When changing a PGP passphrase, does it only affect the private key?

Question

I am beginning to use GPG for email encryption. If I use gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to rebackup this key? Will it leave my public key and the revocation certificate alone, or will these need to be regenerated and then distributed and stored, respectively?

Answer 1

Your PGP private key is encrypted at rest. Altering the passphrase re-encrypts your private key, but it does not affect the actual private key itself. Your passphrase is used to encrypt your private key. From How PGP Works:

PGP uses a passphrase to encrypt your private key on your machine. Your private key is encrypted on your disk using a hash of your passphrase as the secret key. You use the passphrase to decrypt and use your private key.

When you change your passphrase, the protection around your private key has been altered, but the key itself has not. Consequently, the matching public key is still valid, since its corresponding private key is unchanged.

You can back up your newly encrypted private key, since the encryption protection around the key has changed, but the key itself is unchanged.

Answer 2

You can't change your private key without changing your public key. The two are inseparably linked. Things encrypted with the public key can only be decrypted with the private key and vice versa.

When you are using a password, what is actually happening is that rather than storing a copy of your private key, your private key is encrypted with a key derived from a password and the result of that encryption is stored.

To change your password, you enter your old password, which is used to decrypt the actual private key and then the key derived from your new password is used to encrypt the private key. The old version of the encrypted private key is then discarded. Thus, the private key is always kept the same, just the password protecting it changes.

Answer 3

Under the hood all that should be changing is the passphrase. The private key will stay the same (and still match your public key), but the passphrase-encrypted form of your key will change.