Question for GPG knowledgeable;
GPG symmetric encryption of the wallet.dat with Blowfish algo, i.e.
$gpg --cipher-algo BLOWFISH -c wallet.dat
is how much different than just using bcrypt?
(Besides that gpg doesn't wipe the raw file off the disk as bcrypt does.)
Any program that uses that algorithm properly should be secure, but you have to look at the details.
The encryption algorithms work with binary keys that must be random to ensure security. If you encrypt a file, you usually do it with a password. A password is not a secure key in that sense, so the algorithm also has to derive a binary key from the password where each bit has a probability of 0.5.
Example:- you have a file and want to encrypt it with AES256
- AES256 needs a 256 bit random key
- you choose a strong password of 12 ascii characters
Problem:
- your password is only 12 * 8 = 96 bits long
- the most significant bit of each byte is 0, because it's ASCII
- because of that, you should not use your password as AES key directly
There are different solutions now, and they really matter. That's why I would prefer GPG: It has been around for a long time, it is well tested, and the authors are experts who know the state of the art methods to derive keys from passwords.
I have looked at 7z and they seem to use a good key derivation method, too. That was the point I was skeptical about. It could be that compression tool programmers don't care so much or are just not that well informed about state of the art techniques in the crypto community.
