Nowadays, encryption is relevant as a nickname. Communication moves to instant messengers, people continue to encrypt electronic messages with digital certificates, but sometimes this may require additional efforts, including exchanging keys through a trust network. In such circumstances, even some long-standing cryptography adherents are forced to abandon PGP . For secure messaging, it is much more convenient to use open source instant messengers and strong end-to-end encryption, such as Signal (see the manual from the Electronic Frontier Foundation).

At the same time, PGP is still used in “machine” operations: for signing packages, encrypting files on disk, etc. But here, PGP is gradually phasing out. For example, the Go community proposes to stop supporting the OpenPGP package because of the “ancient protocol that still causes serious vulnerabilities ”, as well as because of the unsolved key exchange problem and, most importantly, because of the outdated implementation of the protocol itself.

Why even old users refuse PGP, writes well-known information security specialist Filippo Valsorda, who is part of the Cloudflare crypto group and is known as the author of the service for testing for the Heartbleed vulnerability :

Firstly, the problem of the lack of popularity of encryption, about which others talked a lot, has not disappeared. I received a maximum of two encrypted letters per year.

Then, the problem of inconvenience. Easily tolerated critical errors. Confused server listings with keys many years ago. “I cannot read this letter on my phone.” “Or on a laptop, I left the keys, which I’m not using, on another machine.”

But the real problems that I saw are much more subtle. I never felt that my long-term keys are safe. The more time passed, the less confidence in each of them. YubiKey keys can be intercepted in a hotel room. Offline keys can remain in a distant box or safe. May announce new vulnerabilities. They can connect to USB devices.

The security of long-term keys corresponds to the minimum common divisor of your lifelong security actions. This is a weak link.

To make matters worse, existing long-term key handling practices, such as collecting key signatures and printing public key fingerprints on business cards, contradict other patterns of behavior that would otherwise be considered an obvious hygienic routine: often change keys, have different keys on different devices , apply compartmentalization (different profiles of thinking in different areas, for example, at work and at home - approx. per.). Existing long-term key handling practices actually expand the attack vector, as they push for key backups.

This is a rather capacious explanation. But the question arises: if not PGP, then what to use? With e-mail it is clear, it can be replaced with instant messengers with reliable end-to-end encryption. But what to use for signing packages and software updates and file encryption? Fortunately, there are also modern alternatives here .

Package signatures

Linux distributions and update systems for many programs use PGP signatures to ensure file authenticity.

There are simple alternatives for signing packages, for example, signify (sign and verify) from OpenBSD and minisign . These are extremely simple utilities, but thanks to this they are extremely reliable. Both work with the only Ed25519 algorithm (ErDSA): it is a digital signature scheme using a variant of the Schnorr scheme on the Edwards elliptic curve. It is designed for maximum speed and is much faster than RSA. Since both utilities are based on the same algorithm, their digital signatures are compatible with each other, that is, signify can check the signatures generated by minisign, and vice versa.

These are the most minimal alternatives, without the slightest additional functionality. If you manage a serious package distribution infrastructure and require a more functional option, then you can pay attention to The Update Framework (TUF): a flexible framework that adapts to any software update mechanism.



The developers write that TUF is used in production by companies such as Cloudflare, Docker, DigitalOcean, Flynn, IBM, Microsoft, LEAP, Kolide and Vmware, and the TUF option called Uptane is widely used for updating automotive software over the network.

TUF Implementation for Python Package Infrastructure: PEP 458 , PEP 480 . Based on TUFNotary project with a ready-to-use and proven client-server implementation.

File encryption

Modern alternatives to nacl / box and nacl / secretbox are universal programs for encrypting any data. Support symmetric and asymmetric encryption, modern ciphers and protocols.

Service Keybase for encrypting messages in chat rooms, e-mails, files or any other data. The Keybase main site is a public key catalog that maps social network profiles to encryption keys. Keybase also offers encrypted chat (Keybase Chat), a cloud-based file storage system (Keybase or KBFS file system) and Git repositories.


Keybase-Mounted KBFS File System

Generally, it is a fully functional PGP alternative for data encryption.

Encrypted File Transfer

In the last century, it was customary to encrypt a file, protect it with a password, and transfer it as an attachment by e-mail. This option is possible today, but there are more modern alternatives. For example, the Firefox Send service for exchanging encrypted files recently left beta . Files are encrypted on the sender’s computer, and decrypted on the recipient’s computer (JS in the browser). The service generates a link to a file with a limit on the lifetime or number of downloads. If you do not trust JS, then you can encrypt files, for example, using the magic-wormhole program . The program is installed on the computers of the sender and receiver, uses modern cryptographic techniques PAKE



(password-authenticated key agreement) and generates passwords from several words, breaks through firewalls and supports Tor.



We live in the 21st century. There are much better options than sending encrypted files by mail. Signature



certificates for Microsoft Office documents , Adobe PDF, LibreOffice and others.

GlobalSign provides ample opportunity to implement trusted digital signatures . From desktop, server to cloud implementations. More details