I thinking about GPG, is very widely used, but is secure? Why and where we using GPG?

I found an article from 2002, but is very old.


GnuPG implements the OpenPGP format. Despite a few quirks due to its old age, it is reasonably secure (no serious weakness has been found yet in its usage of cryptography).

OpenPGP was initially meant for emails. It works well for that and plugins are available for various emailing software. The sore point of secure emails (encryption and/or signatures) is about making sure that you know the correct public key for any correspondent. OpenPGP relies on the Web of Trust concept, which is neat but, in practice, does not work well (it requires a thoroughly redundant graph of cross-user certifications, that is unlikely to ever exist). If you can make sure that you have the right key (e.g. by exchanging the public key fingerprints in person or over a phone call), then OpenPGP works well (I do that with customers).

Other usages include validation of software packages. For instance, this is integrated in the format for Debian packages and thus used in some major Linux versions (including Ubuntu).

  • thanks for your comment :), the last paragraph is sounds interesting, so can I verify an application originality what I downloaded from internet? – flatronka Feb 18 '13 at 18:13
  • 1
    The idea of signed packaged is that, by verifying the signature, you make sure that the package is exactly, down to the last bit, the same file as what the signer had. It won't guarantee that the application is secure or correct or nice; but it does protect against malicious alterations on data in transit or in mirror sites. – Thomas Pornin Feb 18 '13 at 18:31
  • 1
    "No serious weakness has been found yet in its usage of cryptography" is not correct. It has had its problems, some very serious. It is nonetheless true that most people have never encountered or been affected by these bugs, and the software has a good reputation. – ruief Feb 19 '13 at 14:33
  • Interesting, I can't found a good article about this. Thank you. – flatronka Feb 19 '13 at 17:52
  • Was exchanging public keys using ECC not there the time of this post? – IndoKnight Nov 26 '16 at 11:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.