PGP Private Key Block
Detects the ASCII-armored header of an OpenPGP (PGP/GnuPG) private key block, as defined in RFC 4880 / RFC 9580. A leaked PGP private key allows an attacker to decrypt the holder's encrypted mail and files and to forge signatures in their name. The registry already covers RSA, EC, OpenSSH and PKCS#8 private keys; this adds the OpenPGP armor format. Header-only hits are discovery-only; armored packet data near the header provides the enforcement tiers.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: the armor header string is long, fixed and structurally distinctive, so false positives outside of documentation or training material are extremely unlikely.
- Jurisdictions
- global
- Regulations
- GDPR, CCPA/CPRA
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
- Data categories
- credentials, security
- Scope
- narrow
- Risk rating
- 8
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible
Pattern
-----BEGIN PGP PRIVATE KEY BLOCK-----Corroborative evidence keywords
private key, PGP, GPG, GnuPG, OpenPGP, secret key, passphrase
Proximity: 300 characters
Should match
-----BEGIN PGP PRIVATE KEY BLOCK-----— Low-tier probe - OpenPGP private-key armor header only-----BEGIN PGP PRIVATE KEY BLOCK----- lQIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCaPO2QBzKYKwDi QQ==— Medium-tier probe - realistic secret-key packet prelude without trailing armor-----BEGIN PGP PRIVATE KEY BLOCK----- lQIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCaPO2QBzKYKwDi k8qK+5bw7VyHxKzg8V+Pw3+QsewdCZi2ueNFTlIMOo0s2ZX/b1QLzu4lu08pMD1x ioxlDQbNb1tOxNoLnGBz1eLzKyraT6AMjuQhLCPHYJTq6Mv9e8GBQ0yljRZuUt04 pXObu8jeQB7Hq+h3gqXsrlEFxc4CIxjzj+WNWhG1XsOLztFPW71Y8lI3EbWp1ERs ALFXSqS3Wp67KJUQqspdXP+tNkgyd3Ch48Xu64zI0zP/t7LB9Qmty1eU2S/iPC/l 2bvvlwQwXDsjjTp5JzVjtxGNyYY6gWwud1A557OgC3bk++TtOdoBsdfYf9yZOLmi =Ab9X -----END PGP PRIVATE KEY BLOCK-----— High-tier probe - long secret-key packet body with checksum/footer beyond proximity
Should not match
-----BEGIN PGP PUBLIC KEY BLOCK-----— Public key block, not a private key-----BEGIN PGP MESSAGE-----— Encrypted PGP message, not a private keyplease export your PGP private key block before rotating the GPG keypair— Prose mention of a PGP private key without the actual armor header-----BEGIN PGP PRIVATE KEY BLOCK----- mQIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCaPO2QBzKYKwDi k8qK+5bw7VyHxKzg8V+Pw3+QsewdCZi2ueNFTlIMOo0s2ZX/b1QLzu4lu08pMD1x ioxlDQbNb1tOxNoLnGBz1eLzKyraT6AMjuQhLCPHYJTq6Mv9e8GBQ0yljRZuUt04— Adversarial public-key packet prelude inside private-key armor-----BEGIN PGP PRIVATE KEY BLOCK----- PLACEHOLDER -----END PGP PRIVATE KEY BLOCK-----— Placeholder packet body must not enforceDocumentation example: -----BEGIN PGP PRIVATE KEY BLOCK----- lQIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCaPO2QBzKYKwDi k8qK+5bw7VyHxKzg8V+Pw3+QsewdCZi2ueNFTlIMOo0s2ZX/b1QLzu4lu08pMD1x ioxlDQbNb1tOxNoLnGBz1eLzKyraT6AMjuQhLCPHYJTq6Mv9e8GBQ0yljRZuUt04 -----END PGP PRIVATE KEY BLOCK-----— Documentation quoting realistic wrapped OpenPGP data must not enforce
Known false positives
- Documentation, RFCs or training material that quotes the armor header without real key material. Mitigation: Require corroborative keywords and confirm armored base64 key material follows the header line.