Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am working on automating a PGP process and plan to replace using PGP with GPG. But I need to make sure GPG can actually be a replacement.

Does GPG do everything PGP can do? I've researched a lot and it seems like most of the basic features are available, but I cannot find a SDA option in GPG.

share|improve this question

2 Answers 2

Self-decrypting archives are a bad idea.

They are a self-inflicted security exposure. You're sending an executable file to someone and asking them to execute it? And then, just to add gravy on top, you're asking them to type their password into this untrusted program they got from who-knows-who? Nuts! That is effectively training people to behave in an insecure manner. Using self-decrypting archives is just asking for problems down the line.

Using a self-decrypting archive is a statement that you have a file so sensitive that it needs to be encrypted, but so harmless that you are asking the recipient to throw caution to the wind and disregard standard security practices. That doesn't make sense.

Personally, I think that GPG's lack of support for SDA's is a feature, not a bug.

Further resources:

share|improve this answer

GnuPG does actually offer SDAs, but it's just a self-extracting zip with a GPG'ed file and a script, which isn't really portable or a proper solution.

The differences I'm aware of:

  • PGP's command line syntax is, imo, awkward. GnuPG's is clearer, but the switches are longer so there's more typing involved.
  • GnuPG can automatically grab a key from the keyserver when someone whose key you haven't seen before emails you. I haven't found a way to do this in PGP, but you can look up the keys by email which GnuPG doesn't seem to let you do.
  • GnuPG is vastly superior in terms of key management abilities.

In terms of crypto, there's not much difference, save the last point. Since GPG has very liberal licenses and is OpenPGP compliant anyway, I do suggest you move to it.

share|improve this answer
    
PGP commands aren't available with every PGP version, right? I don't see them on my version. –  JBurace Aug 3 '12 at 15:12
    
I'm confused. Did you mean every GPG version? –  Polynomial Aug 3 '12 at 15:15
    
Yes, sorry about that. –  JBurace Aug 3 '12 at 15:18
    
There's no specific commands. GnuPG can create files compatible with PGP 5.x and higher if you select certain options. –  Polynomial Aug 3 '12 at 15:20
    
Hmm. Okay, I found GPG commands. I still can't find PGP commands though even though I have PGP installed. I guess I did mean PGP. –  JBurace Aug 3 '12 at 15:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.