8
$\begingroup$

I have a 4096b GnuPG private key. It currently resides ~/.gnupg/secring.gpg.

The private key is passphrase protected.

Is it necessary to keep this private key hidden from public access?

Or, for convenience purposes, can I depend on the pass-phrase protection, and put it somewhere that's less-than-secure (like a git reposity or a dropbox) for ease of distribution to my various devices?

$\endgroup$
10
$\begingroup$

From the manual of GnuPG:

To help safeguard your key, GnuPG does not store your raw private key on disk. Instead it encrypts it using a symmetric encryption algorithm. That is why you need a passphrase to access the key. Thus there are two barriers an attacker must cross to access your private key: (1) he must actually acquire the key, and (2) he must get past the encryption.

[...]

The motivation for trying passphrases is that most people choose a passphrase that is easier to guess than a random 128-bit key. If the passphrase is a word, it is much cheaper to try all the words in the dictionaries of the world's languages. Even if the word is permuted, e.g., k3wldood, it is still easier to try dictionary words with a catalog of permutations. The same problem applies to quotations. In general, passphrases based on natural-language utterances are poor passphrases since there is little randomness and lots of redundancy in natural language. You should avoid natural language passphrases if you can.

From here we have

s2k-cipher-algo

Name

s2k-cipher-algo — use a specified algorithm as the symmetric cipher for encrypting private keys

s2k-cipher-algo name

Description

Use name as the symmetric cipher algorithm to protect private keys. Running the gpg with the command version yields a list of supported algorithms. The default cipher is Blowfish.

also

?> gpg2 --version
gpg (GnuPG) 2.1.11
libgcrypt 1.7.3-beta
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

TL;DR:

Sure, you can distribute your encrypted private key, but this defeat one of the two barriers mentioned in the manual (difficulty of access...)

The cipher used should be strong enough to guarantee the security of your key. However this will require you to use a really strong passphrase in order to avoid brute force and dictionary attacks.

Really TL;DR:

You can do it, but IT IS NOT ADVISED NOR RECOMMENDED. Your security will only rely on the strength of the passphrase that protect your secret key.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.