Why would a public key have a passphrase?

Question

Last week I wrote to my bank with a general question. Today I received an email inviting me to join their "Secure Email (PGP) system". It made clear I'd have to join to read their response to my question.

You have received an encrypted email:
From: $CST1, Mailbox
Subject: Your pension fund enmquiry Ref CF-123456
This is the first time you have received encrypted email from Lloyds Banking Group so you will need to set up a password (also referred to as a passphrase) to access this email and any future encrypted emails that you receive from us. Lloyds Banking Group takes online security very seriously.

Reluctantly, I followed the link to sign up, inventing an account password. I duly received a passworded PDF by email, with the response to my question.

Out of curiousity, I explored the rest of the site, which appears to run "Symantec Web Email Protection". On the settings page, I saw it gave a choice how the bank would encrypt messages to me; either as passworded PDF documents or with public key cryptography.

I have an OpenPGP Key or digital ID/certificate (X.509, S/MIME) that I want to use to secure messages I exchange with site [sic].

Following to the next page:

If you already have a key or certificate, you may upload it and we will encrypt your messages to it.

You may upload any of the following: a PGP key (.asc), X.509 Certificate (.pem, .crt, .cer), or PKCS#12 file (.p12, .pfx).

Optional: If your key file has an associated passphrase, please enter it.

That last line surprised me. I've used public key cryptography in OpenSSH and GPG. As I understand, private keys can have passphrases, but not public keys. The purpose of a passphrase is to protect your key on your computer; like the private key, it should be kept secret.

Why would a public key have a passphrase? What's the point of a passphrase if you share it with your correspondents?

Answer 1

I think they're just trying to be user-friendly, in the worst possible way. PKCS#12 files (.p12 or .pfx) are used for key pairs - both the public and private parts - and the private part will be encrypted. The bank never needs, nor should ever see, the private key! Consequently, they shouldn't even accept such files - just the .der or .cer or .pem or .crt for the X.509 certificate (which only contains the public key) to use S/MIME, or the .asc or sometimes .pub PGP public key (of course, a .asc file can contain anything, but we'll hope the user wasn't stupid enough to export their private key) - and definitely shouldn't ask for a passphrase.

Anything that the bank needs a passphrase for, that means the user uploaded the wrong file. Public keys do not have, and do not need, passphrases. That's presumably why the field is optional - anybody using the form correctly will not have a passphrase on the file they upload, because they'll be uploading a public key (only) - but it's still absolutely abysmal design on the part of the bank.

With that said, good on them for supporting secure email at all. My bank still think that (trivially wire-tappable) fax machines and (easily-stolen) snail-mail post are the height of secure remote communications.

Answer 2

The system they describe in their Documentation is not the standard way of using PGP. They use some extra PDF encryption on the way, so without knowing exactly every step they use, it is hard to tell which "associated passphrase" they are talking about there.

I think they don't mean a passphrase of your public key-file, but rather of some other key file you have to create in this complex PDF encryption process they use there.

Another interpretation could be, that some very unexperienced users use their GPG program and export their private and public keypair in one file and send this whole file to the bank. Although this is the worst thing that can happen to someones private key, it would still be harmless, if that key is only created and used with that bank. So maybe in this case the bank could only open the keypair knowing the password to extract the public key?
Note: If they would do this without informing the user that they could know their private key now, I would change the bank ;-)

Answer 3

Nowhere in their documentation does it make any reference to private vs public key, so I'm immediately suspicious. In my experience, many people get very confused about the difference (e.g., "So I send you the private key so you can encrypt privately just to me right?"). I'm not aware of any PGP key having a passphrase on the public key.

So I would suspect that some users are sending in their private keys and the author of the document couldn't open them so started asking for the passphrase, not knowing they are different.