I generated a public/secret key pair with GnuPG. I know that the secret key must keep secret. However, I am wondering what are the risk to expose the secret key without the passphrase?

If Eve steals my laptop and can access to all my data, what are her abilities to use my secret key without knowing my passphrase?


The passphrase is the 'key' to use to your 'secret key'. You should keep your secret key file safe, but in case Eve stole your laptop, or your file, if there is no passphrase, she can use your secret key to decipher your secrets. If you copy your secret key file to a different computer, to use that file you will need your passphrase.

Lets say is and extra safeguard to make sure you are the one that should be using that secret key.

  • If I copy my secret key file on two different computers. Then, can I use two different passphrases by editing my secret key on each computer?
    – user160373
    Aug 29 '18 at 20:47
  • I think it is possible.
    – Hugo Glez
    Aug 30 '18 at 13:30

If you have a weak password, Eve can brute-force her way decrypting the secret key, given enough resources. And do note that Eve can make unlimited attempts (fast) at breaking the password as there is no timeout.

  • So if I understand well, the "file" corresponding to my secret key is irrelevant without a very strong passphrase? Is the passphrase a kind of key to decrypt the secret key file?
    – user160373
    Aug 29 '18 at 16:49
  • Yes from your passphrase you'll probably derive a key for decrypting your secret (private) key file Aug 29 '18 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy