On a multi-user system (linux), I created a private key with no passphrase. I can now encrypt a file and decrypt it locally without supplyng a passphrase. This is very convenient and appears to be safe. The encrypted file has read/write permissions only for the owner of the file (me). However I am interested in what risks I am open to by not protecting my private key with a passphrase, or how could another user on the system gain access to my encrypted file? I am not intending to exchange encrypted files with other correspondents, I only want to encrypt and decrypt my own files locally.

  • 1
    The root user (system administrator) could decrypt the data. – bwDraco Mar 12 '15 at 21:30
  • your question is 2 part A)How can another user gain access to your private key file or any file B)What can they do with it. Re 'A' Dragonlord gave a great answer, the root user can. Re 'B' of course they can decrypt the files encrypted with your public key, if they have a copy of your private key file and can use it, and they can then use it straight away if you put no passphrase on it. – barlop Mar 12 '15 at 21:35

If they get a copy of your private key then they can decrypt files intended for you (files others encrypted with your public key).

So if they crack into your system somehow and get your private key, then you lose the security.

That's the reason for a passphrase, so even if they get the private key file they can't use it because they don't have the passphrase.

  • 2
    And they can sign messages with your key claiming you did it. – ott-- Mar 12 '15 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.