GPG

GPG
Name	GPG
Developer	Werner Koch, Free Software Foundation, GNU Project
Released	1999
Programming language	C (programming language), Python (programming language)
Operating system	Linux, Windows, macOS
Genre	Cryptography, Privacy
License	GNU General Public License

GPG

GPG is a widely used implementation of public-key cryptography associated with the GNU Project and the Free Software Foundation. It provides tools for encryption, digital signatures, and key management interoperable with standards originating from the OpenPGP format, enabling confidentiality and authentication across software such as Thunderbird (software), Git (software), and Email. Key figures and organizations in its ecosystem include Werner Koch, Phil Zimmermann, and projects like OpenSSL and LibreOffice that interact with cryptographic tooling.

Overview

GPG implements the OpenPGP standard derived from RFC 4880 and interoperates with systems used by Linux kernel developers, contributors to Debian, and administrators of Ubuntu. It supports a variety of public-key algorithms such as those popularized by RSA (cryptosystem), Elliptic-curve cryptography, and integrates with package signing workflows used by GNU and distribution maintainers like Red Hat and Arch Linux. GPG's command-line utilities are often combined with graphical front ends like Kleopatra and GPA (software), and server components like SKS keyserver or services maintained by organizations such as keybase.io and MIT keyserver mirrors.

History and Development

Development traces to Werner Koch's initial implementation in the late 1990s following release of Phil Zimmermann's Pretty Good Privacy program and the need for a free alternative compatible with emerging standards. The timeline intersects with events like the IETF standardization of OpenPGP, debates involving U.S. export regulations and policy discussions in European Union privacy law contexts. Major milestones include adoption by Debian Project packagers, integration into GNOME and KDE desktops, and responses to cryptanalytic discoveries associated with projects from NIST and academic groups at MIT, Stanford University, and University of Cambridge.

Features and Architecture

GPG offers signing, encryption, key generation, and keyring management built around OpenPGP packet formats influenced by RFC 2440 and RFC 4880. It supports algorithm suites including RSA (cryptosystem), DSA, ElGamal, and elliptic-curve variants standardized by SECG and adopted in RFC 6637. The architecture separates a core crypto engine from front ends and agents: components include gpg-agent, gpgsm, and helper tools that interoperate with SSH (protocol) and S/MIME stacks. Extension points allow smartcard integration with devices following ISO/IEC 7816 and FIDO hardware token support, and integration with package managers like RPM (software) and APT (software) for signature verification.

Usage and Typical Workflows

Typical workflows include generating a keypair, publishing public keys to keyservers, signing messages or files, and verifying signatures—actions commonly performed by contributors to GitHub, GitLab, and maintainers of Debian packages. Email users of Mozilla Thunderbird with Enigmail (historically) or built-in OpenPGP support employ GPG to secure correspondence with contacts like academics at Harvard University or journalists at The Guardian. Developers sign commits for repositories mirrored on SourceForge or Bitbucket and CI pipelines in Jenkins may verify artifacts using GPG signatures prior to distribution through PyPI or npm registries.

Security and Cryptanalysis

GPG's security depends on algorithm selection, key length, and implementation hygiene; issues in cryptographic primitives have prompted advisories from NIST and academic analyses by researchers at ETH Zurich and CNRS. Past vulnerabilities, including side-channel leaks and implementation bugs, have been documented by entities such as CERT Coordination Center and prompted patches coordinated with distribution maintainers like Canonical. Cryptanalysis of supported algorithms (for instance advances in factoring impacting RSA (cryptosystem)) influences recommended key sizes and transitions to elliptic-curve algorithms endorsed by standards bodies like IETF and ISO.

Implementations and Compatibility

Multiple implementations interoperate with the OpenPGP ecosystem: the original GPG implementation coexists with projects like OpenPGP.js for web contexts, Bouncy Castle for Java, and proprietary implementations in Microsoft Outlook add-ins. Cross-platform compatibility spans Linux, FreeBSD, Windows, and macOS with GUIs like Kleopatra and Seahorse integrating with desktop environments such as KDE and GNOME. Interoperability testing involves exchanges with services run by MIT keyservers, HKP protocol endpoints, and compatibility suites maintained by contributors from Red Hat and Debian.

Licensing and Governance

GPG is distributed under the GNU General Public License with development led by Werner Koch and contributions coordinated through mailing lists and repositories affiliated with the GNU Project. Governance is largely community-driven, with funding and support from organizations such as the Free Software Foundation, donations from entities like NLnet Foundation, and occasional grants from public institutions. Policy discussions that affect usage and distribution involve stakeholders including European Parliament committees on privacy and advisors in U.S. Department of Commerce technical panels.

Category:Cryptographic software