If Bob steals Alice's private key, how exactly would he read her encrypted documents?

Question

So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files?

What I am reading is that no he does not need it but as far as I understand GPG, it would still ask for a passphrase to decrypt a document. Please explain why Bob would not need to know Alice's passphrase to read her documents in a step by step example.

Answer 1

GPG's (or OpenPGP's) public-key file encryption uses multiple steps:

• Generate a random session key
• encrypt the file using this random session key
• encrypt the random session key using the public key of the receiver (or using multiple keys in parallel, if the file is meant to be decrypted by multiple receivers).
• store the encrypted file together with the encrypted session key.

To decrypt it, the receiver (or attacker) needs the private key corresponding to (one of) the used public key(s).

Now, Alice should have protected her private keys with a passphrase - this way, Bob would get not the private key itself, only an encrypted version of it. If so, Bob's only way for decrypting the key (and thus the file) would be to guess the encryption passphrase (which can be possible if the passphrase is not that long/complicated).

If Alice didn't protect her private keys, Bob would get the private key, and could directly use it to decrypt the session key, and thus decrypt the file.

Answer 2

GPG typically lets the user choose whether or not to encrypt the private key with a passphrase. So, if Alice has encrypted the private key with a passphrase, Bob would need it. If she chose not to, he would not need a passphrase and could use the private key to decrypt files, etc.