Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP signatures, and of PGP encryption?

See also:

share|improve this question
up vote 9 down vote accepted

PGP signatures are used to sign software packages in some Linux distributions, including Debian and Ubuntu. This is quite widespread, although most Linux users are never aware of it.

PGP encryption, for what is was meant initially (i.e. emails), is commonly used in commercial situations, where some parties wish to exchange work documents. PGP keys are thus exchanged directly, not using the certificates (keys signed by other people) and the "web of trust". I often do it with customers. PGP benefits from very good integration and simple usage in many mailer softwares. PGP signatures are also used there, as an integrity check (but not in their "non-repudiation" role).

To sum up, the one feature of PGP which is almost never used is the web of trust.

share|improve this answer
You say "the one feature of PGP which is almost never used is the web of trust." - What exactly do you mean by "used", and what evidence do you have for that? I note that there are over 100,000 signatures of one user's key/certificate by another user that constitute the web of trust. How does that compare with other uses? You can see a fascinating and beautiful analysis of the web of trust here, the structures of which suggest some significant uses: Wotsap: Dissecting the Leaf of Trust – nealmcb Jun 3 '11 at 1:13
@nealmcb: I mean that I have never encountered any situation where the WoT was actually used to ascertain whether a given public key was genuine. I have seen many people signing each other's keys, under the assumption that this was "the right thing to do" and that it would allow some potential WoT-based certification; but when it comes to actually sending encrypted emails, you send them to people you know, for which the WoT has little added value. – Thomas Pornin Jun 3 '11 at 13:03
@ Thomas: Signatures are great! I find myself needing GPG for sharing emails and files (during incidents with other security professionals who rely on GPG), but would prefer S/MIME. I think other security professionals should move to S/MIME and leave GPG for signing installables/packages – atdre Jun 5 '11 at 18:49
I agree with @atdre... "PGP benefits from very good integration and simple usage in many mailer softwares", and very bad integration in some other mail software... – AviD Jun 6 '11 at 22:13

For almost all communications between me and many of my global banking clients, PGP is the trust layer which allows us to pass very sensitive data to each other. Most of these clients run a PGP gateway which ensures all comms to me from them is encrypted (thus avoiding accidental cleartext emails) and allows for an escrow in order that the organisation can check for viruses, information leakage etc.

The ones without PGP Universal all use pgp or gpg desktop clients - either way, we validate pgp keys out of band and gain a strong assurance that our emails are secured between us, time stamped and signed.

Absolutely invaluable for comms about security vulnerabilities.

share|improve this answer

Retroshare is an acentered P2P/Friend2Friend network software using GPG primarily as a authentication mecanism, and use its own kind of web of trust way to add people to "your ring" which is primarily a contact list. They use the PGP signature if you want to sign some content on the Retroshare forum or you can just post anonymously. I don't know if they use it for actually transferring data, because I think they use more their Turtle transfer protocol which is some kind of anonymous VPN so you don't really know where the data comes from.

Personnaly, I don't use it that much because I'm really used to webmails. But that's something I'm looking forward to using more. My other usage of PGP is for signing package for ubuntu, and that's it. I don't have a lot of contacts using it

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.