7

I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key?

Essentially, the question breaks down to: If someone stole my private key, could they use it without knowledge (or breakage) of my password?

3 Answers 3

11

It is possible to leave your PGP key unencrypted (no password), and thus if it were copied it could be used without a password. Encryption of your private key is inherent to the specification (RFC 4880 -- see "String-to-Key" sections), and anytime you're using software that asks for the passphrase for your private key, it is using that for actual decryption. Most modern versions of the software take pains to also avoid allowing the memory used for the unencryped key or passphrase to be swapped to disk.

So no, your private key cannot be used without knowledge or breakage of your password.

4
  • So, what you're saying is that the private key itself is un-protected plaintext but the OpenPGP specification requires that it be stored encrypted?
    – Iszi
    Jun 3, 2011 at 18:53
  • 1
    The OpenPGP specification allows for envelope metadata to tell how a private key is encrypted. Keys can be stored with no passphrase. Since you're using a passphrase, your key is encrypted. To be used, your key has to be decrypted in RAM.
    – Jeff Ferland
    Jun 3, 2011 at 18:57
  • ... and then we had this whole discussion in the chat for the site where I created a key just for example usage which demonstrated this.
    – Jeff Ferland
    Jun 3, 2011 at 20:52
  • 1
    @Gilles - You know, you could just link the whole conversation, like here: chat.stackexchange.com/rooms/151/conversation/…
    – Iszi
    Jun 4, 2011 at 15:50
3

The OpenPGP message format describes many "messages" which are the serialization of structures involving cryptographic algorithms. Some of those messages are meant to be exchanged as emails; when you send a "signed email", you must use your private key. The resulting message (the one which goes to the SMTP server) is not impacted by how the said private key is formatted when stored on a non-transient medium. In that sense, you can "use OpenPGP" (send and receive signed and encrypted emails) without having to store a "password-protected" private key; what OpenPGP requires is that a use can "own" a private key and "remember" it for non-trivial amounts of time. The private key itself should be stored with a high level of confidentiality, since such confidentiality is crucial for the whole security of the scheme. The user private key is often stored in a file, encrypted with a symmetric key derived from a user password ("passphrase" in PGP-speak). Less often, but equally valid, could the private key be stored in a tamper-resistant device such as a smartcard, and accessed through a dedicated API such as PKCS#11; support for PKCS#11 exists for GnuPG. How the device stores the key is up to the device but rarely involves encryption with a password-derived key.

OpenPGP also defines message formats for storing a serialized private key, in particular with symmetric encryption using a key derived from a password. Therefore, when an OpenPGP implementation wishes to store a private key as a file with password protection, it tends to use that specific message format. Using this format allows for transferring private keys ("key rings") between distinct implementations.

So while password-protection of private key is not a mandatory requirement for claiming "OpenPGP support" as far as on-the-wire messages are concerned, it is still recommended, and there is an "OpenPGP-approved" way of doing that password protection, which has portability benefits and is followed by actual implementations.

2

Don't overlook gpg-agent...

Jeff's answer is good and covers what you were mostly talking about. But your first sentence overlooks the fact that there are ways to use your OpenPGP key without entering a password for each use. It lets you enter it once, and then use it for a little while, stored unencrypted in RAM. The default "ttl" (time to live) is conservative: 5 minutes. As @gilles notes that adds some risk, but it should still not appear on disk unencrypted. gpg-agent came as part of gnupg 2.0, and is intended for GUI apps. See gpg-agent: Invoking GPG-AGENT - Using the GNU Privacy Guard, which can also handle the SSH key access tasks that ssh-agent does.

1
  • 2
    True, but a little confusing in the context of the question. To clarify, programs such as gpg-agent make a decrypted copy of the private key in RAM; the on-disk file remains encrypted (if the key has a passphrase). Thus the security cost of gpg-agent is exposing your key to someone who can grab a copy of your RAM (e.g. sophisticated laptop thief), but not to someone who can only get the disk contents (e.g. most laptop thieves). Jun 4, 2011 at 10:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .