I have been looking at PGP for a few days and noticed that if I change the password on the private key, parts of the private key change, but a large portion of it remains the same. The public key does not change at all.

I know the public and private are mathematically related.

Does the important part private key (the part related to the public key) really remain the same, and its just the encryption of the private key that changes?

  • Changing the passphrase does not change the private key itself – it only re-encrypts it. – user1686 Aug 26 '11 at 21:01
  • Can you point me towards some documentation? It's a tricky one to search for on google. – bryan Aug 26 '11 at 21:02
  • The public key was never encrypted. You know, because it's public. Yes, if you change the password for the encryption, it changes the ciphertext, but not the cipher. – digitxp Aug 26 '11 at 21:19
  • There isn't much. Asking GPG developers on the GnuPG mailing list might be the best you can get... (RFC 4880 §5.5.3 mentions "Secret MPI values can be encrypted using a passphrase." but it isn't at all clear.) – user1686 Aug 26 '11 at 21:43
  • FWIW, in some other formats (such as PEM, often used for SSH/X.509/SSL private keys) the passphrase encrypts both public and private parts, for simplicity. – user1686 Aug 26 '11 at 21:46

There is a good concise overview to private and public key cryptography at the PGPI website. After explaining the basis for public key cryptography it explains "What is a passphrase?"

Most people are familiar with restricting access to computer systems via a password, which is a unique string of characters that a user types in as an identification code. A passphrase is a longer version of a password, and in theory, a more secure one. Typically composed of multiple words, a passphrase is more secure against standard dictionary attacks, wherein the attacker tries all the words in the dictionary in an attempt to determine your password. The best passphrases are relatively long and complex and contain a combination of upper and lowercase letters, numeric and punctuation characters.

PGP uses a passphrase to encrypt your private key on your machine. Your private key is encrypted on your disk using a hash of your passphrase as the secret key. You use the passphrase to decrypt and use your private key.

| improve this answer | |

Changing the password to a private-key will result in the private-key be decrypted and then encrypted using the new password. If the private key or public-key changed then you didn't change the password to the private-key, you changed the key-pair. Another way to look at it is that the private-key is stored in an encrypted file - you changed the password to the encrypted file (needed to use the contents of the encrypted file, namely the private-key) but you did not change the contents of the encrypted file. Yet another example because I know this can make your head spin a bit... you keep your valuables (private-key in this case) in a safe... you changed the combination of the safe and it would be surprising if the contents of the safe were changed by that action. If you are using your keys for anything important you should probably regenerate (change) your key-pair regularly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.