The label PGP is now also used loosely for OpenPGP-compatible implementations. OpenPGP is the interoperable message and key format standardized by the Internet Engineering Task Force (IETF), most recently in RFC 9580.
OpenPGP commonly uses hybrid cryptography: a randomly generated session key encrypts content, then public-key methods protect that session key for recipients. It can also attach digital signatures and key information. OpenPGP is a format and protocol family rather than one algorithm, application, or universal way to decide whether a key belongs to a person.
Key points
Protection goalChoose encryption, signing, or both according to whether confidentiality, origin authentication, integrity, or a combination is required.
Identity and trustVerify key fingerprints or other binding evidence through an appropriate channel; possession of a key or a valid signature does not establish that an asserted identity is correct.
Lifecycle and interoperabilityProtect private keys, plan revocation and replacement, test recipient capabilities, and constrain legacy versions, algorithms, and optional features to a documented profile.
Important limitationOpenPGP does not protect compromised endpoints or content after an authorized recipient decrypts it. Message routing, participants, timing, and some headers may remain visible, while incorrect key verification or obsolete implementations can defeat the intended assurance.