Modern alternative to GnuPG for symmetric encryption on Linux

Question

I'm looking for an alternative to GnuPG for symmetric encryption. Specifically, I want to encrypt short, secret files using a passphrase using Linux, and have them secured against modern attacks, such as parallelized brute-force attacks

The algorithms in GnuPG are not designed to withstand mentioned attacks, and parameters improve on this, like the --s2k-count are intentionally limited on a software level (see this answer).

It also has some other rather insecure defaults, like this one (from the docs)

gpg caches the passphrase used for symmetric encryption so that a decrypt operation may not require that the user needs to enter the passphrase

Meaning, that by default anyone with access to the shell can decrypt the file without knowing the passphrase while the password is still in cache from the encryption process.

What software is there that can encrypt a file with a passphrase and

• is readily available for linux distributions
• provides modern encryption mechanism (brute-force resistant)
• doesn't have insecure defaults?

Answer 1

Disclaimer: I'm the developer of one of the product (File Lock PEA) mentioned in this answer.

---

You are looking for a symmetric encryption tool that works on file level. The variety of programs with symmetric cryptography for Linux is, as far as I know, not that big and most of them use PBKDF2 which is not much better than s2k. You can check: AESCrypt CrocoCrypt File Lock PEA

However, I know or suspect that all these programs cache the key - although not the password -, because otherwise the usability would suffer a lot. You would have to enter the password again for each operation and - because the key derivation function has to be time-consuming - wait some time.

Answer 2

Look at the ccrypt package, which does file level encryption and doesn't cache the decryption key. Since it's scriptable, you can write a wrapper script which caches the key if you'd like or just use it directly as you wish.