If I change my private key PGP passphrase, will the old private key+old passphrase work to decrypt already encrypted data?

Question

Suppose I have a script that contains my PGP private key in plain text and requires me to manually type in the key passphrase to decrypt some data. Later, I decide that my passphrase is compromised and use gpg to change the passphrase. Would someone that has my old PGP private key and captured somehow my old passphrase be still able to decrypt data?

In other words I am thinking if regularly changing the passphrase would do any good in terms of securing the data or not. As far as I understand, changing the PGP private key passphrase only affects the private key, and public key is unaffected. This leads me to thinking that if someone is in possession of my old PGP private key and old passphrase, he may still be able to decrypt messages, even after I change my passphrase.

I hope that makes sense :) Thanks

Answer 1

You are correct: the passphrase protects the key, so if both have been leaked, then the attacker can decrypt any previously intercepted messages, and any future messages using the same key.

Remember that the attacker has a copy of the key with the old passphrase in his posession - changing the passphrase on your copy of the key does not affect his copy. Also a passphrase change does not affect the key itself, so any compromises of the key are permanent.

So if you suspect a key + passphrase has been leaked, revoke it immediately and generate a new key.

Answer 2

Would someone that has my old PGP private key and captured somehow my old passphrase be still able to decrypt data?

Yes, definitely. This is the worst case scenario and you absolutely don't want this to happen, because you would have to revoke your key and come up with a new one, which needs to be redistributed.