PGP: Difference between revisions

From [[wikipedia:Pretty_Good_Privacy|its dedicated Wikipedia article]] :<blockquote>'''Pretty Good Privacy''' ('''PGP''') is an [[wikipedia:Encryption_software|encryption program]] that provides [[wikipedia:Cryptographic|cryptographic]] [[wikipedia:Privacy|privacy]] and [[wikipedia:Authentication|authentication]] for [[wikipedia:Data_communication|data communication]]. PGP is used for [[wikipedia:Digital_signature|signing]], encrypting, and decrypting texts, [[wikipedia:Email|e-mails]], files, directories, and whole disk partitions and to increase the [[wikipedia:Security|security]] of e-mail communications. [[wikipedia:Phil_Zimmermann|Phil Zimmermann]] developed PGP in 1991.<ref name=":0">{{cite web|last=Zimmermann|first=Philip R.|author-link=Phil Zimmermann|date=1999|title=Why I Wrote PGP|url=https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html|website=Essays on PGP|publisher=Phil Zimmermann & Associates LLC|access-date=July 6, 2014|archive-date=June 24, 2018|archive-url=https://web.archive.org/web/20180624122110/https://philzimmermann.com/EN/essays/WhyIWrotePGP.html|url-status=live}}</ref>

PGP and similar software follow the OpenPGP standard ([[wikipedia:Request_for_Comments|RFC]] 4880), an [[wikipedia:Open_standard|open standard]] for [[wikipedia:Encryption|encrypting]] and decrypting [[wikipedia:Data|data]]. Modern versions of PGP are [[wikipedia:Interoperability|interoperable]] with [[wikipedia:GnuPG|GnuPG]] and other OpenPGP-compliant systems.<ref>{{cite web|url=https://www.gnupg.org/faq/gnupg-faq.html#compatible|title=Gnu Privacy Guard|publisher=GnuPG.org|access-date=2015-05-26|archive-url=https://web.archive.org/web/20150429192132/https://www.gnupg.org/faq/gnupg-faq.html#compatible|archive-date=2015-04-29|url-status=live}}</ref>

The OpenPGP standard has received criticism for its long-lived keys and the difficulty in learning it,<ref>{{Cite web|date=2019-07-16|title=The PGP Problem|url=https://www.latacora.com/blog/2019/07/16/the-pgp-problem|access-date=2024-11-22|author=Latacora|language=en}}</ref> as well as the [[wikipedia:EFAIL|Efail]] security vulnerability that previously arose when select e-mail programs used OpenPGP with S/MIME.<ref>{{Cite web|title=Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels|url=https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-poddebniak.pdf}}</ref><ref>{{Cite web|last=Yen|first=Andy|date=2018-05-15|access-date=2025-01-22|title=No, PGP is not broken, not even with the Efail vulnerabilities|website=Proton|url=https://proton.me/blog/pgp-vulnerability-efail}}</ref> The new OpenPGP standard ([[wikipedia:Request_for_Comments|RFC]] 9580) has also been criticised by the maintainer of [[wikipedia:GnuPG|GnuPG]] [[wikipedia:Werner_Koch|Werner Koch]], who in response created his own specification LibrePGP.<ref name="LibrePGP">{{cite web|last1=Edge|first1=Jake|title=A schism in the OpenPGP world [LWN.net]|url=https://lwn.net/Articles/953797/|website=lwn.net|date=December 6, 2023|access-date=February 14, 2024|archive-date=February 22, 2024|archive-url=https://web.archive.org/web/20240222124116/https://lwn.net/Articles/953797/|url-status=live}}</ref> This response was dividing, with some embracing his alternative specification,<ref>{{Cite web|last1=Tse|first1=Ronald|last2=Olshevsky|first2=Nickolay|date=2024-07-22|access-date=2025-01-22|title=RNP proudly supports LibrePGP|website=RNP|url=https://www.rnpgp.org/blog/2024-07-22-rnp-and-librepgp}}</ref> and others considering it to be insecure.<ref>{{Cite web|last=Gallagher|first=Andrew|date=2024-09-11|access-date=2025-01-22|title=A Summary of Known Security Issues in LibrePGP|url=https://blog.pgpkeys.eu/security-issues-librepgp-2024-08.html}}</ref></blockquote>

* {{Nixpkg|pkgs/by-name/se/sequoia-chameleon-gnupg/package.nix|sequoia-chameleon-gnupg}}

From [[wikipedia:GNU_Privacy_Guard|its dedicated Wikipedia article]] :<blockquote>'''GNU Privacy Guard''' ('''GnuPG''' or '''GPG''') is a [[wikipedia:Free-software|free-software]] replacement for [[wikipedia:Symantec_Corporation|Symantec]]'s [[wikipedia:Cryptography|cryptographic]] software suite [[wikipedia:Pretty_Good_Privacy|PGP]]. The software is compliant with the now obsoleted<ref>{{cite web|url=https://www.rfc-editor.org/rfc/rfc9580.html|title=RFC 9580 OpenPGP|date=July 2024|publisher=IETF|website=RFC Editor|access-date=2024-12-19|last1=Wouters|first1=Paul|last2=Huigens|first2=Daniel|last3=Winter|first3=Justus|last4=Yutaka|first4=Niibe}}</ref> {{IETF RFC|4880}}[[wikipedia:RFC_(identifier)|RFC]]&nbsp;[https://www.rfc-editor.org/rfc/rfc4880 4880], the [[wikipedia:Internet_Engineering_Task_Force|IETF]] standards-track specification of [[wikipedia:OpenPGP|OpenPGP]]. Modern versions of PGP are [[wikipedia:Interoperability|interoperable]] with GnuPG and other OpenPGP v4-compliant systems.<ref>{{cite web|url=https://www.gnupg.org/faq/gnupg-faq.html#compatible|title=GnuPG Frequently Asked Questions|publisher=The GNU Privacy Guard|access-date=2015-05-26|archive-url=https://web.archive.org/web/20150429192132/https://www.gnupg.org/faq/gnupg-faq.html#compatible|archive-date=2015-04-29|url-status=live}}</ref>

November 2023 saw two drafts aiming to update the 2007 OpenPGP v4 specification (RFC4880), ultimately resulting in the RFC 9580 standard in July 2024. The proposal from the GnuPG developers, which is called LibrePGP, was not taken up by the OpenPGP Working Group and future versions of GnuPG will not support the current version of OpenPGP.<ref>{{cite web|url=https://lwn.net/Articles/953797/|first1=Jake|last1=Edge|date=December 6, 2023|title=A schism in the OpenPGP world|publisher=Linux Weekly News|access-date=2023-12-09}}</ref>

GnuPG is part of the [[wikipedia:GNU_Project|GNU Project]] and received major funding from the [[wikipedia:Politics_of_Germany|German government]] in 1999.<ref>{{cite web|url=http://www.heise.de/newsticker/meldung/Bundesregierung-foerdert-Open-Source-24110.html|title=Bundesregierung fördert Open Source|publisher=Heise Online|language=de|date=1999-11-15|access-date=July 24, 2013|archive-url=https://web.archive.org/web/20131012024601/http://www.heise.de/newsticker/meldung/Bundesregierung-foerdert-Open-Source-24110.html|archive-date=October 12, 2013|url-status=live}}