0

I'm new to OpenPGP, GnuPG, and the concept of public-private key pairs. I have some questions in my mind:

  1. Is it necessary for me to have a PGP (or an OpenPGP) key? I'm an Android programmer, and an ordinary Linux user.

  2. If yes, then, do I need only one PGP key, or I will need several keys for different purposes?

  3. Is this belief true: Every today's computer user needs having, and using PGP keys?

  • 4
    You make it sound like a PGP key is an expensive acquisition. The way you're asking is also quite broad, so you might want to specify the use cases you had in mind. For instance, you can use Linux securely without ever explicitly handling PGP keys. On the other hand there are areas where PGP is widespread (e.g. email encryption). IMO, knowing how to create and handle keys is a really important skill, but it's not a hard requirement for using Linux securely. – Arminius Dec 18 '17 at 23:07
  • you use the terms "necessary" and "need" without indicating what the goal is - technology is a tool - use the tools that accomplish your goal – schroeder Dec 21 '17 at 20:35
3

From what I know about PGP, it's built on the concept of Web Of Trust, where trust is transitive. PGP belongs to public key infrastructure, and its main purpose is to provide ground for the authentication of public key, i.e. some public key truly belongs to a person who the key claim to belong. Authentication here is implemented by me using my private key to sign someone's public key, in order to authenticate they are the true owner of the public key. Since people who know me, and my public key in person, can verify my signing using my public key, then they would automatically 'trust' someone's public key which I signed. This poses a security issue when I mistakenly believe the key belongs to someone and I sign it. Then, my web-of-trust would automatically trust that malicious guy. Since people in the web of trust usually know each other in person, which makes it very difficult to engage in, thus preserving some degree of privacy within the group.

So, coming back to your question, it all depends if such degree of privacy is needed, a group-level privacy, when deciding whether or not to use PGP.

1

You need your own key pair if you want to be able to receive files/emails only you can decrypt or if you want to send files/emails signed by you. In both cases your correspondents will need a copy of your public key (they will be able to read your signed messages, but not validate the signature without a copy of the key).

1

OpenPGP is an asymmetric encryption protocol, which means it's designed to

  1. Allow anybody to encrypt things that only the recipient can decrypt and

  2. To enable people to 'sign' files to prove with (reasonable) certainty the identity of the sender and integrity of the message.

The protocol utilizes key pairs which consist of a public key that you share with others (or even publish publicly) and a private key which only you should ever control. It is often used to handle securing email but can also be applied to any files/text.

With that in mind:

  1. In general, no it is not necessary to have a PGP key pair to use Linux or write Android programs. (see answer 3)

  2. If you decide to use PGP, there are pros and cons to either approach. Generally a PGP key pair is intended to be assigned to one identity, which may mean one key pair identifies you, OR one key pair identifies you at work and another key pair identifies you in a personal capacity. The OpenPGP standard will support either use case and which you choose depends on the given application. For example, if I use a PGP key pair to sign/encrypt emails at work, my company may require a backup copy of my private encryption key pair in case I get hit by a bus. In this instance I would go with option B so they don't also have a copy of my personal private key.

  3. My original answer for this point was entirely opinion-based, so I'll omit it. Technically it is not required for all computer users to use PGP or any kind of encryption. It is entirely possible for everybody to use computers that continually expose all stored data to the entire planet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.