I was thinking of using gpg4win to encrypt files I'll upload to cloud storage services. I already use 7-zip so if I just wanted to password protect my files I could have easily done it, but I wanted to implement TLS style asymmetric encryption for my files so that one has to acquire both the private key file and the password protecting it to decrypt the files on cloud.
Kleopatra (GUI client of gpg4win) has an option to import keys in PKCS12 (.p12 or .pfx) format and public certificate (.crt) format as well as its own OpenPGP Private Key (.asc) format. So I wanted to see if I can use .pfx keys created somewhere else to encrypt/decrypt files using Kleopatra. This test worked out well without any problem using .pfx file, but something unintuitive happened when I tried the same test using .crt public certificate file with no private key information. When I imported public certificate file which technically shouldn't hold any secret key components, encrypting and decrypting files on Kleopatra still worked with no problem. But from my understanding of how asymmetric RSA encryption works, encrypting files with a public certificate should work but decrypting process requires at least the corresponding private exponent field to calculate the symmetric key back.
rem 1. Creating public certificate using openssl openssl req -x509 -key private.key -out public.crt -sha256 -set_serial 0 -days 365000 rem 2. Creating certificate + secret key bundle as .pfx openssl pkcs12 -export -in public.crt -inkey private.key -out combined.pfx
The above code shows how I created a public certificate file without secret key components. I used
-set_serial 0 to make sure even if I create certificates later on using the same private key it will still work on Kleopatra, because Kleopatra considers certificates with different serial numbers to be different despite being created from the same secret key. The version of Kleopatra is 4.0.0 and it's using GnuPG 2.3.4 and Libgcrypt 1.9.4.
To sum up my question is: Why does RSA decryption work on Kleopatra without any secret key components?