or otherwise RFC 9580 / Argon2-capable tool. Older GnuPG versions that do not support Argon2 S2K cannot decrypt it. If you need the widest compatibility, encrypt symmetrically with the GnuPG engine instead.

When encrypting symmetrically with rPGP, GpgFrontend always prompts for the passphrase fresh (the passphrase cache is bypassed) and asks you to confirm it, to avoid accidentally encrypting with a mistyped password.

When to Use Symmetric Encryption?

Symmetric encryption is a great choice when:

• You’re encrypting something for yourself (e.g. storing private notes or backup files).
• You’re sharing data over a secure channel, and can safely provide the password.
• You don’t want to manage public/private key infrastructure.

However, it is not ideal for public communication where secure password exchange is difficult.

Tips for Better Security

• Always use a strong, complex password (longer is better).
• Never send passwords through insecure channels (e.g., unencrypted email).
• Consider using symmetric encryption as a supplement to public-key encryption e.g., encrypt a file symmetrically, then encrypt the password with the recipient’s public key.