Lets say for a PGP/GPG pair with a passphrase.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Typical ways include
The OpenPGP standard (RFC 4880) defines in section 3.7 a number of String-to-Key (S2K) conversion functions, which are used for password-encrypted messages (i.e. ones without using a public key scheme), as well as for (the secret part) in private keyrings.
Most probably the Iterated and Salted S2K will be used. Its specification includes a hash function algorithm identifier, an 8-byte salt, and a
To create the key from a passphrase, salt and passphrase will be alternatedly concatenated until a string of length
The format of the private key rings itself is not documented there, though it is sensible to assume the format given in section 5.5.3.
Assuming the private key is encrypted (otherwise there would be nothing to crack), look at the S2K specifier byte to know which key derivation function is used, and also which salt (if any).
Now you take your dictionary of passwords (or passphrases, or program which generates candidates), and with each candidate password do this:
Mikeazo's answer includes some ideas on which passphrases to try.
If the passphrase is any good (and the key derivation algorithm is "Salted and Iterated" with an appropriate high count), you will need a long time for this.
Related to this, I found a description of an attack on signature keys stored in this format. It does not need to crack the encryption, but instead does modify the stored (encrypted) private key and then observes one message signed with the modified key.
This does not work on encryption keys (or actually, decryption), and as this attack was from 2001/2002, I suppose it is fixed until now. (I didn't do detailed research on this, comments are welcome.)