• Suppose I send a PGP-encrypted email to person A, and the same email (same subject line, same message text) unencrypted to person B.
  • Suppose a secret service intercepts both messages.
  • The secret service rightly assumes from the identical subject line that both mails contain identical text.
  • Does this make it possible for the secret service to deduce my or person A's private key, and decrypt all my subsequent encrypted emails to person A?
  • 3
    If you're sending encrypted mail to someone else, you use their public key to encrypt it, not your private key. If you're signing the mail as well, you use your private key and they use your public key to verify the signature.
    – Ladadadada
    Commented Sep 25, 2013 at 10:22
  • @Ladadadada - Sounds like an answer to me, wanna post it?
    – TildalWave
    Commented Sep 25, 2013 at 10:24
  • I've changed the question to "my or person A's private key".
    – Ydobemos
    Commented Sep 25, 2013 at 10:46

4 Answers 4


No, the private keys are still safe in this case:

  • Your key, as the sender, is not involved at all in the process. When you encrypt an email to person A, you use A's public key, not your private key. If you use your private key at all, it will be to sign the email you send, which is something quite different.

  • A's private key is not involved either. You use A's public key for the encryption. If the potential attacker wants to know a message m, and what this message would become if encrypted with A's public key, then... he can do it himself ! A's public key is public, everybody knows it, and everybody can encrypt things with that key.

  • In the general case of encryption mechanisms, such systems are supposed to resist situations where the attacker can learn several (even many) pairs plaintext/ciphertext. These are called known plaintext attack (attacker learned a plaintext/ciphertext pair), chosen plaintext attack (attacker gets to choose the plaintext, and obtains the corresponding ciphertext), and chosen ciphertext attack (attacker chooses the ciphertext and obtains the plaintext). PGP would be considered quite weak if a single pair, or even one million pairs, would be sufficient to break it.


Firstly, lets look into how PGP works. Taking excerpts from RFC4880

 OpenPGP combines symmetric-key encryption and public-key encryption
   to provide confidentiality.  When made confidential, first the object
   is encrypted using a symmetric encryption algorithm.  Each symmetric
   key is used only once, for a single object.  A new "session key" is
   generated as a random number for each object (sometimes referred to
   as a session).  Since it is used only once, the session key is bound
   to the message and transmitted with it.  To protect the key, it is
   encrypted with the receiver's public key.  The sequence is as

   1.  The sender creates a message.

   2.  The sending OpenPGP generates a random number to be used as a
       session key for this message only.

   3.  The session key is encrypted using each recipient's public key.
       These "encrypted session keys" start the message.
   4.  The sending OpenPGP encrypts the message using the session key,
       which forms the remainder of the message.  Note that the message
       is also usually compressed.

   5.  The receiving OpenPGP decrypts the session key using the
       recipient's private key.

   6.  The receiving OpenPGP decrypts the message using the session key.
       If the message was compressed, it will be decompressed.

The text sent is encrypted using some symmetric encryption and the symmetric encryption key is encrypted using receivers private key. So now the question can be broken down into two problems:

  1. Known plaintext attack on symmetric encryption.
  2. Known plaintext attack on asymmetric encryption.

First question first. In GnuPG, some of symmetric algos used are: AES, Twofish, CAST5, DES3. These algorithms are using minimum keysize of 128 bits, thus known plaintext attack against these algorithms is tough. You can read more on this for AES in this thread.

Coming to the second question, attack on asymmetric encryption. ElGamal and RSA are used in GnuPG. As per this thread, known plaint text attack against RSA is not possible.

Also, please also have a look at this question as well.


Sending an encrypted PGP-message is (according to Wiki article on PGP):

  1. Encrypt message T with a symmetric encryption algorithm with a one-time-use randomly generated key (session key S) to get ciphertext E;
  2. Encrypt session key S with asymmetric encryption algorithm using recipient's public key Pub (we get S');
  3. Send E and S' to the recipient;
  4. Recipient then can decrypt S' with her private key Pr to get S, and then use S to decrypt E to get T.

From this I assume getting recipient's private key Pr having both T and E is not possible, since asymmetric encryption part has nothing to do with cyphertext or plaintext.


As rightly pointed out, the private key is not involved in encrypting, the only thing involved in the scenario from the question is the public key, and obviously everyone already has the public key, so it really doesn't matter if the security agency intercepts the public anc encrypted messages or not, it can encrypt whatever it wants with the public key.

However, the interesting question is if the plaintext message is signed but not encrypted. There the private key is used, and that's the type of scenario the known plaintext, chosen plaintext attacks refer to. It is believed that RSA type algorithm (based on exponentiation in finite fields) are resistant against those attacks. This means that the complexity of finding the private key even knowing the cleartext, is basically the same as trying every number between 2 and 2^4096 (if your key is 4096 bits long). This is because the density of prime numbers is n/log n so there is almost 2^4096/4096 = 2^4084 primes to test.

But the truth is that no one knows whether it is impossible to perform a known plaintext attack in general. There are ways to perform chosen plaintext attacks for so-called "weak keys" (for instance the prime number generators are probabilistic so you could end up with a non-prime private key, which is basically as weak as its largest prime component). But it's never been proved that there are no general attacks, it's just a belief. Just like it wasn't known if there was a way to test if a number was prime deterministically in polynomial time until a few years ago, then they found a way (but in this case there existed probabilistic algorithms with very low failure rate that were polynomial and to break keys there aren't such known algorithms)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .