Is GnuPG symmetric encryption vulnerable to brute force attacks on the passphrase?

Question

The handbook suggests that symmetric encryption is appropriate (and therefore not less secure than public key encryption?) when only you need to access the plaintext. But according to this post, since gpg --symmetric only requires a passphrase, an attacker only needs to brute force this passphrase rather than the full 128/256 bit key generated from it.

It seems to me that the correct procedure then is to actually have a 128/256 bit key file which is used to symmetrically encrypt my data; which itself is symmetrically encrypted with a key generated from a passphrase, just like how private keys are protected. This would require an attacker to brute force the full symmetric key- even if they acquired my key file, they would still have to brute force my passphrase.

Does gpg support this sort of usage? Is my understanding of the situation flawed, is there a reason why this isn't a valid use case?

--

Or to put it another way:

In this question it is assumed that passphrase protection is sufficient- but basically my question is what if I don't trust myself to memorize a good 256 bit password? Can I use a symmetric key file just like with my private key? Obviously I could just actually use my private key, but the handbook suggests that the symmetric encryption would be the idiomatic choice in this situation.

Answer 1

In OpenPGP, there are two possibilities allowed for deriving the symmetric (session) key from the passphrase: directly using the passphrase to derive the key, or generating a random key which is itself encrypted with the generated key. Yet, in both cases the symmetric key is always stored together with the cipher text and symmetric key cannot be split apart without losing compatibility with the OpenPGP format. In the end, the key can also be brute-forced through the passphrase, no matter which kind of storing the key is used.

OpenPGP makes brute-forcing the passphrase hard though, though, by generating a large input to be hashed (iterating the passphrase multiple times for the hash input). This way brute-forcing the passphrase is much more expensive. From RFC 4880, OpenPGP, 3.7.1.3. Iterated and Salted S2K:

This includes both a salt and an octet count. The salt is combined with the passphrase and the resulting value is hashed repeatedly. This further increases the amount of work an attacker must do to try dictionary attacks.

In GnuPG, the number of times to repeat the passphrase (and some other options) can be tweaked using the --s2k-* options.