GNU Privacy Guard (GnuPG)

GNU Privacy Guard (GnuPG, often shortened to GPG) is a free, open source encryption tool built to provide privacy and integrity in digital communication.

It is an implementation of the OpenPGP standard, which means it lets users encrypt and digitally sign messages and files so that the content stays confidential and any tampering is detectable.

It is one of the oldest pieces of security software still in daily use, and its most important job today is not email. It is signature verification: package repositories, release artefacts and Linux distributions are signed with it, and a great deal of software supply chain trust rests on those signatures being checked.

What it does

Encryption. It uses both symmetric and asymmetric algorithms. A file or message is encrypted with the recipient’s public key, and only the holder of the matching private key can decrypt it, so only the intended recipient can read the content.

Digital signatures. A user signs a file or message with their private key. Anybody with the corresponding public key can verify that the content came from that key and has not been altered in transit. That is what a digital signature buys you, and it is independent of whether the content was encrypted.

Identity, through a web of trust. GnuPG does not depend on a hierarchy of certificate authorities. Users sign each other’s keys, and confidence in a key comes from who else has vouched for it. This is a different trust model from the one browsers use, and the difference matters in practice.

Interoperability. It runs across platforms and works with other OpenPGP implementations, which is what keeps the format usable between organisations that have chosen different tooling.

A worked example

Somebody wants to send a confidential file to a colleague by email.

They use GnuPG to encrypt the file with the colleague’s public key, so that only the colleague, who holds the corresponding private key, can decrypt it.

They also sign the file with their own private key, so the recipient can confirm both that the content is intact and that it came from the expected sender.

The colleague decrypts with their private key and verifies the signature. Those are two separate checks answering two separate questions, and it is worth being explicit about it: encryption answers who can read this, and the signature answers who wrote it.

GnuPG, PGP and OpenPGP

Three names for things that are related and not the same, and mixing them up is common enough to be worth separating.

PGP was the original program, released in 1991, and later a commercial product line.

OpenPGP is the open standard that came out of it, specified by the IETF in RFC 4880 and since revised. It defines the message format and the key format, not any particular program.

GnuPG is a free software implementation of that standard, and the one most systems have installed.

Two things are worth knowing before adopting it as an organisation. The first is that the web of trust does not scale the way public key infrastructure does: there is no authority to revoke a key centrally, and in practice revocation depends on the holder publishing a revocation certificate they may no longer be able to produce. The second is key handling: a private key that lives unprotected on a laptop is only as safe as that laptop, which is why serious deployments keep the key on a smartcard or a hardware token.

And a limitation that gets missed: OpenPGP encrypts the message, not the metadata. Who wrote to whom, when, and with what subject line, stays visible.

Where to read more

gnupg.org: the official site, with the manuals, the user guide and the reference documentation.

openpgp.org: information about the standard itself, the technical specification and the implementations that support it.