openpgp-notes/book/source/01-intro.md

<!--
SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
SPDX-License-Identifier: CC-BY-SA-4.0
-->

# Introducing OpenPGP

This documentation project seeks to introduce OpenPGP concepts and functionalities to software developers who wish to use it in their projects.

This document describes [OpenPGP version 6](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/), with occasional remarks about differences to earlier versions.

This text is *not* intended as a guide for end-users of OpenPGP-related software.

## What is OpenPGP?

OpenPGP is an open standard for cryptographic operations. It is a system based on well-understood [cryptographic building blocks](cyrptography_chapter). OpenPGP supports the secure delivery of files and messages between a sender and a recipient. It also addresses identities and their verification. OpenPGP is an outgrowth of the ["Pretty Good Privacy (PGP)"](https://en.wikipedia.org/wiki/Pretty_Good_Privacy) encryption program and has many widely used and [interoperable implementations](interop_section).

With OpenPGP, you can:

- [Encrypt](encryption_chapter) and [decrypt](decryption_chapter) messages to achieve confidentiality
- [Sign](signing_data) and [verify](verification_chapter) data to ensure authenticity
- [Issue and validate certifications](component_signatures_chapter) about keys and identities, similar to the role of a Certificate Authority in validating identities.

## Who is the audience for this document?

Three groups of people interact with OpenPGP:

1. End-users, who use software that contains OpenPGP functionality (e.g., the Thunderbird email software)
2. Software developers who build applications that contain OpenPGP functionality
3. Implementers of OpenPGP libraries (or other software that directly handles the processing of internal OpenPGP data structures)

This document is not intended for end-users or implementers of OpenPGP libraries (or other software that directly handles internal OpenPGP data structures).

Instead, this document is focused on the second group, application developers, who use OpenPGP functionality in their software projects. It describes the properties of the OpenPGP system and its uses. It presupposes solid knowledge of software development concepts and of general cryptographic concepts. Thus, this text describes OpenPGP at the "library-level," teaching concepts that will help software developers get started as a user of any implementation (e.g., [OpenPGP.js](https://openpgpjs.org/), [Sequoia-PGP](https://sequoia-pgp.org/)).

With the emergence of a new crop of modern, high-quality, OpenPGP libraries, and the imminent release of the updated [OpenPGP version 6 specification](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/), we think that now is a great time to implement OpenPGP functionality in applications, or to modernize existing OpenPGP subsystems.

We aim to offer an implementation-independent introduction to the OpenPGP technology, to help software developers get their bearings more quickly. The text is also intended as a stepping stone to more easily locate relevant information in the RFC, when necessary.

## Why not just use the OpenPGP RFC?

The [OpenPGP RFC](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/)
defines *the message formats used in OpenPGP.* That is, it describes the internal structure of OpenPGP data, which is crucial for OpenPGP library implementers. However, this level of detail is not required for software developers who use OpenPGP via a library.

This document describes OpenPGP concepts at the "library" level of abstraction, omitting unnecessary detail about the internal encoding of OpenPGP artifacts. Instead, we focus on the properties of these OpenPGP artifacts and how they are used, while adding context that is not elaborated on in the RFC.

## Which version of OpenPGP does this address?

The documentation will mainly cover version 6 of OpenPGP, while occasionally noting differences to previous versions that are relevant to application developers.

Version 4 of OpenPGP will remain relevant for a number of years;
some version 3 artifacts are still in use as of this writing.