|
|
|
@ -32,10 +32,16 @@ The name "OpenPGP" can be used freely by implementations (unlike the name "PGP",
|
|
|
|
|
|
|
|
|
|
|
|
GnuPG has been the major Free Software implementation of OpenPGP for a period of time. It has played an important (and successful) role in the release of NSA documents by [Edward Snowden](https://theintercept.com/2014/10/28/smuggling-snowden-secrets/).
|
|
|
|
GnuPG has been the major Free Software implementation of OpenPGP for a period of time. It has played an important (and successful) role in the release of NSA documents by [Edward Snowden](https://theintercept.com/2014/10/28/smuggling-snowden-secrets/).
|
|
|
|
|
|
|
|
|
|
|
|
Note: The terms "pgp key" and "gpg key" are often used interchangably. Since both PGP and GnuPG are just some out of many existing OpenPGP implementations, the proper term to use is "OpenPGP key".
|
|
|
|
Note: The terms "pgp key" and "gpg key" are sometimes used interchangeably. Since both PGP and GnuPG are just some out of many existing OpenPGP implementations, the proper term to use is "OpenPGP key" (or "OpenPGP certificate", more on that later [link]).
|
|
|
|
|
|
|
|
|
|
|
|
## The present
|
|
|
|
## The present
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### OpenPGP version 4
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
In 2007, [RFC 4880](https://datatracker.ietf.org/doc/html/rfc4880), defining version 4 of OpenPGP, was published.
|
|
|
|
|
|
|
|
This version is currently most commonly used
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
(major_implementations)=
|
|
|
|
### Multiple major implementations
|
|
|
|
### Multiple major implementations
|
|
|
|
|
|
|
|
|
|
|
|
Today multiple new Free Software implementations of OpenPGP play important roles:
|
|
|
|
Today multiple new Free Software implementations of OpenPGP play important roles:
|
|
|
|
@ -44,29 +50,47 @@ Today multiple new Free Software implementations of OpenPGP play important roles
|
|
|
|
- The Thunderbird email software is using the [RNP](https://www.rnpgp.org/) implementation for their built-in OpenPGP support since version 78 (released in mid-2020).
|
|
|
|
- The Thunderbird email software is using the [RNP](https://www.rnpgp.org/) implementation for their built-in OpenPGP support since version 78 (released in mid-2020).
|
|
|
|
- The RPM Package Manager software includes an OpenPGP backend based on [Sequoia PGP](https://sequoia-pgp.org/), a modern OpenPGP implementation in Rust. Fedora [uses Sequoia PGP in rpm](https://sequoia-pgp.org/blog/2023/04/27/rpm-sequoia/) since version 38.
|
|
|
|
- The RPM Package Manager software includes an OpenPGP backend based on [Sequoia PGP](https://sequoia-pgp.org/), a modern OpenPGP implementation in Rust. Fedora [uses Sequoia PGP in rpm](https://sequoia-pgp.org/blog/2023/04/27/rpm-sequoia/) since version 38.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## The road ahead
|
|
|
|
|
|
|
|
|
|
|
|
### OpenPGP version 6
|
|
|
|
### OpenPGP version 6
|
|
|
|
|
|
|
|
|
|
|
|
This document mainly describes OpenPGP version 6, which brings many updates of the core cryptographic mechanisms, compared to the previous version 4.
|
|
|
|
As of this writing (in 2023), [version 6 of OpenPGP](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/) is approaching publication as an RFC.
|
|
|
|
|
|
|
|
The working group's [charter](https://datatracker.ietf.org/wg/openpgp/about/#autoid-1) centers around updating the cryptographic mechanisms, adding new algorithms, and deprecation of obsolete algorithms.
|
|
|
|
|
|
|
|
|
|
|
|
As of this writing (in 2023), version 4 of OpenPGP is still most commonly used. OpenPGP version 4 is described in [RFC 4880](https://datatracker.ietf.org/doc/html/rfc4880).
|
|
|
|
This document mainly describes OpenPGP version 6, while pointing out differences to previous versions that are relevant to application developers.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Multiple implementations have already done significant work on support for version 6.
|
|
|
|
|
|
|
|
|
|
|
|
## Concepts
|
|
|
|
## Concepts
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Building on the cryptographic building blocks OpenPGP uses, it provides the following high-level functionalities.
|
|
|
|
|
|
|
|
|
|
|
|
### Certificates/Keys
|
|
|
|
### Certificates/Keys
|
|
|
|
|
|
|
|
|
|
|
|
All uses of OpenPGP are centered around (asymmetric) cryptographic key material. In OpenPGP, cryptographic keys are combined with additional metadata into "OpenPGP Keys", or "OpenPGP Certificates".
|
|
|
|
Use of OpenPGP is centered around (asymmetric) cryptographic keys. In OpenPGP, these keys are combined with additional metadata into "OpenPGP certificates" - also often referred to as "OpenPGP keys."
|
|
|
|
|
|
|
|
|
|
|
|
See chapter "certs" (link) for more on OpenPGP Certificates, and "private" for handling of private key material in OpenPGP.
|
|
|
|
See the [certificates chapter](certificates_chapter) for more on OpenPGP certificates, and their internal makeup, and the [private key chapter](private_key_chapter) for handling of private key material in OpenPGP.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Other important topics around certificates are their management, authentication, and trust models. We will only touch on those, in this document.
|
|
|
|
|
|
|
|
|
|
|
|
### Cryptographic operations
|
|
|
|
### Cryptographic operations
|
|
|
|
|
|
|
|
|
|
|
|
- Signatures
|
|
|
|
The main operations of OpenPGP are discussed in the following chapters:
|
|
|
|
- Encryption
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### Internal structure of OpenPGP data
|
|
|
|
- [Encryption](encryption_chapter) and [Decryption](decryption_chapter)
|
|
|
|
|
|
|
|
- [Digital signatures](signatures_chapter)
|
|
|
|
|
|
|
|
|
|
|
|
OpenPGP data is structured as "packets" (and sometimes "subpackets"), internally.
|
|
|
|
## Zooming in: Internal structure of OpenPGP data
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OpenPGP data is internally structured as "packets" (and sometimes "subpackets"). We'll go into some detail about this, throughout the coming chapters.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
add a tiny bit more detail here
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
(interop_section)=
|
|
|
|
## Interoperability
|
|
|
|
## Interoperability
|
|
|
|
|
|
|
|
|
|
|
|
```describe, and link to interop test suite```
|
|
|
|
OpenPGP has been defined as a standard with the express goal of enabling multiple parties to build interoperable implementations. This has already been a success early on, but in recent years, there has been [much development of new implementations]((major_implementations)).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
While interoperability has been an informal goal in the OpenPGP space since the initial standardization, since 2019 the Sequoia project is maintaining and operating the more formal ["OpenPGP interoperability test suite"](https://tests.sequoia-pgp.org/). This test suite has identified numerous [issues](https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite#hall-of-fame).
|
|
|
|
|
heiko