← Back to Blog Comparison

Is PGP/GPG Dead? Post Quantum Cryptography Alternatives Compared

7 min read

PGP/GPG Is Quantum-Vulnerable

PGP (Pretty Good Privacy) and GPG (GNU Privacy Guard) rely on RSA, DSA, ElGamal, and ECDH. All are broken by Shor's algorithm. For any message encrypted with PGP today that needs multi-decade confidentiality, Harvest Now Decrypt Later is a real threat.

The OpenPGP PQC Migration

The IETF OpenPGP working group is specifying PQC extensions:

Hybrid encryption: combine ECDH + ML-KEM for key exchange.
Hybrid signatures: combine ECDSA + ML-DSA.
Standalone PQC: pure ML-KEM, pure ML-DSA where appropriate.

As of April 2026 these drafts are maturing; OpenPGP PQC should be deployable in production releases of GnuPG and equivalents through 2026-2027.

What to Do Right Now

Short-lived messages: continue using PGP/GPG for now but plan migration.
Long-lived archives: re-encrypt with Post Quantum Cryptography-aware tools. QNSQY, for example, supports ML-KEM + X25519 hybrid for data at rest.
Subkeys: if feasible, use hybrid subkey patterns.
Archives backed up in the cloud: encrypt with PQC-native tools before uploading; do not rely on classical PGP alone for long-term archive confidentiality.

Alternatives to PGP/GPG

Signal: for interactive messaging, deployed PQXDH (hybrid X25519+Kyber-1024) since September 19, 2023.
age: modern encryption tool, classical only as of 2026 but popular simplicity over PGP.
QNSQY: hybrid ML-KEM + X25519 data encryption supporting FIPS 203/204/205.
Wire: secure messaging with some PQC capability.

Frequently Asked Questions

Is PGP/GPG still secure today?

Classically yes. PGP/GPG using RSA-3072 or ECDH P-256 is secure against classical attackers today. It is not quantum-safe, and the HNDL threat applies to long-lived data.

When will GnuPG support ML-KEM?

IETF OpenPGP working group has draft specifications. Production GnuPG support is expected in 2026-2027 as drafts finalize.

Should I migrate off PGP now?

For data with multi-decade confidentiality lifetimes, yes, migrate to PQC-aware tools. For short-lived email signatures and transient messages, the urgency is lower.

Is age quantum-safe?

Classical age uses X25519. It is not quantum-safe. age-pqc variants exist in experimental form but are not mainstream as of April 2026.

Sources

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/pgp-gpg-vs-pqc-alternatives.