PGP Encryption Explained
How PGP encryption works step by step: public and private keys, hybrid encryption and digital signatures.
Public key
Who can have it?
It's shared freely, even published. It lets others encrypt messages to you or verify your signatures.
Private key
Who can have it?
It's never shared with anyone. It's used to decrypt messages addressed to you and to sign your own.
Digital signature
What is it for?
A hash of the message encrypted with your private key. Anyone can verify it with your public key.
Step 1 of 6
Encrypt vs. Sign
Encrypt → Confidentiality
The message is encrypted with the recipient's public key, so only whoever holds the matching private key can read it.
Example
Alice encrypts a contract with Bob's public key before emailing it to him.
When to use it
When the content is sensitive and nobody else should be able to read it in transit.
Main risk
It doesn't prove who sent it: anyone with the recipient's public key can encrypt something for them.
Sign → Authenticity and integrity
A hash of the message is encrypted with the sender's private key, so anyone can verify with their public key that it's authentic and wasn't altered.
Example
Alice signs an official statement so everyone can check that it's really hers.
When to use it
When what matters is proving authorship and integrity, even if the content isn't secret.
Main risk
It doesn't hide the content: anyone can read the message; it only verifies that it wasn't altered.
Symmetric vs. asymmetric encryption
Symmetric encryption
It uses a single key to encrypt and decrypt. It's very fast, but that same key must be shared securely between both parties.
Example
In PGP, AES encrypts the message body using a session key generated on the fly.
When to use it
To encrypt large volumes of data quickly, once both parties have the key.
Main risk
If the key leaks while being shared, anyone who has it can decrypt all the content.
Asymmetric encryption
It uses a mathematically linked key pair: what a public key encrypts, only its matching private key can decrypt.
Example
In PGP, RSA/ECC encrypts the session key (not the whole message) with the recipient's public key.
When to use it
To exchange a session key securely without having shared it before through another channel.
Main risk
It's much slower than symmetric encryption for large amounts of data.