4
$\begingroup$

So I am little confused about a type of encryption I read about. You can encrypt your E-mails and pretty much all kind of information using PGP key pairs.

However, I am confused if an encrypted message has an expiry date if a key used to encrypt the message has an expiry date too?

Let's say I am using a Key1 to Encrypt a Message and Key1 has an expiry date of 1 week from now, Can a person who received a message decrypt an encrypted message after a 1 week?

$\endgroup$
11
$\begingroup$

It is the keypair that is doing the encrypting, not the one doing the decrypting, that the expiration date applies to. And yes, they will be able to decrypt it after one week. In fact, they will always be able to decrypt it. The expiration date only applies to the key and is nothing more than a gentle reminder that the key is supposed to be replaced and should no longer be used for encryption (for public keys) or signing (for private keys). There is nothing stopping anyone from decrypting data that was encrypted with an expired public key. Unless a revocation certificate is generated and imported, an expired public key can have its expiration date retroactively modified by the holder of the private key. This is common practice.

If a public key has passed its expiration date, most PGP programs will warn you if you try to encrypt a message with it. There is nothing fundamentally that prevents you from forcing encryption, although some programs may refuse to encrypt with it and do not provide any override option. In those cases, forcing encryption with an expired public key is as simple as changing your computer's clock.

$\endgroup$

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.