# PGP's Legacy Design and Cryptographic Deficiencies

DevFeed: [PGP's Legacy Design and Cryptographic Deficiencies](<https://devfeed.tech/articles/the-pgp-problem-29171.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2019/07/16/the-pgp-problem/>)

Published: 2019-07-17T01:14:00Z

Content type: opinion

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [Security, Privacy and Abuse Prevention](<https://devfeed.tech/topics/security-privacy-and-abuse-prevention.md>)

Tags: [certificates](<https://devfeed.tech/tags/certificates.md>), [compression](<https://devfeed.tech/tags/compression.md>), [crypto](<https://devfeed.tech/tags/crypto.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [defects](<https://devfeed.tech/tags/defects.md>), [parsing](<https://devfeed.tech/tags/parsing.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [pgp](<https://devfeed.tech/tags/pgp.md>), [signing](<https://devfeed.tech/tags/signing.md>)

## AI overview

This commentary argues that PGP has significant design and cryptographic deficiencies rooted in its 1990s origins. It examines the complexity of PGP's packet structure, key management, parsing, compression, signing, and encryption features.

## Source excerpt

Cryptography engineers have been tearing their hair out over PGP's deficiencies for (literally) decades. When other kinds of engineers get wind of this, they're shocked. PGP is bad? Why do people keep telling me to use PGP? The answer is that they shouldn't be telling you that, because PGP is bad and needs to go away. There are, as you're about to see, lots of problems with PGP. Fortunately, if you're not morbidly curious, there's a simple meta-problem with it: it was designed in the 1990s, before serious modern cryptography. No competent crypto engineer would design a system that looked like PGP today, nor tolerate most of its defects in any other design. Serious cryptographers have largely given up on PGP and don't spend much time publishing on it anymore (with a notable exception). Well-understood problems in PGP have gone unaddressed for over a decade because of this.