Endpoint Encryption

I would like to know the relationship (how each unit affects the other units) between PGP Desktop, Private Keys, and Passphrase.

I recently changed the Passphrase on my Private key in Administrator User mode. When I switched to Standard User, the new Passphrase did not work. I had to use the old Passphrase, then change it to the new one. In both User modes, I was accessing the same files, and had imported the Key to PGP Desktop from the other User.

This problem also brings up the issue of old (and possibly compromised) Passphrases that are floating around on some backup. Could recently stored files be opened using old Passphrases?

Is there some easy solution, other than finding all my old Keys/Passphrases and deleting them?

The key's passphrase serves one very important purpose - and is needed for any use of your private key.  Your private key needs to be protected from anyone else having access to it, but it has the additional protection of being encrypted.  The passphrase is hashed to produce the symmetric key that your private key is encrypted to. 

When you change your passphrase, it only changes the passphrase for the private key that is actually on your keyring - it can't re-encrypt copies of your private key that have been copied to other locations.  Since those other copies have not been re-encrypted, those copies of the private key are still encrypted to the old passphrase, and therefore will still be decrypted by that old passphrase.  You should either change the passphrase on those other copies, or delete them and replace them with a copy of the changed private key.

An option you may want to consider, to make sure that newly encrypted files cannot be decrypted by copies of your key that still has the old passphrase, is to also create a new encryption subkey when you change your passphrase.  This key can then use the new encryption subkey to encrypt files, but can still also decrypt prior encrypted files.

Do you need further assistance with this?

Thank you for answering.

It looks like I need to find and delete any old key/passphrases once I have changed the passphrase. I really don't see how a subkey will help, especially if the passphrase has been changed more than once since making encrypted file backups. There may be some procedure for varying  between 2 passphrases, or varying a passphrase in a manner I could predict, so I can guess my old passphrases. I never thought of doing that before, but it may be necessary.

Your answer stated that I must protect my private key. I assume this can be done on backup files by the "Export" function in PGP Desk. I don't see how I can protect a private key on my computer, however. Anyone could get access to my computer, even if they have to remove the hard disk and run it externally from another computer.

Do you have any ideas to prevent someone so accessing my files therefore my private key?

How far you go in protecting your private key depends on how valuable your data is that you are protecting.  Simply having the private key encrypted to your passphrase (which is automatically done when you create a new key) is fine if your only interest is in protecting the content of your email from your Internet Service Provider.  Never leaving your machine running without at least using the Screensaver password protection is another level.  Not doing any file sharing is another.  Only having your private key on a smartcard that is always in your personal possession is another.  Towards the top would be never connecting your working computer to the Internet, and do all decryption by transferring encrypted files manually to it for decryption.  Backups of your private key and private keyrings should ideally only be to secure locations that do not let others access the backup. 

Can I be of further assistance with this?