OpenPGP is the enduring, decentralized standard for securing digital messages and sensitive files.

Cultures · Published 10 October 2026 · Updated 25 October 2026 Swipe more like this →

In short: Born from Phil Zimmermann's 1991 PGP program, OpenPGP has evolved into a critical Internet standard. It secures communications through a hybrid of symmetric and public-key cryptography, allowing users to verify identities via digital signatures and protect data from prying eyes, even in the face of evolving quantum computing threats.

At its core, OpenPGP functions as a hybrid cryptosystem. It uses symmetric-key encryption for the message itself, while the session key required to decrypt that message is protected by the recipient's public key. This ensures that only the intended holder of the corresponding private key can access the content. Beyond confidentiality, the standard provides authentication through digital signatures, where a hash of the plaintext is signed with the sender's private key, allowing recipients to verify the source.

The challenge of verifying that a public key truly belongs to a specific person led to the development of the web of trust. First described by Zimmermann in 1992, this decentralized model relies on users designating trusted introducers and accumulating certifying signatures. While this avoids the centralized control of traditional certificate authorities, it remains a manual process that lacks a universally accepted solution. More recent specifications have introduced trust signatures to support hierarchical certificate authorities, offering a middle ground between total decentralization and standard PKI schemes.

The standard's evolution has been marked by both technical progress and internal friction. The transition from RFC 4880 to the current RFC 9580, finalized in July 2024, involved a contentious process known as 'crypto-refresh.' This effort aimed to modernize cryptographic primitives and address documented vulnerabilities, though it faced opposition from some long-term contributors, including GnuPG author Werner Koch. Despite these disagreements, the standard continues to advance, with recent additions like RFC 9980 in June 2026 introducing post-quantum cryptography to ensure long-term security against future computing capabilities.

OpenPGP remains a vital tool for privacy, supported by a wide array of software including GnuPG, RNP, and OpenPGP.js. While vulnerabilities like the 2017 ROCA flaw or the 2018 EFAIL bug have highlighted the risks of implementation errors, the underlying specification has proven resilient. As it integrates newer algorithms and adapts to the post-quantum era, OpenPGP continues to serve as a foundational, if complex, pillar of digital security.

General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.

Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?

Related

• How a 1985 breakthrough in public-key cryptography powers modern secure communication today
• How a compromised certificate authority birthed the internet's public ledger
• Why the Secure Shell protocol remains the internet's most trusted digital tunnel
• How digital signatures mathematically guarantee that your electronic documents have not been tampered with
• Why the same secret key is the backbone of modern digital privacy
• How a single memoir became a Trojan horse for television representation
• Why One World Trade Center stands exactly 1,776 feet above Lower Manhattan
• How Orchestral Manoeuvres in the Dark defined the sound of electronic pop
• Why the second season of One Tree Hill remains its most watched television run
• The US order of precedence is a ceremonial guide, not a legal mandate
• Why the American one-drop rule still shapes how we see race today
• Oregon's name remains a mystery, likely born from a mapmaker's error or misheard word.

More in US culture · More in Cultures · Latest · A–Z · All topics