39

On this answer, cjk says

RSA and PGP are different.

What you are essentially asking is how do I run my petrol car on diesel? The answer is you can't.

I would be interested in a more detailed comparison between the two, why they are different, and why one would choose one over the other.

Pang
  • 185
  • 6
makerofthings7
  • 50,090
  • 54
  • 250
  • 536

2 Answers2

73

RSA is an algorithm (actually, two algorithms: one for asymmetric encryption, and one for digital signatures -- with several variants). PGP is originally a piece of software, now a standard protocol, usually known as OpenPGP. OpenPGP defines formats for data elements which support secure messaging, with encryption and signatures, and various related operations such as key distribution. As a protocol, OpenPGP relies on a wide range of cryptographic algorithms, which it assembles together (which is not as easy as it seems, if you want the result to be secure). Among the algorithms that OpenPGP can use is RSA.

So, to keep with the car analogy, your question is like: "What is the difference between a combustion engine and a Honda Accord ? Why would one choose one over the other ?" The question makes no sense per se: the Accord comes with a combustion engine under its lid. It also comes with a bunch of other useful features, such as wheels; you cannot do much with a combustion engine alone.

Still in that analogy, you can imagine cars without a combustion engine, e.g. electric cars. Translated into the OpenPGP world, the question becomes: can OpenPGP perform its work without using RSA ? And the answer is yes: there are other asymmetric encryption and digital signature algorithms that OpenPGP can use, which will provide the same functionality than what OpenPGP uses RSA for. Historically, when OpenPGP was first defined, there were still a few unsolved questions about the RSA patent, so implementations were encouraged to use El Gamal and DSA (for asymmetric encryption and digital signatures, respectively), instead of RSA. (The RSA patent expired in 2000)

Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949
11

PGP is a software suite of encryption algorithms and the ability to encrypt emails, files, etc. RSA is a specific algorithm for encryption and digital signatures. There is also a difference between PGP (the $ one) and GPG (the free one).

It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both).

PulpSpy
  • 2,204
  • 15
  • 19