A Schism in the OpenPGP World

Original Article ↗ Hacker News Discussion ↗

A split has emerged in the OpenPGP world as GnuPG resists the IETF’s new “crypto-refresh” standard, arguing that format changes and new cipher modes add complexity and risk breaking interoperability for the sake of marginal benefits. Supporters of the refresh counter that the long‑criticized OpenPGP format needs modernization to address clear security flaws and to align with contemporary authenticated encryption practices. Around this technical rift lies a broader question: how much effort to invest in PGP at all, given its poor usability, fragile key management, and the rise of alternative tools like Signal, Matrix, age, and platform‑specific signing systems.

Scope of the schism

  • Split between “crypto-refresh” OpenPGP work and the LibrePGP camp centered around GnuPG.
  • One side prioritizes modernizing primitives and cleaning up long‑standing issues, even if this complicates compatibility.
  • The other side prioritizes long-term interoperability, simplicity of migration, and minimizing churn for existing deployments.

Backwards compatibility vs security

  • Some argue “don’t break compatibility” is essential, especially for decades‑old encrypted data and widely deployed tooling.
  • Others argue strict backward compatibility has already led to serious flaws (e.g., downgradeability, MDC handling, strip‑and‑modify attacks) and becomes “security theater.”
  • Debate over whether old formats should continue to be natively supported vs. decrypted once and re‑encrypted with modern schemes.
  • Comparisons are made to deprecating old TLS versions; disagreement over whether keeping weak modes around is ever justified.

Technical critiques of OpenPGP/GnuPG

  • OpenPGP format described as complex, brittle, and historically insecure in places (packet layout, MDC, downgrade paths).
  • GnuPG criticized for:
    • Releasing unauthenticated plaintext in some cases.
    • Introducing OCB mode in ways that can break interoperability with other implementations.
  • Others counter that, used sanely (signing, symmetric AES, OCFB‑MDC), current OpenPGP is “actually secure enough.”

Email vs modern secure messaging

  • Many cryptography‑minded commenters say encrypted email is structurally flawed: metadata leakage, downgrade issues, poor UX, easy user errors.
  • Recommendation from that camp: use Signal/Matrix/other E2EE messengers for human‑to‑human communication; use specialized tools for backups, app data, etc.
  • Pushback: messengers don’t replace email’s ubiquity, federation, long‑form, archival, and “business” use; phone‑number identity and centralization are non‑starters for some.

Key management, Web of Trust, and alternatives

  • Keyservers, revocation, and Web of Trust widely described as a “dumpster fire” that never scaled; poisoning attacks and inconsistent trust semantics cited.
  • Some still value PGP’s long‑term identity and signing capabilities (code, packages, documents), especially in Linux distros and server‑side software distribution.
  • Others view PGP’s identity model (long‑lived keys, shared across use cases) as a serious design mistake.
  • Alternatives mentioned:
    • For file encryption: age, minisign/signify, bespoke per‑use tools.
    • For identity and signing: emerging systems (e.g., Sigstore, new protocols) and application‑specific PKI.
  • Overall sentiment: PGP remains heavily used in some niches (notably package/repo signing) but is seen by many as outdated, hard to use correctly, and politically fragmented.