PGP
Pretty Good Privacy — asymmetric encryption for email and files. Public keys encrypt; private keys decrypt and sign.
PGP — today standardized as OpenPGP and implemented most widely by GnuPG — provides two operations: encryption to a recipient’s public key, and signatures that only the holder of the matching private key could have produced. In the Tor ecosystem signatures matter most: projects sign canary statements, newsrooms sign their Onion Address lists, and markets use PGP challenges for 2FA.
The hard part is the key, not the math
The cryptography is rarely the failure point. The failure is binding a key to an identity: a fingerprint copied from the same page as the address it is meant to verify proves nothing, because an attacker replaces both. Verification has to come from an independent channel — a key that has survived across mirrors, takedowns, and reposts is worth more than a fresh one on a fresh site.
What PGP does not protect
PGP encrypts content, not metadata: who wrote to whom, when, and how much remains visible to the network. It also does nothing against an endpoint that is already compromised. It complements End-to-End Encryption in transit and the discipline of OPSEC — it replaces neither.
Category: Cryptography