On Ma, 22 iun 21, 10:46:58, Marco Möller wrote: > Regarding openPGP usage, it is recommended in several user guides to keep > the primary key offline and keeping on the main computer only subkeys. The > argumentation is that if keeping it on the main computer then it could be > used in an unauthorized way. > Of course, what is offline, like a good backup, is safer than what is kept > online, simply because it cannot be accessed on the computer. > But, would it really be so easy for someone to to use a primary key? Isn't > the primary key stored passphrase protected, thus stored encrypted? > Except the case that an attacker would be in my system and actively spying > on me with a keylogger and other bad tools, I would assume that if someone > would simply steel (copy and carry away) my complete ~/.gnupg folder with > the primary key and revocation certificates somewhere being stored in there, > the usage of these keys and certificates would only be possible after > decryption upon the correct answer at the passphrase request? Isn't it like > this? Yes, for using the key. They could also just use your revocation certificate for a denial-of-service attack (as far as I recall these are not protected by a passphrase). However, with a copy of your private key an attacker can try to brute-force your passphrase. Because this is done locally they can throw whatever processing power they have access to at the problem[1]. For most other passwords this is not an issue, because an attacker trying to brute-force a password will quickly find themselves rate limited and/or banned and/or the account will be locked after a certain number of tries. So it's basically a defence-in-depth approach, which may be relatively easy for you to implement (the master key is needed only to issue or revoke sub-keys and sign other keys), but increases the difficulty significantly for an attacker. [1] obligatory XKCD: https://xkcd.com/538/ Hope this helps, Andrei -- http://wiki.debian.org/FAQsFromDebianUser
Attachment:
signature.asc
Description: PGP signature