Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that I can do (edit: fixed this; I'm interested in gpg NOT openssh)

gpg --edit-key change my passphrase for my key, but I'm not sure what this means.

If I'm encrypting data on box A and decrypting on box B (say with duplicity) do I have to change the passphrase on both ends? Will previous backups still work?

Is the passphrase just the key to a sort of encrypted wrapper around the key file?

Dumb question, but I don't want to screw this up. Thanks!

share|improve this question
SSH is not GPG! – Zoredache Jan 5 '12 at 18:33
I think you may have confused ssh keypairs and GPG keypairs, which whilst related aren't entirely interconvertible or interoperable. Most of your question relates to the latter, but ssh-keygen deals with the former. gpg --edit-key is used to change the passphrase on a gpg key. Can you perhaps clarify what you're trying to do? – MadHatter Jan 5 '12 at 18:35
Duh, thanks both of you. Don't know why I didn't realize that. – jberryman Jan 5 '12 at 19:17
up vote 16 down vote accepted

Yes. The only thing that matters for asymmetric encryption are the keys themselves. Alice encrypts something using Bob's public key, and only Bob with possession of his private key may decrypt the transmission and retrieve the original plaintext from Alice.

Since private keys are very sensitive, it is not a good idea to leave them laying around (in your disk or home directory). They need to be protected. So we wrap them using symmetric encryption using a passphrase. This way, we have two layers of security: in order to decrypt the data, the attacker needs something you have (the encrypted private key) and something you know (the passphrase to unlock the private key).

Changing the passphrase of a private key basically unwraps it from its old protection and creates a new protection with the new passphrase. The passphrase is never used in the transmission of the data between the two parties.

share|improve this answer

The actual ssh private key is stored in an encrypted format. The pass phrase is used to decrypt the private key so that is can be used. Changing the pass phrase will not affect how the key was used in the past.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.