RFC 4880

RFC 4880
Title	RFC 4880
Subject	OpenPGP Message Format
Published	2007-11
Status	Informational
Authors	Philip Zimmermann, Jon Callas, etc.

RFC 4880 RFC 4880 specifies the OpenPGP message format and associated packet formats for encrypting, signing, compressing, and archiving electronic mail and data. It updates prior specifications and documents packet structures, algorithm identifiers, and interoperability requirements for software implementations. The document is foundational to projects and standards in cryptography, secure messaging, and software such as OpenPGP, GnuPG, Pretty Good Privacy, PGP Corporation, and related libraries.

Background

RFC 4880 arose from work on Pretty Good Privacy and the efforts of contributors associated with Phil Zimmermann, Jon Callas, and organizations like IETF working groups concerned with secure messaging. It builds on earlier standards and influences by projects at MIT, Stanford, and companies including RSA Security and Network Associates. The specification responds to interoperability issues encountered by implementations such as GnuPG, PGP Desktop, and libraries used by projects at Mozilla Foundation, Apache Software Foundation, and KDE.

Specification

The specification defines packet formats, versioning, and required behaviors for implementations like GnuPG and commercial products from Symantec and McAfee. It establishes version fields, timestamp semantics, and processing rules that affect applications integrating with Thunderbird, Evolution, and command-line tools common in distributions maintained by Debian, Red Hat, and Ubuntu. The RFC details canonicalization rules that impact mail clients offered by organizations such as Microsoft and Google when interoperating with OpenPGP-encrypted messages.

Message Formats and Packet Types

RFC 4880 enumerates packet types including Public-Key, Signature, Symmetric-Key Encrypted Session Key, One-Pass Signature, Literal Data, and Compressed Data packets—elements implemented in libraries such as Libgcrypt and used by clients like Enigmail. Packet header formats, length encodings, and nested packet sequences are defined to facilitate compatibility across implementations from projects at OpenBSD, FreeBSD, and NetBSD. The standard prescribes handling for keyring formats and subpacket extensions affecting integrations with services run by GitHub, GitLab, and enterprises using Microsoft Exchange.

Cryptographic Algorithms and Security Considerations

The RFC catalogs algorithm identifiers and modes for public-key algorithms such as RSA, DSA, and ElGamal, and for symmetric ciphers including AES, Triple DES, and CAST5. It addresses hashing algorithms including SHA-1, SHA-256, and considerations prompting migration influenced by findings from institutions like NIST and research from RSA Laboratories and Academic cryptography researchers. Security considerations review known attacks documented by teams at Google Project Zero and guidance from bodies like ENISA and the European Commission on cryptographic agility and deprecation of weak primitives.

Implementations and Interoperability

Several implementations follow RFC 4880, notably GnuPG maintained by the Free Software Foundation, commercial PGP-compatible products by Symantec Corporation, and libraries used in projects by Red Hat and Canonical Ltd.. Interoperability testing occurred at conferences and workshops organized by IETF and community events linked to DEF CON, Black Hat (briefings), and academic venues at USENIX. Toolchains in ecosystems like OpenSSL and bindings used by languages from Python to Java implement support, with integrations in platforms by Apple Inc. and Google influencing user-facing applications.

History and Revisions

RFC 4880 updated and obsoleted earlier documents produced by contributors at IETF working groups and reflected feedback from projects including GnuPG, PGP Corporation, and academic reviewers at Stanford University and MIT CSAIL. Subsequent revisions and extensions, informed by cryptanalysis and operational experience reported by entities like NIST and research groups at University of California, Berkeley, have led to complementary specifications and implementation notes adopted by communities around Debian Project and corporate security teams at Amazon Web Services. The ongoing evolution of OpenPGP is shaped by interoperability reports, security advisories from vendors such as Red Hat and Canonical Ltd., and standards work within IETF.

Category:Internet Standards