Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm new to OpenPGP, GnuPG, and the concept of public-private key pairs. I have some questions in my mind:
Is it necessary for me to have a PGP (or an OpenPGP) key? I'm an Android programmer, and an ordinary Linux user.
If yes, then, do I need only one PGP key, or I will need several keys for different purposes?
Is this belief true: Every today's computer user needs having, and using PGP keys?
From what I know about PGP, it's built on the concept of Web Of Trust, where trust is transitive. PGP belongs to public key infrastructure, and its main purpose is to provide ground for the authentication of public key, i.e. some public key truly belongs to a person who the key claim to belong. Authentication here is implemented by me using my private key to sign someone's public key, in order to authenticate they are the true owner of the public key. Since people who know me, and my public key in person, can verify my signing using my public key, then they would automatically 'trust' someone's public key which I signed. This poses a security issue when I mistakenly believe the key belongs to someone and I sign it. Then, my web-of-trust would automatically trust that malicious guy. Since people in the web of trust usually know each other in person, which makes it very difficult to engage in, thus preserving some degree of privacy within the group.
So, coming back to your question, it all depends if such degree of privacy is needed, a group-level privacy, when deciding whether or not to use PGP.
You need your own key pair if you want to be able to receive files/emails only you can decrypt or if you want to send files/emails signed by you. In both cases your correspondents will need a copy of your public key (they will be able to read your signed messages, but not validate the signature without a copy of the key).
OpenPGP is an asymmetric encryption protocol, which means it's designed to
Allow anybody to encrypt things that only the recipient can decrypt and
To enable people to 'sign' files to prove with (reasonable) certainty the identity of the sender and integrity of the message.
The protocol utilizes key pairs which consist of a public key that you share with others (or even publish publicly) and a private key which only you should ever control. It is often used to handle securing email but can also be applied to any files/text.
With that in mind:
In general, no it is not necessary to have a PGP key pair to use Linux or write Android programs. (see answer 3)
If you decide to use PGP, there are pros and cons to either approach. Generally a PGP key pair is intended to be assigned to one identity, which may mean one key pair identifies you, OR one key pair identifies you at work and another key pair identifies you in a personal capacity. The OpenPGP standard will support either use case and which you choose depends on the given application. For example, if I use a PGP key pair to sign/encrypt emails at work, my company may require a backup copy of my private encryption key pair in case I get hit by a bus. In this instance I would go with option B so they don't also have a copy of my personal private key.
My original answer for this point was entirely opinion-based, so I'll omit it. Technically it is not required for all computer users to use PGP or any kind of encryption. It is entirely possible for everybody to use computers that continually expose all stored data to the entire planet.
