Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files?

What I am reading is that no he does not need it but as far as I understand GPG, it would still ask for a passphrase to decrypt a document. Please explain why Bob would not need to know Alice's passphrase to read her documents in a step by step example.

share|improve this question

GPG's (or OpenPGP's) public-key file encryption uses multiple steps:

  • Generate a random session key
  • encrypt the file using this random session key
  • encrypt the random session key using the public key of the receiver (or using multiple keys in parallel, if the file is meant to be decrypted by multiple receivers).
  • store the encrypted file together with the encrypted session key.

To decrypt it, the receiver (or attacker) needs the private key corresponding to (one of) the used public key(s).

Now, Alice should have protected her private keys with a passphrase - this way, Bob would get not the private key itself, only an encrypted version of it. If so, Bob's only way for decrypting the key (and thus the file) would be to guess the encryption passphrase (which can be possible if the passphrase is not that long/complicated).

If Alice didn't protect her private keys, Bob would get the private key, and could directly use it to decrypt the session key, and thus decrypt the file.

share|improve this answer
What would be a command line way to attack a private key with a passphrase? – Andrew Oct 1 '11 at 17:34
I don't know any command line programs which can be used for this, and this would be off-topic here anyways. – Paŭlo Ebermann Oct 1 '11 at 18:16

GPG typically lets the user choose whether or not to encrypt the private key with a passphrase. So, if Alice has encrypted the private key with a passphrase, Bob would need it. If she chose not to, he would not need a passphrase and could use the private key to decrypt files, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.