Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On this answer ck says

RSA and PGP are different.

What you are essentially asking is how do I run my petrol car on diesel? The answer is you can't.

I would be interested in a more detailed comparison between the two, why they are different, and why one would choose one over the other.

share|improve this question
add comment

2 Answers

up vote 29 down vote accepted

RSA is an algorithm (actually, two algorithms: one for asymmetric encryption, and one for digital signatures -- with several variants). PGP is originally a piece of software, now a standard protocol, usually known as OpenPGP. OpenPGP defines formats for data elements which support secure messaging, with encryption and signatures, and various related operations such as key distribution. As a protocol, OpenPGP relies on a wide range of cryptographic algorithms, which it assembles together (which is not as easy as it seems, if you want the result to be secure). Among the algorithms that OpenPGP can use is RSA.

So, to keep with the car analogy, your question is like: "What is the difference between a combustion engine and a Honda Accord ? Why would one choose one over the other ?" The question makes no sense per se: the Accord comes with a combustion engine under its lid. It also comes with a bunch of other useful features, such as wheels; you cannot do much with a combustion engine alone.

Still in that analogy, you can imagine cars without a combustion engine, e.g. electric cars. Translated into the OpenPGP world, the question becomes: can OpenPGP perform its work without using RSA ? And the answer is yes: there are other asymmetric encryption and digital signature algorithms that OpenPGP can use, which will provide the same functionality than what OpenPGP uses RSA for. Historically, when OpenPGP was first defined, there were still a few unsolved questions about the RSA patent, so implementations were encouraged to use El Gamal and DSA (for asymmetric encryption and digital signatures, respectively), instead of RSA. (The RSA patent expired in 2000)

share|improve this answer
6  
+1, @Thomas, I always enjoy reading your answers! –  AviD Jan 20 '11 at 0:57
add comment

PGP is a software suite of encryption algorithms and the ability to encrypt emails, files, etc. RSA is a specific algorithm for encryption and digital signatures. There is also a difference between PGP (the $ one) and GPG (the free one).

It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both).

share|improve this answer
    
RSA is well known as the pioneering implementation of public key cryptography. –  DCookie Jan 19 '11 at 23:24
    
I love when questions beget answers which beget more questions. And the cycle continues. –  Iszi Jan 21 '11 at 19:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.