Should I really keep my private gpg key secret if it's protected by a passphrase? What if an adversary stole it? And if it didn't have a passphrase, would it be game over for me?
Update:
What to do if my private key is stolen?
Since it's easy to crack a passphrase, does it make any difference if it has or not a passphrase if and only if private key is stolen?
Looks like there's three questions here:
1) You should keep your private GPG key secret despite its passphrase. Your passphrase is a lot easier to crack than the private GPG key, so even having the passphrase-encrypted private key makes it potentially easier for an adversary.
What the passphrase does is apply a layer of symmetric encryption to the keyfile, so the local computer needs that passphrase to open it.
2) If an adversary stole your passphrase-encrypted keyfile, they can try to brute force the passphrase (which is far simpler than brute forcing a 2048 or 4096-bit RSA key, even with a super-complex password); or attempt a password re-use attack (check known dumps for your previous passwords). A strong, unique passphrase could make these attacks unfeasible.
3) If you didn't have a passphrase and that private key file was copied from you, that key would be fully compromised and someone could decrypt your previous GPG-encrypted communications (provided they had access to the encrypted copy), et cetera depending what the key was used for. With a strong and unique passphrase, you have a second line of defense that could potentially stop such a compromise in its tracks.
In conclusion, it's always a best practice to secure your private keys with a strong, unique passphrase. Any passphrase makes it a lot harder to compromise the private key, and one that is strong and unique might be implausible for an adversary to ever crack.
