Why am I able to decrypt the data I send using someone else's public key?



  • Sorry if this is more of a conceptual question. I was using GPG to send encrypted emails back and forth with a friend and I understand why I am able to decrypt the messages my friend sends me: because that data was encrypted using my gpg public key and I have the corresponding private key.

    But for fun, once I encrypted some data using my friend's public gpg key, I highlighted it and chose "OpenPGP: Decrypt Selected" and it worked. I don't have my friend's private key anywhere in my GPG Keychain. So I don't understand this because I thought that only the corresponding private key is able to decrypt the ciphertext.

    It seems that possibly both public keys are used when encrypting data (i.e. in an email)?? It's not like the sender doesn't know what data they encrypt and send but wouldn't this mean that now there are two private that can decrypt the data vs just the one?

    I've been reading through their manual but I only see explanations on the different types of cryptosystems, nothing explicitly stating how GPG works and what it is using.



  • PGP (generically) can encrypt a message to multiple publickeys; this was originally intended for emails to multiple recipients but can be used to include yourself, and GnuPG has an option to include yourself that can be configured to do so automatically, see --encrypt-to in https://www.gnupg.org/documentation/manuals/gnupg/GPG-Key-related-Options.html#GPG-Key-related-Options .

    Commandline gpg by default displays the keyid and userid used to decrypt (or verify) a file, and when it prompts for the passphrase on a privatekey it tells you which key it's asking for; these would show the key being used to decrypt your message to be your own key. If you're using one of the many different GUI frontends, it may show this information differently or not at all; you'll have to be more specific about what you're using.

    See PGP question decrypting my own message from 2 days ago
    Does OpenPGP encryption mean that not even I can see my data?
    and https://superuser.com/questions/1389024/gpg-difference-encrypt-to-and-recipient .



Suggested Topics

  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2