What is it about the architecture of GPG that requires me to enter the password of the secret key when I export it with "gpg --export-secret-keys"?

I would expect that gpg can just copy the relevant part out of the keyring and dump it into a file, without a password prompt. After all, the exported form is still encrypted with my password.


closed as off-topic by e-sushi Dec 24 '17 at 8:41

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ It is rather reassuring that the password is asked for this kind of operation, otherwise an attacker who controls your terminal could get your secret keys without knowing your password. It's maybe possible to disable this property but it wouldn't be surprising if not. If you want to, you can still try to decrypt the output file. $\endgroup$ – Raoul722 Feb 27 '16 at 22:31
  • 2
    $\begingroup$ An attacker who controls your terminal can just look them up from ~/.gnupg. As long as they are similarly encrypted there is no difference. $\endgroup$ – otus Dec 23 '17 at 9:57
  • $\begingroup$ I'm voting to close this question as off-topic because it is not about cryptography as defined in our help center. Instead, it is about the usage of a specific program — and the answer can be found in the according user manual. $\endgroup$ – e-sushi Dec 24 '17 at 8:41

man gpg...

GnuPG may ask you to enter the passphrase for the key. This is required because the internal protection method of the secret key is different from the one specified by the OpenPGP protocol.

I guess that answers it. Though if anybody knows more, feel free to share.


Not the answer you're looking for? Browse other questions tagged or ask your own question.