PGP Format Versions and Key IDs
Older versions of the PGP Key Format have several issues that potentially harm security. RFC 4880 further explains these, summarized very briefly:
- higher chances for key ID collisions
- fingerprint only hashes key, not size and algorithm (again, higher chance for ID collisions)
- use of MD5, which is considered broken
Anyway, usage of short key IDs is considered bad practice, as chance of duplicate keys is rather high. Use long key IDs or the full fingerprint instead.
Asymmetric Encryption Algorithms
There are mainly three choices for choosing algorithms: DSA/Elgamal, RSA and elliptic curves (ECDSA).
- DSA is very dependent from good random numbers during key generation and usage of the key. As there have been several issues with random number generators, it isn recommended as default algorithm any more (, , more on Wikipedia), although smaller keys are sufficient (compared with RSA).
- RSA needs larger key sizes, but is considered secure for adequately large keys. 768 bit keys have been broken, 1024 bit keys might be. Keys starting from 2048 bits are considered safe and currently are default, keys of 4096 bits currently recommended by Debian and others.
- Ellipctic Curves aren't broadly supported yet (GnuPG 2.1 will bring them, Google's End to End already uses them), and the security of the NIST-selected curves is still in doubt (without any proof). Generally, elliptic curves are considered safe.
I posted more on choosing keys in a Super User post.
Further Settings for Hashing and Symmetric Encryption
OpenPGP's and GnuPG's defaults do not meet highest possible security for compatibility reasons. You can change the preferred algorithms (you'd like others to use when encrypting to you) using a special signature. In GnuPG, you can create this using
gpg --edit-key and updating the preferences using
setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
To change the preferences for signing and encrypting to others, add these lines to
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
These list has been put together by Ana Beatriz Guerrero López and order hashing algorithms, symmetric encryption algorithms and finally compression algorithms ordered by higher entropy/security.
Not an issues with keys, but somewhat related with those settings are two rather theoretical issues. Mister, Zuccherato proposed a decryption oracle attack on OpenPGP's cipher feedback mode, which can be mitigated by always compressing data that will be encrypted; and Jallad, Katz, Schneier proposed a chosen-ciphertext attack which can be prevented by using the newly introduced (in RFC 4880) Integrity Protected Data Packet (which is a choice made by the implementation).