Skip to content
ecdsa.com

LibrePGP

An OpenPGP specification maintained by GnuPG's author (draft-koch-librepgp) that continues the RFC 4880bis line with v5 keys and its own Kyber composite encryption, incompatible with RFC 9580's v6 keys.
Also written asLibrePGPv5 keydraft-koch-librepgpRFC 4880bis

The split became public in late 2023, when GnuPG's author published LibrePGP as an alternative to the IETF working group's "crypto refresh", which became RFC 9580 in July 2024. LibrePGP v5 keys have SHA-256 fingerprints like v6 keys but a different format, and GnuPG 2.5 uses them for its post-quantum keys (ML-KEM-768 or ML-KEM-1024 with ECC, final since GnuPG 2.5.1 in September 2024).

For users the practical rules are: v4 keys and the algorithms of RFC 4880 work everywhere; v5 keys work with GnuPG and implementations that chose LibrePGP; v6 keys work with RFC 9580 implementations such as Sequoia and OpenPGP.js. Before publishing a new-format key, check what the people and systems verifying it can read. The description here is neutral by intent: both groups argue their design is the better path.

Standards and references

All terms