Private Keyring file – what does it contain and why does it need protecting?
The Private keyring (called “Secring.skr” by default) contains your private key(s). If someone obtains access to your private keyring then they can: • Decrypt any messages sent to keys contained on your keyring. This includes past messages, current messages and any future messages. • Create digital signatures using any of your private keys. Basically, if someone obtains your private keys then the entire security of PGP is lost. It is therefore important to protect PGP private key rings stringently. PGP provides some protection; it encrypts the keyring with a passphrase – without the passphrase the private key(s) are inaccessible. If you provide a good passphrase (see [Sch96a]), then your private keyring should be safe from any adversary. Still, you would be well advised to take some simple steps to protect the secret keyring file: • Don’t store the file on a network or shared drive. I, for example, store my keyring file on a ZIP disk. • Store the file on an encrypted drive (as provided
