We have a scenario where we are locked out of our PGP private key despite 100% certainty we are using the correct passphrase:

User1 created a PGP key pairing. The public key was sent to a third party who used it for encryption and then sent the data over sftp back to User1. The data sent could be decrypted using the paired keys. After a few weeks, User2 was added to private key and created a new passphrase(this was done through Kleopatra). User2 was able to decrypt the data successfully (using the new passphrase) immediately after being added (they were also added as the primary user). Eight months later the data being sent by the third party has been archived and no decryption has been done. User2 has migrated key across 3 different devices during that time. Now when User2 tries to decrypt, they are prompted for a passphrase under their user ID, but the passphrase they enter is rejected. At no point in time did the public key change. What could be causing the issue in this scenario? The RSA and IDs all match up with what the encrypted file.

A couple of additional questions about this issue:

Does User1's password still exist on that key?

Can a key be reverted back to an old version, or can an older version of the key (prior to adding User2) be used for decryption?

When User2 migrated is it possible to lose some type of subkey or certificate in the process?

Are there certain settings with the key which could have changed at any point?

Are private keys tied to the original computers they were created on somehow?

I also wanted to note the key does not have an expiration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.