Encrypted Private Keys in OpenPGP
Generally in OpenPGP and specifically also in GnuPG, private keys can be encrypted with a symmetric key derived from a passphrase. For deriving the symmetric key (session key), a string-to-key function is used. Usually the Iterated and Salted S2K is used:
The salt is combined with the passphrase and the resulting value is hashed repeatedly.
The other methods include a simple hash and a salted hash. The hashing algorithm can also be chosen -- while MD5 is allowed, it shouldn't be used as it is considered weak. Also the symmetric encryption algorithm can be chosen, while the defaults depend on the implementation of OpenPGP you use.
You probably fetched up information for old versions of PGP, which only used plain MD5:
Older versions of PGP just stored a cipher algorithm octet preceding
the secret data or a zero to indicate that the secret data was
unencrypted. The MD5 hash function was always used to convert the
passphrase to a key for the specified cipher algorithm.
Exporting Encrypted Private Keys without Entering the Passphrase
If Kleopatra is able to export the private key anyway, several reasons might exist:
- it exports the encrypted copy of the private key,
- the passphrase for the key is stored in
gpg-agent
or
- the passphrase is stored somewhere else (which Kleopatra doesn't, but other graphic keyring managers do, like the GNOME keyring).