Difference between pgp protocol and rsa protocol

Question

These are the two widely used protocols in a number servers and email applications for security with public private key pair. What is the difference between them? What are the other popular protocols available?

Solution

Using a car analogy:

• PGP is a car
• OpenPGP is the design for the PGP car
• GnuPG is another car using the same design
• RSA is a diesel engine, and other engines are available
• SSH isn't a car at all. But it uses engines.

RSA is a public-key cryptosystem. That is, it is an algorithm for encrypting, decrypting and signing data using a set of two keys (the public key and private key).

PGP and GnuPG both offer the use of RSA for general purpose encryption and signing of data. They also offer other options, like Elgamal and DSA.

SSH uses RSA for authentication, not encryption. The server has your public key, and you have the private key, and SSH uses this fact to make sure you are, well, you. SSH also supports other keypairs, for example, ECDSA.

Further reading on the Information Security Stack Exchange:

• How does RSA encryption compare to PGP?
• RSA vs. DSA for SSH authentication keys

And you should probably read What is the difference between SSL vs SSH? Which is more secure? as well.

Comments

[Jens Erat]

I also like the analogy. But better compare OpenPGP with regulations for cars or something like this, nobody cares for how the car looks like nor how the requirements are achieved, as long as they match the rules. The same applies to software: the RFC/standards define a set of rules, but not propose any "software design" at all. Different OpenPGP implementations do things in very different ways.

[Pacerier]

@muru, So how is GnuPG different from PGP? What's the difference? | When Snowden says that "encrypting works", is he talking about PGP or RSA?

[Pacerier]

Is OpenPGP a protocol like TLS?