Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

I thinking about GPG, is very widely used, but is secure? Why and where we using GPG?

I found an article from 2002, but is very old.

share|improve this question
1  
Useful for what? Secure for what? – Gilles Feb 18 at 17:10

closed as not a real question by Jeff Ferland♦ Feb 18 at 19:14

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 3 down vote accepted

GnuPG implements the OpenPGP format. Despite a few quirks due to its old age, it is reasonably secure (no serious weakness has been found yet in its usage of cryptography).

OpenPGP was initially meant for emails. It works well for that and plugins are available for various emailing software. The sore point of secure emails (encryption and/or signatures) is about making sure that you know the correct public key for any correspondent. OpenPGP relies on the Web of Trust concept, which is neat but, in practice, does not work well (it requires a thoroughly redundant graph of cross-user certifications, that is unlikely to ever exist). If you can make sure that you have the right key (e.g. by exchanging the public key fingerprints in person or over a phone call), then OpenPGP works well (I do that with customers).

Other usages include validation of software packages. For instance, this is integrated in the format for Debian packages and thus used in some major Linux versions (including Ubuntu).

share|improve this answer
thanks for your comment :), the last paragraph is sounds interesting, so can I verify an application originality what I downloaded from internet? – flatronka Feb 18 at 18:13
1  
The idea of signed packaged is that, by verifying the signature, you make sure that the package is exactly, down to the last bit, the same file as what the signer had. It won't guarantee that the application is secure or correct or nice; but it does protect against malicious alterations on data in transit or in mirror sites. – Thomas Pornin Feb 18 at 18:31
thank you for the explanation :) – flatronka Feb 18 at 22:28
1  
"No serious weakness has been found yet in its usage of cryptography" is not correct. It has had its problems, some very serious. It is nonetheless true that most people have never encountered or been affected by these bugs, and the software has a good reputation. – ruief Feb 19 at 14:33
Interesting, I can't found a good article about this. Thank you. – flatronka Feb 19 at 17:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.