Re: [gentoo-user] {OT} GPG: pub & sec keys required to decrypt?

[Mike Edenfield]

Grant wrote:

> My understanding of GPG is weak.  Can someone point out my misconception(s)?

Speaking from a purely practical standpoint, keeping your private and 
public keys completely separate is extremely inconvenient with (IMO) a 
negligible security benefit.

However, there is arguably a much bigger security issue with keeping 
your private key on a remote server, particularly one you have no 
control over.  Pulling your keypair locally and doing any decryption 
operations locally is a much easier, and more practical, improvement.

If you keep the two halves of your keypair physically separate, then an 
attacker would need to get two distinct pieces of information in order 
to break any encryption using your keys.  For extremely high security 
purposes, this may be a worthy benefit.  For something like email, your 
public key should be considered common knowledge anyway.  If an attacker 
can gain control of your private key, the extra burden of getting your 
public key is insignificant.

Put another way: a file containing both your public and private key 
contains essentially the same amount of secure information as a file 
containing only your private key.  So long as your private key is kept 
secure, with or without your public key, your risks should be minimal.

--K