Understanding PGP
Pretty Good Privacy — still good, still pretty.
The 1991 spec that won't die, the OpenPGP RFC, the web of trust, and where Signal and age have eaten PGP's lunch.
A hybrid scheme.
PGP isn't a single algorithm. It's a wrapper that uses asymmetric crypto (RSA or ECDSA/EdDSA) to encrypt a randomly generated symmetric key, then uses that symmetric key (AES) to encrypt the actual message. The asymmetric part is slow but small; the symmetric part is fast but needs the key delivered safely. Almost every secure messaging scheme works the same way; PGP was the canonical implementation in 1991.
OpenPGP — the spec.
OpenPGP (RFC 4880, updated by RFC 9580 in 2024) is the wire format: armored ASCII blocks beginning -----BEGIN PGP MESSAGE-----, packet structures, key fingerprints, signature trust levels. GnuPG (GPG) is the reference open-source implementation. Sequoia-PGP is a modern Rust rewrite. Both implement OpenPGP — keys generated by one work with the other.
Web of trust.
PGP's defining feature: no central CA. Users sign each other's keys when they verify identity in person; the resulting graph is the "web of trust". If you trust three people who've signed Alice's key, you can transitively trust Alice's key. It's elegant in theory and a usability disaster in practice. The web never reached enough density to be useful for most users; Signal and Keybase (later Keybase, RIP) found better answers via phone-number bootstrapping or identity-provider proofs.
A worked encryption.
Alice wants to send Bob "Hello". GPG generates a random 256-bit AES key, encrypts "Hello" with that AES key, then encrypts the AES key with Bob's RSA public key. The output is an ASCII-armored block ~400 bytes long containing both ciphertexts plus metadata. Bob decrypts the AES key with his RSA private key, then decrypts the message with the AES key. Alice can also sign the message with her RSA private key — Bob verifies the signature with Alice's public key.
Encrypt & sign
hybrid encryption
AES-encrypt the message, RSA-encrypt the AES key, sign the message.
"Hello" → AES(K, "Hello") + RSA(pubB, K) + sig(privA, "Hello")
= ~400-byte armored block
Where PGP still wins.
Long-lived identity attached to email (developer code-signing, Debian package maintainers, security advisories). Encrypted email between technical correspondents. Hardware-backed keys via YubiKey or Nitrokey, which makes the private key never touch a disk. Git commit signatures — git commit -S uses GPG by default. For these use cases, the long-lived-key-pair model fits.
Where it's been eaten.
Real-time messaging — Signal's double-ratchet beats PGP's static keys on forward secrecy. File encryption between humans — age (Filippo Valsorda) has a 100-byte format, no metadata, no signatures, just encryption. Code signing — Sigstore's identity-bound keyless signatures avoid the long-term-key management problem. Anywhere usability or forward secrecy matters more than long-lived identity, PGP has lost. For everything else, it's still the standard.