🔑Pretty Good Privacy

NEW

Also known as: PGP

A software program for encrypting and signing data and email, using public-key cryptography to ensure privacy and authenticity.

DESCRIPTION

PGP, created by Phil Zimmermann, provides end-to-end encryption and digital signatures for files and email. It combines public-key and symmetric cryptography for efficiency and security. The OpenPGP standard later formalized many PGP concepts, enabling interoperability across implementations like GnuPG. PGP relies on key management and trust establishment, often via a web of trust model. It is used for secure communication, distribution, and verification in developer and privacy communities.

ALTERNATIVE DEFINITIONS

Phil Zimmermann

PGP is a program that provides cryptographic privacy and authentication for data communication.

Founder’s description highlighting privacy and authentication purposes.

Source

Symantec

PGP encryption protects data and email with strong cryptography and digital signatures for secure communication.

Vendor framing focused on enterprise data and email protection.

Source

RELATED TERMS

OpenPGP GnuPG Asymmetric Encryption Digital Signature Key Management Email Encryption RSA Keyserver Fingerprint

COMPETING TERMS

S-MIME

RELATIONS

• Broader: Privacy
• Conforms to: OpenPGP

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance Infrastructure

TARGET AUDIENCE

Cybersecurity Engineer Security Architect Data Privacy Officer Application Administrator Software Developer

EXTERNAL SOURCES

• Wikipedia - Pretty Good Privacy
• IETF - OpenPGP message format standard
• GnuPG - OpenPGP implementation documentation
• Electronic Frontier Foundation - PGP usage guides and best practices

TOP QUESTIONS

What problem does Pretty Good Privacy solve?

PGP provides end-to-end encryption and signatures, ensuring confidentiality and integrity of messages and files across untrusted networks.

Category: Overview

How does PGP establish trust without a Certificate Authority?

PGP uses a web of trust, where users sign each other’s keys after verification, building decentralized trust relationships.

Category: Example

What are common mistakes using PGP?

Poor key management, weak passphrases, and failing to verify fingerprints undermine security. Insecure key storage is a frequent issue.

Category: Mistakes

What’s the relationship between PGP and OpenPGP?

OpenPGP is a standardized specification derived from PGP’s concepts, enabling interoperable implementations like GnuPG.

Category: Misunderstanding

What risks remain even with PGP?

Metadata leakage, compromised endpoints, and phishing can bypass cryptography. Operational security is essential.

Category: Risk

How do I verify a PGP signature?

Import the signer’s public key, check the fingerprint, and run verification; trust depends on your web-of-trust decisions.

Category: Requirements

What is a hot topic around PGP today?

Hardware-backed keys, modern keyserver designs, and UX improvements for mainstream adoption are active areas.

Category: Topic

What competes with PGP for email security?

S/MIME offers CA-based trust and enterprise integration, contrasting with PGP’s decentralized web-of-trust.

Category: Alternatives

Where do I start learning PGP?

Begin with OpenPGP manuals, EFF guides, and practice generating keys, signing, and encrypting test messages.

Category: Learning