The 4096-bit limit on RSA keys for GPG won't be an issue for security, unless a new, better, faster algorithm for cracking RSA keys is discovered, and then any assertion about strength provided by some specific key sizes would be overly speculative. New algorithms for cracking RSA don't happen often; last time was circa 1989 for the General Number Field Sieve (most of the scientific advances on GNFS since the late eighties' are about practical implementations of GNFS and a lot of small-scale optimizations, but the core algorithm has not changed since that time).
Note that asymmetric encryption does not solve the confidentiality issue; it just moves it around: you still have to store the private key somewhere. Ultimately, for your problem of storing passwords, you will protect your private key with a "master passphrase" and that's symmetric encryption. You could make the whole process simpler by applying symmetric encryption directly on your file full of passwords (GnuPG supports it). Going fully asymmetric is interesting (in your context) only if you want to store a new password from a machine from which you do not have access to the private key and on which you do not want to type your passphrase.
Either way, a tricky point is when it comes to using your stored passwords. You have to perform decryption on some system. That system had better be free of any malware, because a keylogger would then grab your passphrase and/or your private key (if you use asymmetric encryption). Ideally, you should do that only from your own device(s). That's what I do when travelling:
- My own device is a Linux-powered netbook.
- The
/tmp
directory is a memory-based filesystem (so what I write in it never makes it to the SSD).
- No swap has been configured (so what is in RAM is never written to the SSD either).
- I decrypt (symmetrically) my file-of-passwords in
/tmp
, read the password, then type it, and then I delete the decrypted file.
Of course, if you have your own device at that point, why would you need to store the encrypted file in your email ? You could keep it directly on your device.
(Speaking of which, since emails can store arbitrary files as attachments, you do not need to restrict yourself to the email-specific formats OpenPGP and S/MIME. Using these only makes things simpler in that you may hope for your mail application to perform the decryption, instead of having to resort to some command-line tools. However, I may argue that command-line tools give you more control about where your data goes, e.g. in a RAM-backed /tmp
filesystem.)