Pretty Good Privacy (PGP): cryptography, history and uses

Key characteristics

PGP implementations typically offer:

• Hybrid cryptography: a short-lived symmetric session key encrypts the message body while a recipient's public key encrypts that session key.
• Digital signatures: messages and files can be signed so recipients can verify the sender's identity and message integrity.
• Key management: distributed public-key sharing via keyservers and a user-driven trust model known as the web of trust.
• Interchange formats: binary packets and ASCII-armored blocks for transporting encrypted or signed data.

PGP is closely related to broader concepts like cryptographic techniques and authentication methods, and it is commonly used for signing and encrypting messages.

History and standards

Phil Zimmermann released the first PGP program in 1991 as a way to make strong cryptography accessible to individuals. Its release prompted debates about software export controls and government review in the 1990s; ultimately, no criminal charges were filed. The need for interoperability led to the OpenPGP standard, formalized as RFC 4880, which describes message formats and packet types used by PGP-compatible software.

Uses and ecosystem

PGP and OpenPGP-compatible tools are used to secure email, encrypt files and archives, sign software packages, and protect backups. Multiple implementations exist, including free and open-source projects and commercial products; users often share public keys through keyservers and verify identities via the web of trust. For practical advice on using PGP with email clients and services, consult resources on secure communications and community guides at further resources.

While PGP technology remains influential, users should understand the differences among implementations, the importance of key hygiene, and how trust decisions work in practice. OpenPGP-compatible tools continue to evolve to address modern cryptographic best practices and usability concerns.