Editing Pretty Good Privacy (section)

==Limitations==

With the advancement of cryptography, parts of PGP and OpenPGP have been criticized for being dated:

* The long length of PGP public keys, caused by the use of RSA and additional data other than the actual cryptographic key<ref name="2014_green">{{cite web |url=https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ |first=Matthew |last=Green |title=What's the matter with PGP? |date=August 13, 2014 |publisher=A Few Thoughts on Cryptographic Engineering |access-date=December 19, 2016 |archive-date=October 5, 2024 |archive-url=https://web.archive.org/web/20241005182349/https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ |url-status=live }}</ref>
* Lack of [[forward secrecy]]<ref name="2014_green" />
* Use of outdated algorithms by default in several implementations<ref name="2014_green" />
* Difficulty for the users to comprehend and poor usability<ref name="2015_marlinspike">{{cite web |url=https://moxie.org/2015/02/24/gpg-and-me.html |first=Moxie |last=Marlinspike |title=GPG And Me |access-date=June 21, 2020 |date=February 24, 2015 |archive-date=October 5, 2024 |archive-url=https://web.archive.org/web/20241005182854/https://moxie.org/2015/02/24/gpg-and-me.html |url-status=live }}</ref>
* Lack of ubiquity<ref name="2015_marlinspike" />

In October 2017, the [[ROCA vulnerability]] was announced, which affects RSA keys generated by buggy Infineon firmware used on [[Yubikey]] 4 tokens, often used with OpenPGP. Many published PGP keys were found to be susceptible.<ref name=nemecsys>[https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli] {{Webarchive|url=https://web.archive.org/web/20171112012916/https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf |date=November 12, 2017 }}, Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec, Vashek Matyas, November 2017</ref> Yubico offers free replacement of affected tokens.<ref name=yubicokeyreplace>{{Cite web|url=https://www.yubico.com/keycheck/verify_otp|title=Yubico Replacement Program|access-date=June 13, 2018|archive-url=https://web.archive.org/web/20181222101837/https://www.yubico.com/keycheck/verify_otp|archive-date=December 22, 2018|url-status=dead}}</ref>