1996-06-03 - Re: Security of PGP if Secret Key Available?

Header Data

From: Henry Huang <hwh6k@fulton.seas.virginia.edu>
To: cypherpunks@toad.com
Message Hash: 362b4f55ac438d93e903f7eacda5ca688e95da527527cdc31b45897b136231ec
Message ID: <199606031648.MAA31489@fulton.seas.Virginia.EDU>
Reply To: N/A
UTC Datetime: 1996-06-03 22:59:42 UTC
Raw Date: Tue, 4 Jun 1996 06:59:42 +0800

Raw message

From: Henry Huang <hwh6k@fulton.seas.virginia.edu>
Date: Tue, 4 Jun 1996 06:59:42 +0800
To: cypherpunks@toad.com
Subject: Re: Security of PGP if Secret Key Available?
Message-ID: <199606031648.MAA31489@fulton.seas.Virginia.EDU>
MIME-Version: 1.0
Content-Type: text/plain

On Jun 3,  2:36, "Robert A. Hayden" wrote:
> However, I got to wondering about the security of PGP assuming somebody 
> trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have 
> it on my personal computer, and somebody gets my secret key, how much 
> less robust has PGP just become, and what are appropriate and reasonable 
> steps to take to protect this weakness?

If someone else has your secret key, it's safe to assume you're toast. ;)
Better a new key and revocation certificate before the forgeries start
(or before someone ELSE does before you ... <shudder>).

More specifically, if you've failed to assign a passphrase to your
secret key, you ARE toast, because anyone can just pick it up and use

If you did use a passphrase, it becomes a question of breaking either
the passphrase, or the IDEA algorithm used to encrypt your secret key.
It's usually a lot easier to break the passphrase than it is to brute
force IDEA.

See the PGP Passphrase FAQ
and Arnold Reinhold's page (http://world.std.com/~reinhold/papers.html)
for more details.