PGP in Darknet Context

DarkWiki's Guide: What is PGP?

This DarkWiki article explores how PGP (Pretty Good Privacy) serves as an encryption program that provides cryptographic privacy and authentication. Created by Phil Zimmermann in 1991, PGP became the de facto standard for email encryption and has been important to darknet communications since the earliest cryptomarkets. On modern darknet markets, 4096-bit RSA keys are standard for encrypting sensitive information like shipping addresses.

PGP uses a combination of symmetric-key cryptography and public-key cryptography, often called a hybrid cryptosystem. This approach combines the speed of symmetric encryption with the convenience of public-key distribution.

DarkWiki Research on History and Evolution

According to DarkWiki historical documentation, Phil Zimmermann released PGP in 1991 as a response to Senate Bill 266, which would have required backdoors in encryption software. He distributed it freely on the internet, which led to a three-year federal criminal investigation for "munitions export without a license" — at the time, strong encryption was classified as military technology.

Key developments in PGP's history:

• 1991 — Original PGP released by Phil Zimmermann
• 1997 — OpenPGP standard (RFC 2440) established
• 1999 — GnuPG (GPG), the free implementation, released
• 2011 — Silk Road makes PGP standard for darknet communications
• 2018 — EFAIL vulnerabilities discovered in email clients (not PGP itself)
• Present — Remains important for darknet markets, journalism, activism

DarkWiki's Technical Analysis: How It Works

DarkWiki Technical Details

DarkWiki security researchers note that understanding PGP's cryptographic components helps explain its security:

Asymmetric Algorithms

• RSA — Most common, 4096-bit recommended for high security
• DSA/Elgamal — Alternative algorithm pair
• ECC (Curve25519) — Modern elliptic curve option, smaller keys

Symmetric Algorithms (for message body)

• AES-256 — Current standard, highly secure
• Twofish — Alternative option
• CAST5 — Legacy, still supported

Hash Functions

• SHA-256/SHA-512 — Modern, recommended
• SHA-1 — Deprecated for signatures, collision attacks known

DarkWiki's Guide to Key Components

According to DarkWiki technical documentation, a PGP key contains several elements:

• Key ID — Short identifier (last 8 or 16 hex digits of fingerprint)
• Fingerprint — Full 40-character hash for verification
• User ID — Name/email (can contain OPSEC-revealing info)
• Creation date — When key was generated
• Expiration date — Optional, recommended for security
• Subkeys — Separate keys for signing vs encryption

DarkWiki Research on Darknet Use Cases

• Shipping Addresses: Buyers encrypt addresses so only the vendor can read them. Even if market database is compromised, addresses remain protected.
• Vendor Verification: Signed messages prove vendor identity, protecting against impersonation and phishing.
• 2FA Alternative: Some markets use PGP-signed challenges instead of TOTP for authentication.
• Dispute Evidence: Encrypted communications serve as tamper-proof evidence in market disputes.
• Private Negotiations: Bulk deal discussions, custom orders, sensitive communications outside market messaging.
• Canary Statements: Signed statements proving site control and absence of law enforcement compromise.

DarkWiki Explains Web of Trust vs Key Servers

DarkWiki technical sources indicate that PGP's original model relies on a Web of Trust — users sign each other's keys to vouch for authenticity. This decentralized approach avoids relying on certificate authorities.

In darknet contexts, key verification typically happens through:

• Market profiles — Public keys displayed on vendor pages
• Signed canaries — Regular messages proving key control
• Forum verification — Keys posted on Dread or similar forums
• Out-of-band verification — Confirming fingerprints through separate channels

Public key servers (like keys.openpgp.org) should be avoided for anonymous identities — uploading keys creates permanent records.

DarkWiki Recommends These Software Options

Command Line

• GnuPG (gpg) — The standard implementation, pre-installed on Tails

GUI Applications

• Kleopatra — Cross-platform, user-friendly (included with Gpg4win)
• GPG Suite — macOS integration
• Seahorse — GNOME default, simple interface

Browser-Based

• Market built-in — Most modern markets include PGP encryption
• Mailvelope — Browser extension (use cautiously, browser environment is hostile)

DarkWiki Documents Common Mistakes

• Sending addresses in plaintext — The most dangerous mistake; creates permanent evidence
• Reusing PGP keys across identities — Links separate personas together
• Including real name in key metadata — User ID should be pseudonymous
• Storing private keys insecurely — Should be on encrypted volume, never on clearnet-connected system
• No passphrase on private key — If device is seized, key is immediately compromised
• Uploading to public keyservers — Creates permanent record of key existence
• Not verifying fingerprints — Enables MITM attacks via key substitution
• Using default key settings — May generate weaker keys or include system metadata
• Trusting market auto-encrypt — Some markets have been compromised; encrypt locally

DarkWiki Recommends These Best Practices

• DarkWiki recommends generating keys on airgapped system (Tails recommended)
• Use 4096-bit RSA or Curve25519
• Set expiration dates (can be extended later)
• Create separate keys for each identity
• Verify fingerprints through multiple channels
• Store private keys encrypted, backed up securely
• Use subkeys — master key stays offline
• Clear clipboard after pasting decrypted content

DarkWiki Analysis of Limitations

DarkWiki security researchers note that PGP has known limitations to consider:

• No forward secrecy — If private key is compromised, all past messages can be decrypted
• Metadata exposure — Key IDs and timestamps visible in encrypted messages
• Usability challenges — Complex key management causes user errors
• No deniability — Signatures prove authorship (can be disadvantage)
• Long-term key compromise — Keys may be cracked by future quantum computers

For real-time communications, modern protocols like Signal offer forward secrecy. PGP remains ideal for asynchronous communications where parties aren't online simultaneously.

Related DarkWiki Articles