PGP public keys look something like

Version: GnuPG v1.4.9 (GNU/Linux)


I'm wondering why the 'Version:' line is always included and if it's safe to remove. Why advertize what version of GPG/PGP and operating system being used if decryption does not depend on information in the 'Version:' line?

3 Answers 3


You can safely remove that line. RFC 4880, OpenPGP does not declare it as required.

Currently defined Armor Header Keys are as follows:

  • "Version", which states the OpenPGP implementation and version used to encode the message.
  • [...]

I also could not find any evidence of version data being included in the binary version, neither by reading the RFC nor by viewing at the package data using gpg --list-packets.

To remove it, use --no-emit-version. From man gpg:

          Force inclusion of the version string in ASCII armored output.   --no-emit-
          version disables this option.
  • Thanks. Searching "--no-emit-version" I was able to find this, which shows an easy way to add --no-emit-version to enigmail.
    – kzoo
    Dec 7, 2013 at 17:55

This version number will be usefull in the case in the future a known version of OpenGPG will be announced broken on a given set of OS.

Upon receiving a signed or crypted message using this broken version of OpenGPG, you will be able to decide to change your trust level attributed to this key.

On the other hand, I don't see any real advantage to hide the origin tracking information of a key generation.


Displaying version data is a security vulnerability and should be disabled by default. This is a huge bug in PGP right now and it needs to be addressed by the core maintainers ASAP.

  • 3
    Why is it a vulnerability? Can you point to a bug report?
    – schroeder
    Apr 15, 2016 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.