OpenPGP keys, often referred to as “PGP” keys, are used to encrypt and sign outbound files and to decrypt and verify inbound files.
PGP encryption protects the contents of a file. PGP signatures verify the authenticity of the file’s sender and provides non-repudiation, which prevents the sender from claiming that he or she did not actually send the file.
OpenPGP keys are created as private key pairs, which must be kept secret and never distributed. The public portion of an OpenPGP key pair can be exported to a file to be sent to trading partners. When you establish a relationship with a trading partner, you send each other only OpenPGP public keys.
You can create OpenPGP key pairs and export OpenPGP public keys to send to your trading partner using Diplomat OpenPGP Community Edition, a free PGP automation tool.
OpenPGP is a standard that defines formats for encryption keys and messages.
PGP™ is a trademarked term used by Symantec Corporation for their OpenPGP-compliant products, such as Symantec PGP Command Line.
Many commercial products like McAfee E-Business Server and free products like Diplomat OpenPGP Community Edition comply with the OpenPGP standard.
OpenPGP-compliant products are compatible such that:
PGP™ is a standard for encrypting data. Because Coviant Software uses PGP to encrypt the files it sends and receives, we get a lot of questions about it. Here are the most frequently asked questions we get about PGP and their corresponding answers.
PGP encryption is often handled by complex command line applications, which can be confusing and hard to remember. Diplomat MFT enables simple point-and-click encryption, decryption, signing, and verification with an intuitive interface.
GPG is short for “GnuPG,” an open source implementation of the PGP protocol that provides a command line interface to perform PGP encryption, decryption, signing, verifying, and key management operations.
Because OpenPGP is an open, standard format for data encryption, there are many tools out there which can be used to do required PGP operations. Tools like Diplomat MFT make using PGP point-and-click easy, so there’s no need to use more complicated encryption processes.
GPG can be used to decrypt PGP files because it conforms to the OpenPGP standard. Any message that is encrypted in the OpenPGP format can be decrypted by GPG or any other standard conforming tool, like Diplomat MFT, which automates the use of proper command line syntax for the various operations like encrypting, decrypting, signing, and verifying.
The OpenPGP standard lists multiple algorithms for public key algorithms, including RSA, Elgamal, and DSA.
The OpenPGP standard lists multiple algorithms for symmetric data encryption, including 3DES, IDEA, CAST5, BlowFish, TwoFish, AES (128,192, and 256-bit), and Camellia (128, 192, and 256-bit).
The OpenPGP standard lists multiple algorithms for hashes on the data (which are used for integrity checking and signatures), including MD5, SHA-1, RIPE-MD/160, and SHA2 (224, 256, 384, and 512-bit).
The OpenPGP standard lists multiple algorithms for data compression, including ZIP, ZLIP, and BZIP2.
It is important to note that only a few of these algorithms–DSA and Elgamal; 3DES; and SHA-1–are required to be implemented by the OpenPGP Standard. However, this minimal requirement is regarded as insecure because algorithms like 3DES and SHA-1 are considered “broken.” Fortunately, many PGP implementations, such as Diplomat MFT, support all the algorithms of the OpenPGP standard public key algorithms (and a few additional ones, like Elliptic Curve). Diplomat MFT is one such software that supports modern, secure algorithms in its PGP library.