GPG Keys and Emails

Question

I have been testing out GPG keys and were studying the changes of the keys when adding/removing users on the key. If I add a user Alice upon key generation. I export the key pairs's public and private key. And then add the user Bob to the same key. And Finally export the same key except with Bob added as a user. Then I compare the Alice and Alice/Bob keys. The Alice public key has a huge chunk similar to the Alice/Bob public keys and also has a few differences in many spots. The Alice/Bob public key is considerably longer than the Alice key. I notice the same applies for the private keys. What I find interesting is that if I encrypt using the Alice Public Key and decrypt using the Alice/Bob private key, I get the same message.

Here are the questions I have:

1. Does email/User ID affect the public and private key?
2. Can you extract the user id from the public key? If yes, how does it work?
3. How does the encryption with Alice and decryption with Alice/Bob work?
4. Is a certain part of each key used for encryption/decryption and other parts left for the user id and emails?

Answer 1

And then add the user Bob to the same key

Most importantly, this is not what PGP key "user IDs" are for.

User IDs are only labels. They cannot be used for access control of any sort – they only inform others about the owner of the key. There should be only one owner of a key, and all user IDs on a single key should describe the same person.

(The reason you can add multiple user IDs is simply because the same person can have multiple email addresses, and indeed even multiple names.)

If multiple people need to use PGP, each of them should create their individual keys. Then you will list all of their keys when encrypting (e.g. use multiple --recipient options).

3. How does the encryption with Alice and decryption with Alice/Bob work?

When you add a second user ID, it's still literally the same RSA key material, you only changed the label that's written on it. User IDs are not for access control.

1. Does email/User ID affect the public and private key?
2. Can you extract the user id from the public key? If yes, how does it work?

4. Is a certain part of each key used for encryption/decryption and other parts left for the user id and emails?

When you talk about "public keys" and "private keys" in PGP, that does not usually mean just the raw public key data (e.g. just the RSA parameters) like it does in some other systems. Instead, what you actually get from gpg --export is the OpenPGP keyblock or certificate containing the public keys together with various metadata (user IDs, signatures, etc.).

So when you add a User ID, it doesn't really change the actual key parameters – it is added as a metadata packet next to the public-key packet.

And when people share their "PGP public keys" they share the whole bundle of key+metadata packets as a single unit. Overall the whole idea is very similar to X.509 certificates, which have a 'Subject' field alongside the key itself.

You can use such tools as pgpdump or gpg --list-packets to show the exported data in text format.