2

I started to reverse engineer the ProtonMail system a bit and noticed that ProtonMail keeps all the ASCII armored private keys in their plain text form on their servers, and the only thing protecting them is the standard defined OpenPGP integrated passphrase protection.

More information here.

Now, ProtonMail claims they keep the key encrypted on their servers, but based on network traffic sniffing, I was able to recover my secret key that the server returns in plain text and I was able to import it into GnuPG.

Is a PGP secret key considered compromised if it reaches the internet unencrypted, ASCII armored, passphrase protected?

  • "unencrypted, ASCII armored, passphrase protected" - What makes you think the key is unencrypted? – Arminius Mar 26 '17 at 19:41
  • "Unencrypted" as in, not another layer of encryption. Like taking the PGP armored key and encrypting it with AES. – Gala Mar 26 '17 at 19:43
  • But that's what it is - encrypted. That's why you get the password prompt. – Arminius Mar 26 '17 at 19:44
  • 3
    I'm not sure what your point is. The secret key is AES-encrypted with your mailbox password, even if it looks to you like an unencrypted key. So you don't get the plain key from sniffing the traffic. The guys on reddit explained that pretty well. – Arminius Mar 26 '17 at 19:48
  • 1
    Let us continue this discussion in chat. – Arminius Mar 26 '17 at 19:51
2

Here's a different take: All the encryption in the world doesn't matter if the password is brute-forceable.

You should assume the key is compromised if the time since it was made available is longer than feasible time to crack the password.

Even that only creates an upper-bound to it's security, any weaknesses in the password and encryption implementation will reduce the time to compromise.

In short - yes assume it is compromised; then decide what that means for you. If it's just that someone could read emails full of gossip, probably not an issue. If it's used for securing legally protected information then revoke the keys, generate new ones (with new password) and rebuild your trusts.

Unfortunately PGP doesn't offer forward secrecy, so any historic emails encrypted to those released keys have eternity to be brute-forced; that data is no longer private.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.