What are the doubts, fears, concerns, or criticisms about OpenPGP and its future?

Enter a comma separated list of user names.
June 10, 2020

The author of this article did a pretty good job of centralizing many different elements of the history of end-to-end encrypted communication system. He situates the history of PGP among a broader history of communication systems over the Internet. However, it is a biaised history, as he does not present new developments and implementations of the program (such as the Sequoia projet, the Pretty Easy Privacy project, or many email providers that have native PGP support (ProtonMail, Mailfence, etc.). The criticisms he formulates about PGP are somehow very classical: he quotes, among others, the 2004 OTR article, Green's 2013 "What's the matter with pgp?", Valsorda's 2016 "I'm giving up on PGP", and Lactora's 2019 "PGP Problem", which present well-developed criticisms about PGP. Here's are the most important ones that the article mentions:

  • No forward secrecy
  • Non-repudiation signature scheme
  • Email has no future and its underlying infrastructure is too old. We should move to secure messaging
  • Complexity of the PGP protocol
  • The GnuPG manual is too long and complex
  • Too few users

About this last point, it is interesting to note that when Efail was disclosed, in May 2018, many people, among others journalists, complained that this disclosure was putting them at risk and many voices from the infosec community criticized the disclosure process because of this. There is thus an obvious contradiction that would be interesting to dig into.

In general, the defenders' opinions do not appear in this article.

The author of this history also ignores the fact that much work is being done on the standard specification (see the openpgp-wg/rfc4880bis repository on gitlab) and many emerging projects have come into light (Sequioa, keys.openpgp.org, Pretty Easy Privacy, and so on).

Creative Commons Licence