Once a key pair has been revoked, is it still possible to decrypt messages that were previously encrypted?

What if the key is / isn't protected with a strong passphrase?

From what I understand, it is possible since the private key is not modified (or is it?) when revoked. Even if the private key is modified, the numbers making up the private key can be extracted and thus possible to create a new, non-revoked key that can be used to decrypt the messages.

Quoted from https://emailselfdefense.fsf.org/en/

If you lose your private key or someone else gets ahold of it (say, by stealing or cracking your computer), it's important to revoke it immediately before someone else uses it to read your encrypted email or forge your signature.

1 Answer 1


A revocation doesn't actually change the key - it simply signals others, that they are no longer trustworthy - if the private key has been stolen - or functional (i.e. the receiver is unable to decrypt any messages any longer) - if the private key is lost.

As long as you're in possession of the private key, you can decrypt anything encrypted with the corresponding public key - in fact anyone in possession of the private key can do that.

A passphrase is just a means of protecting the private key by encrypting it - for example if somebody copies the key file.

  • So does that mean it is still possible to decrypt messages after the key pair has been revoked? If so, then is the bold part of the quote misleading and / or incorrect?
    – J C
    Dec 26, 2016 at 3:13
  • @JC it's still possible to decrypt old messages encrypted with this key pair. However people should now stop sending you mails encrypted with this key pair, so this will stop attackers from reading messages sent encrypted to you from now on (either people don't send you messages that have to be encrypted anymore, or they do so using a new key pair that hasn't been compromised). Dec 26, 2016 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .