mirror of
https://codeberg.org/openpgp/notes.git
synced 2024-11-27 01:52:06 +01:00
Sorted out rough flow of ch1
This commit is contained in:
parent
c8054b9120
commit
913612b0ee
1 changed files with 42 additions and 33 deletions
|
@ -1,37 +1,36 @@
|
||||||
# OpenPGP: what is it, history
|
# Notes on OpenPGP
|
||||||
|
|
||||||
This document is intended as an introduction to the inner workings of OpenPGP,
|
An introduction to the concepts of OpenPGP, aimed mainly at software
|
||||||
aimed mainly at technical readers.
|
developers who are looking to use OpenPGP functionality in their projects.
|
||||||
|
|
||||||
It is *not* a guide for *use* of OpenPGP by end-users.
|
This document describes
|
||||||
|
[OpenPGP version 6](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/),
|
||||||
|
with occasional remarks about differences to earlier versions.
|
||||||
|
|
||||||
|
This text is *not* intended as a guide for end-users who use OpenPGP-related software.
|
||||||
|
|
||||||
## What is OpenPGP?
|
## What is OpenPGP?
|
||||||
|
|
||||||
OpenPGP is an open standard that was developed based on the
|
OpenPGP is an open standard for cryptographic operations.
|
||||||
|
It has grown out of the
|
||||||
["Pretty Good Privacy (PGP)"](https://en.wikipedia.org/wiki/Pretty_Good_Privacy)
|
["Pretty Good Privacy (PGP)"](https://en.wikipedia.org/wiki/Pretty_Good_Privacy)
|
||||||
software.
|
software.
|
||||||
|
|
||||||
The standard has evolved over time, and there is ongoing work to improve it.
|
OpenPGP is an open standard, there are many widely used
|
||||||
[RFC 4880](https://datatracker.ietf.org/doc/html/rfc4880) is the most recent
|
(and [interoperable](https://tests.sequoia-pgp.org/)) implementations.
|
||||||
published version of the standard (describing OpenPGP version 4).
|
|
||||||
|
|
||||||
An IETF working group is currently finalizing a
|
## A very brief history
|
||||||
[new revision](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/),
|
|
||||||
of the OpenPGP standard (which will describe OpenPGP version 6).
|
|
||||||
The current standardization work focuses on updating the cryptographic
|
|
||||||
mechanisms in OpenPGP.
|
|
||||||
|
|
||||||
There are multiple [interoperable](https://tests.sequoia-pgp.org/)
|
The OpenPGP standard has evolved over time.
|
||||||
implementations with significant use.
|
|
||||||
|
|
||||||
## A very brief history (dramatis personae)
|
(Also see https://www.openpgp.org/about/history/)
|
||||||
|
|
||||||
### PGP
|
### "Pretty Good Privacy (PGP)"
|
||||||
|
|
||||||
*"Pretty Good Privacy (PGP)"* is a software program, initially by Phil
|
The earliest roots of OpenPGP trace back to *"Pretty Good Privacy (PGP)"*,
|
||||||
Zimmermann, first released in 1991.
|
a software program, written by Phil Zimmermann and first released in 1991.
|
||||||
|
|
||||||
The PGP software has played a role in the political struggles sometimes
|
The original PGP software has played a role in the political struggles sometimes
|
||||||
referred to as the ["Crypto Wars"](https://en.wikipedia.org/wiki/Crypto_Wars)
|
referred to as the ["Crypto Wars"](https://en.wikipedia.org/wiki/Crypto_Wars)
|
||||||
(also see https://en.wikipedia.org/wiki/Crypto_(book) for some of that history,
|
(also see https://en.wikipedia.org/wiki/Crypto_(book) for some of that history,
|
||||||
including about the history of PGP).
|
including about the history of PGP).
|
||||||
|
@ -45,38 +44,48 @@ The software enjoys a continued existence, albeit with
|
||||||
[changing name and scope](https://en.wikipedia.org/wiki/Pretty_Good_Privacy#PGP_Corporation_encryption_applications).
|
[changing name and scope](https://en.wikipedia.org/wiki/Pretty_Good_Privacy#PGP_Corporation_encryption_applications).
|
||||||
|
|
||||||
|
|
||||||
### OpenPGP
|
### Standardizing OpenPGP
|
||||||
|
|
||||||
While the PGP software was developed as a commercial product, the owner at the time,
|
While the PGP software was developed as a commercial product, the owner at the time,
|
||||||
"PGP Inc." started a standardization effort with the IETF in July 1997.
|
"PGP Inc." started a standardization effort with the IETF in July 1997.
|
||||||
The resulting open standard was named
|
The resulting open standard was named
|
||||||
[OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP).
|
[OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP).
|
||||||
|
|
||||||
The result of this first round of standardization work under the "OpenPGP"
|
The result of this early standardization work is
|
||||||
name is [RFC 2440](https://datatracker.ietf.org/doc/html/rfc2440),
|
[RFC 2440 "OpenPGP Message Format"](https://datatracker.ietf.org/doc/html/rfc2440),
|
||||||
published November 1998.
|
published November 1998.
|
||||||
|
|
||||||
The name "OpenPGP" can be used freely by implementations (unlike the name
|
The name "OpenPGP" can be used freely by implementations (unlike the name
|
||||||
"PGP", which is a [registered trademark](https://uspto.report/TM/74685229)).
|
"PGP", which is a [registered trademark](https://uspto.report/TM/74685229)).
|
||||||
|
|
||||||
### GnuPG
|
### GnuPG, a free software implementation
|
||||||
|
|
||||||
[First released 1997-12-20](https://gnupg.org/download/release_notes.html#sec-2-70),
|
[First released 1997-12-20](https://gnupg.org/download/release_notes.html#sec-2-70),
|
||||||
GnuPG is an implementation of the OpenPGP standard.
|
GnuPG is an implementation of the OpenPGP standard.
|
||||||
|
|
||||||
GnuPG has been the major Free Software implementation of OpenPGP for a period
|
GnuPG has been the major Free Software implementation of OpenPGP for a period
|
||||||
of time. It has played a role in the release of NSA documents by
|
of time. It has played an important and successful role in the release of NSA
|
||||||
[Edward Snowden](https://theintercept.com/2014/10/28/smuggling-snowden-secrets/)
|
documents by [Edward Snowden](https://theintercept.com/2014/10/28/smuggling-snowden-secrets/).
|
||||||
|
|
||||||
## Multiple major implementations
|
## The present
|
||||||
|
|
||||||
|
### Multiple major implementations
|
||||||
|
|
||||||
Today, multiple implementations of OpenPGP play an important role:
|
Today, multiple implementations of OpenPGP play an important role:
|
||||||
|
|
||||||
- Protonmail, who serve a large number of users, use (and maintain)
|
- Protonmail, who provide email encryption services for a large number of users,
|
||||||
[OpenPGP.js](https://openpgpjs.org/).
|
use (and maintain) [OpenPGP.js](https://openpgpjs.org/).
|
||||||
- The Thunderbird email software is using the [RNP](https://www.rnpgp.org/)
|
- The Thunderbird email software is using the [RNP](https://www.rnpgp.org/)
|
||||||
implementation for their built-in OpenPGP support since version 78 (released in mid-2020).
|
implementation for their built-in OpenPGP support since version 78 (released in mid-2020).
|
||||||
- The RPM Package Manager software includes an OpenPGP backend based on
|
- The RPM Package Manager software includes an OpenPGP backend based on
|
||||||
[Sequoia PGP](https://sequoia-pgp.org/), a modern OpenPGP implementation in Rust.
|
[Sequoia PGP](https://sequoia-pgp.org/), a modern OpenPGP implementation in Rust.
|
||||||
Fedora [uses Sequoia PGP in rpm](https://sequoia-pgp.org/blog/2023/04/27/rpm-sequoia/)
|
Fedora [uses Sequoia PGP in rpm](https://sequoia-pgp.org/blog/2023/04/27/rpm-sequoia/)
|
||||||
since version 38.
|
since version 38.
|
||||||
|
|
||||||
|
### OpenPGP version 6
|
||||||
|
|
||||||
|
This document mainly describes OpenPGP version 6, which brings many updates of the core cryptographic mechanisms,
|
||||||
|
compared to the previous version 4.
|
||||||
|
|
||||||
|
As of this writing (in 2023), version 4 of OpenPGP is still most commonly used.
|
||||||
|
OpenPGP version 4 is described in [RFC 4880](https://datatracker.ietf.org/doc/html/rfc4880).
|
||||||
|
|
Loading…
Reference in a new issue