Recommended reading: GnuPG manuals, RFC 9580 and books

The GnuPG manual, available as HTML and PDF from gnupg.org. It is written by the developers and covers every gpg command and option, plus gpg-agent, dirmngr and the other tools. The same text is installed as man pages: try man gpg. Two chapters are worth reading in full: “How to manage your keys” and the list of configuration options. When a blog post and the manual disagree, trust the manual for your version.

New to all this? Start with this site’s install guide and How PGP works, then dip into the manual as questions come up.

For ideas, yes. For commands, be careful. The GNU Privacy Handbook is copyright 1999. Its chapters on symmetric, public-key and hybrid ciphers, and on trust and validity, still explain the ideas well. Its key sizes, algorithms and keyserver examples are from another era.

Yes, the GnuPG FAQ, but it says it was last checked for accuracy in October 2017. Parts are clearly out of date: it still mentions pool.sks-keyservers.net, a keyserver pool that shut down in 2021. Its answers on revocation certificates, lost passphrases and validation are still sound.

The Gpg4win project publishes the Gpg4win Compendium. The latest English edition is version 3.0.0, released 2016-11-30, as a PDF. The project itself says the English text is not on the same level as the German original. Use it for the concepts. Screens and defaults in current Gpg4win releases will differ.

The GnuPG project runs the gnupg-users mailing list for general help, in English. There are also lists in German, Spanish, Portuguese and Russian, and gnupg-announce for release news. Only subscribers can post. Messages from others wait for a moderator. Subscribe on the mailing lists page. The Usenet groups listed in the old FAQ, such as comp.security.pgp.discuss, belong to history.

RFC 9580, “OpenPGP”, was published in July 2024 on the IETF Standards Track. It replaces RFC 4880, the format most software implemented for years, and two add-ons: RFC 5581 (Camellia) and RFC 6637 (elliptic-curve cryptography). It is long and precise. For a first pass, read section 2 (general functions), section 5.2 (signatures) and section 13 (security considerations). The background is in OpenPGP standards: RFC 1991, 2440, 4880 and 9580, and why not every program follows the newest one.

OpenPGP for application developers is a free online book from the “Notes on OpenPGP” project, under a CC BY-SA 4.0 license. It is written for people who build OpenPGP into their own programs, covers both the version 4 and the newer version 6 formats, and has a migration guide from v4 to v6.

• Serious Cryptography, 2nd Edition, Jean-Philippe Aumasson. No Starch Press, August 2024, ISBN 978-1-7185-0384-7. A practical introduction to modern cryptography. It covers symmetric and public-key techniques, elliptic curves, TLS, and quantum and post-quantum cryptography.
• Real-World Cryptography, David Wong. Manning, September 2021, ISBN 978-1-61729-671-0. Explains the cryptography inside everyday protocols, including signatures, secure messaging and post-quantum work, with little math.

Neither is a PGP manual. They explain why the algorithms in RFC 9580 were chosen.

• Applied Cryptography: Protocols, Algorithms and Source Code in C, 20th Anniversary Edition, Bruce Schneier. Wiley, March 2015, ISBN 978-1-119-09672-6. The book the old FAQ recommended in its 1990s edition. Read it for the ideas and the history. Its algorithm advice is older than today’s standards.
• The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography, Simon Singh. Paperback August 29, 2000, ISBN 978-0-385-49532-5. A readable history of secret writing and code-breaking, from ancient times to the computer age.

The PGP books in the original FAQ’s reading list are from 1994–1995. They describe PGP 2.x commands, IDEA, MD5 and the email keyservers, and none of that applies to current software. They are interesting history. The full list is in the original FAQ, kept in the archive at /pub/pgp/pgp-faq/faq.html. For today’s commands, the GnuPG manual and the guides on this site are a better bet than any printed book.

• Publish it on keys.openpgp.org and verify your address, or set up a Web Key Directory on your own domain.
• Put your full fingerprint on your website, business card or profile page, where people can compare it.
• A fingerprint in an email signature is convenient but proves nothing by itself, since a forged email can carry a forged fingerprint.
• Quote fingerprints, never short key IDs. The GnuPG FAQ’s sample configuration uses keyid-format long for the same reason.

Only if you also encrypt them to yourself. Add your own key as an extra recipient in ~/.gnupg/gpg.conf:

encrypt-to C9D3642643533F47C090431DF2C9F13D0062B815

GnuPG uses it only when you are encrypting to someone else as well, and does no trust check on it. --no-encrypt-to turns it off for one command. The trade-off is the same as in the 1990s: anyone who later gets your private key can read everything you sent.

• gpg --show-keys file.asc lists the keys in a file without importing them, so you can check the fingerprint first.
• gpg --list-packets file.gpg shows the packets inside a message or key. The manual calls it “only useful for debugging”, but it is also the best way to see how PGP works.
• gpg --fingerprint --fingerprint you@example.org (the option twice) also prints the fingerprints of your subkeys.
• gpg --export-ownertrust backs up the trust values you set, which you cannot recreate from a damaged trust database.