Here is an example of how to securely encrypt files under GNU/Linux, using GNU Privacy Guard, with particular respect to revelations made about the NSA by Edward Snowden and others.

First some important points:

• Never use the AES (Rijndael) cipher algorithm
• Never use the SHA (any version) digest algorithm
• Never use any standard endorsed by NIST
• Never use any standard created, influenced or endorsed by the NSA
• Never use hardware random number generators manufactured either by US companies, within the US, or for the US
• Never use proprietary encryption software
• Never use server-side, certificate-based encryption

For background on why, please read the following:

• Silent Circle Moving Away From NIST Ciphers in Wake of NSA Revelations
• Revealed: how US and UK spy agencies defeat internet privacy and security
• “We cannot trust” Intel and Via’s chip-based crypto, FreeBSD developers say
• The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

Here's the tools you'll need:

1. Any GNU/Linux distro
2. A hardware random number generator (optional, but recommended) from a trusted, non-US source
3. A MicroSD card and USB adaptor (recommended, as it's very small and easy to hide), or USB thumbdrive
4. GNU Coreutils, GNU Privacy Guard and CLPBar

First insert (unmount if automounted) and format the MicroSD card or USB thumbdrive, ensuring that you back up its contents first, if any. Then mount it at e.g. /mnt/keys, and create a keyfile thus:

dd if=/dev/random iflag=fullblock ibs=1k count=1024 | \
   bar -s 1M | \
   dd of=/mnt/keys/keyfile

If you don't have a hardware-accelerated random number generator, you may wish to replace /dev/random with /dev/urandom, but this is less secure. Be aware that, without a hardware RNG device, keyfile generation could take days using random instead of urandom, but at least it's more secure. The choice is up to you.

Then unmount the keyfile storage device, physically remove it and hide it somewhere very secure. This step is extremely important, because if an attacker has your keyfile then it's game over, and you've completely wasted your time encrypting anything. Please also ensure that you have at least one backup of this keyfile in another, separate, secure location, in case you lose the other copy, because otherwise you will have completely lost access to your own encrypted files forever.

From that point on, any time you wish to encrypt anything, up to and including block-level encryption of an entire drive, you must retrieve your USB thumbdrive and/or MicroSD card from its secure location, insert it, mount it then use it thus:

gpg -c \
   --cipher-algo CAMELLIA256 \
   --digest-algo RIPEMD160 \
   --compress-algo ZLIB \
   --batch --passphrase-file /mnt/keys/keyfile {unencrypted input file}

To decrypt that file:

gpg -d --batch --passphrase-file /mnt/keys/keyfile {encrypted file} \
   >/dev/shm/{decrypted file}

Note: Always using /dev/shm as temporary storage for decrypted files, as anything else is insecure. Re-encrypt them and delete the unencrypted version (if applicable) as soon as possible, once you've finished reading and/or editing them.

Then repeat the process of unmounting, removing and hiding your keyfile storage device.

Good luck.