The GNU Privacy Guard (GnuPG or GPG) is a free replacement for the PGP Cryptographic Suite, licensed under the GPL v3 license. It is part of the GNU All Free Software Foundation project, and it has received important funding from the German government. GnuPG fully complies with RFC 4880, the IETF standard for OpenPGP. The current versions of PGP (and Filecrypt of Veridis) are interoperable with GnuPG and other OpenPGP compliant systems. GnuPG is a stable and mature software. It is often included in free operating systems, such as FreeBSD, OpenBSD and NetBSD, and almost all Linux distributions. GnuPG can be compiled by many operating systems.
GnuPG encrypts messages using asymmetric key pairs individually generated by GnuPG users.
Users can exchange keys in different ways, for example using Internet key servers. A person will make his key publicly known to others. By knowing the public key of a person, users can send messages that only the recipient can open. Also, through the signature received in an email, users can verify the identity of the user and whether the message is the original one.
The exchange of keys should be done carefully so that the public keys don’t change from one user to another. If a user manages to change the public key of another user, then he can sign and decrypt the messages instead of the real person.
To use the GnuPG system, you will need a public key and a private key (commonly known as the “key pair”). Each is a long string of random numbers and letters that are unique to you. Your public and private keys are linked together by a special mathematical function.
Your public key does not resemble a physical key because it is kept in sight in an internet catalog called a key server. People download it and use it, along with GnuPG, to encrypt the letters they are sending. You can think of the key server as a phonebook where people who want to send you an encrypted letter look for your public key.
Your private key resembles more with a physical key, because you are the one having it (holding it on your computer). You use GnuPG and the private key to decode the encrypted letters that other people send you.
In general, the terms GnuPG, GPG, GNU Privacy Guard, OpenPGP (PGP Open), and PGP are used alternately for the same. Technically speaking, OpenPGP (Pretty Good Privacy) is the encryption standard and “GNU Privacy Guard” (often abbreviated GPG or GnuPG) is the program that implements the standard. Enigmail is a program module for your e-mail program that provides an interface for GnuPG. GnuPG (GNU Privacy Guard) is a complete and free implementation of the OpenPGP standard that is defined in RFC4880.
GnuPG Functions:
– symmetrical encryption;
– asymmetric encryption;
– generation and management of public and private keys;
– digital signature;
– verification of digital signatures;
– Easy integration with other libraries and standards such as S/MIME (Aegypten project provides S/MIME functionality in GnuPG);
For increased security, it is recommended to check the integrity of any program installed in the system. Here we refer to servers, kernel, various utilities, system updates, etc. GnuPG is the most used program for this purpose.