Can GPG be a full replacement for PGP?

Question

I am working on automating a PGP process and plan to replace using PGP with GPG. But I need to make sure GPG can actually be a replacement.

Does GPG do everything PGP can do? I've researched a lot and it seems like most of the basic features are available, but I cannot find a SDA option in GPG.

Answer 1

Self-decrypting archives are a bad idea.

They are a self-inflicted security exposure. You're sending an executable file to someone and asking them to execute it? And then, just to add gravy on top, you're asking them to type their password into this untrusted program they got from who-knows-who? Nuts! That is effectively training people to behave in an insecure manner. Using self-decrypting archives is just asking for problems down the line.

Using a self-decrypting archive is a statement that you have a file so sensitive that it needs to be encrypted, but so harmless that you are asking the recipient to throw caution to the wind and disregard standard security practices. That doesn't make sense.

Personally, I think that GPG's lack of support for SDA's is a feature, not a bug.

Further resources:

• Don't use self-decrypting files. "Self-decrypting files are not cool at all." "Self-decrypting files are a man-in-the-middle attacker's dream come true."

• Is creating SDA's possible with GnuPG? "These are an incredibly bad idea. So, no."

Answer 2

GnuPG does actually offer SDAs, but it's just a self-extracting zip with a GPG'ed file and a script, which isn't really portable or a proper solution.

The differences I'm aware of:

• PGP's command line syntax is, imo, awkward. GnuPG's is clearer, but the switches are longer so there's more typing involved.
• GnuPG can automatically grab a key from the keyserver when someone whose key you haven't seen before emails you. I haven't found a way to do this in PGP, but you can look up the keys by email which GnuPG doesn't seem to let you do.
• GnuPG is vastly superior in terms of key management abilities.

In terms of crypto, there's not much difference, save the last point. Since GPG has very liberal licenses and is OpenPGP compliant anyway, I do suggest you move to it.