PGP/GPG, Encrypted Email, and the Problem of Old Archives
PGP and GPG remain useful tools, but they show clearly why post-quantum migration matters: a file may use strong symmetric encryption for its contents while relying on a quantum-vulnerable public-key system to protect the key that unlocks it.
The question readers are really asking
Are my old PGP/GPG-encrypted emails and files safe after Q-Day?
Not necessarily. It depends on how they were encrypted.
Many OpenPGP archives use a hybrid design: the message or file is encrypted with a random symmetric session key, then that session key is encrypted to the recipient’s public key, often using RSA or elliptic-curve cryptography.
The symmetric layer protects the actual contents. The public-key layer determines who can recover the session key. A sufficiently capable quantum computer could threaten that classical public-key layer.
The practical question is:
Which important archives use classical public-key encryption, and how long would their contents still matter if revealed?
The short answer
Classical RSA- and elliptic-curve PGP/GPG encryption is a post-quantum migration concern, even when the file itself uses AES.
This does not mean every encrypted archive is immediately unsafe. A file encrypted only with a strong passphrase and modern symmetric encryption is a different case. But an archive protected by an RSA or elliptic-curve public key should not be assumed to remain confidential indefinitely against a future quantum computer.
The sensible response is to identify valuable archives now, protect them well today, and prepare to decrypt and re-encrypt them once compatible post-quantum migration paths are mature.
How OpenPGP encryption usually works
File or email
↓
Encrypted with a random symmetric session key
↓
Session key encrypted to each recipient's public key
↓
Encrypted message or archive
The session key encrypts the actual message, often using AES. The recipient’s public key protects that key.
That distinction explains why saying “my file uses AES” is not enough. The file may use AES internally, but access to the AES key may still depend on a public-key envelope that a future quantum computer could defeat.
The OpenPGP standards path has been updated
The OpenPGP Crypto Refresh, RFC 9580, modernized the core OpenPGP standard. It is now accompanied by RFC 9980, a standards-track extension that adds post-quantum algorithms to OpenPGP. RFC 9980 defines hybrid public-key encryption that combines ML-KEM with elliptic-curve cryptography, hybrid signatures that combine ML-DSA with elliptic-curve cryptography, and standalone SLH-DSA signatures.
This is an important foundation for future migration, but it does not turn existing keys or old ciphertext into post-quantum protection. GPG and other OpenPGP tools must implement the new standards, present them safely to users, and interoperate with correspondents. Watch the official documentation of the tools you use rather than assuming that an update will automatically create or migrate post-quantum keys.
Why old encrypted files cannot become PQ-safe retroactively
Suppose an archive was created today using a classical RSA or elliptic-curve recipient key, and an adversary keeps a copy of the ciphertext.
Later, the owner upgrades to a post-quantum key or re-encrypts the original archive. That protects the new version. It does not alter the older copy already collected by the adversary.
The old ciphertext still contains the original public-key protection. If that protection becomes vulnerable, the retained copy may become readable.
This is harvest now, decrypt later in its clearest form. Migration protects future files and newly re-encrypted copies; it cannot replace the cryptography on copies that have already left your control.
Public-key encryption and symmetric encryption are different risks
Public-key-encrypted archive
A random file key is encrypted to one or more recipient public keys. If those keys use RSA or classical elliptic-curve cryptography, the public-key layer is threatened by Q-Day.
Symmetrically encrypted archive
The file is protected directly by a strong secret passphrase or key, without a public-key recipient envelope. AES-256 and other strong symmetric methods remain useful, although password quality and key management are crucial.
A symmetric-only archive is not automatically safe. Weak passphrases, obsolete settings, malware, stolen recovery keys, and careless backups can expose it today. But its post-quantum problem is different from the public-key problem.
Signatures matter too
PGP/GPG is used for digital signatures as well as confidentiality. A signature helps verify who signed a file or message and whether it was changed.
RSA, ECDSA, and EdDSA signatures also use public-key mathematics that a future quantum computer could threaten. This matters for signed software, research artifacts, legal documents, code releases, and archived correspondence.
A historical signature does not instantly become meaningless. But future verifiers may no longer be able to rely on it alone as proof of authorship. Important long-term records may eventually need renewed signatures, trusted timestamps, or other archival evidence under stronger methods.
Who should pay special attention?
This issue is especially relevant to people with archives that may remain valuable for years:
- researchers with unpublished data, source code, peer-review files, or collaboration records;
- lawyers and clients with privileged communications or case files;
- activists, journalists, and civil-society organizations with sensitive correspondence;
- system administrators with encrypted configuration backups, credentials, and key archives;
- institutions with confidential records; and
- people with old private correspondence, family archives, financial records, or personal documents.
Not every old .gpg, .pgp, or encrypted-email file is an emergency. But valuable archives should not be forgotten simply because they are old.
Start with an archive inventory
For important encrypted archives, record:
- Where the archive is stored. Include laptops, external disks, cloud folders, email stores, backup systems, and retired devices.
- What protection it uses. Is it encrypted to an RSA or elliptic-curve public key, a symmetric passphrase, or both?
- Which private keys and passphrases are needed. Confirm they are available, protected, and backed up.
- How long confidentiality matters. A short-lived working file has a different priority from a health, legal, research, or institutional archive.
- Whether copies may already exist elsewhere. Sent attachments, recipient mailboxes, shared folders, and old backups may all matter.
This inventory is useful now: it prevents important records from becoming inaccessible because an old private key, passphrase, or compatible software has been lost.
Decrypting and re-encrypting valuable archives
When mature, interoperable post-quantum-capable tools and policies are available, valuable archives may need a controlled process:
Locate and verify the old archive
↓
Decrypt it in a trusted environment
↓
Create a new encrypted archive using approved protection
↓
Verify restoration and preserve protected recovery information
↓
Decide how to retain or dispose of the old ciphertext
For organizations, this should include access controls, backup procedures, and validation of the new archive. Do not decrypt sensitive material on an untrusted device or upload it to a service whose key-control model is unclear.
Do not rush to re-encrypt everything today merely because a product uses “quantum” marketing. Start with inventory and preservation: make sure important archives can still be opened, are backed up safely, and are ready for migration.
What readers should do now
- Identify important PGP/GPG archives and encrypted-email stores. Prioritize records that must remain confidential for many years.
- Preserve access. Protect private keys, passphrases, revocation material, and recovery instructions; test critical archives.
- Keep more than one protected backup. Do not place every archive copy, key, and recovery item in one location.
- Include signatures in the migration plan. Long-lived signed records may need stronger future signatures or archival evidence.
- Watch for credible PQC migration support. Prefer documented standards-based upgrades over vague “quantum-proof PGP” claims.
What readers do not need to do
Most people do not need to delete old archives, decrypt every historical email immediately, or abandon PGP/GPG before a credible and compatible post-quantum migration path is available.
Takeaway: A typical PGP/GPG archive uses strong symmetric encryption for its contents, but a classical public-key system protects the key that unlocks them. For valuable long-lived archives, identify that dependency now and plan to re-encrypt when post-quantum migration tools are ready.
Key terms
OpenPGP / PGP / GPG
A family of standards and tools used to encrypt, decrypt, and digitally sign email, files, and other data.
Session key
A random symmetric key that encrypts the actual contents of an OpenPGP message or file.
Public-key encryption
Encryption that uses a recipient’s public key to protect a session key or other secret.
Symmetric encryption
Encryption that uses a shared secret key to protect and decrypt the actual data.
Digital signature
A cryptographic proof used to verify the claimed source and integrity of a file or message.
OpenPGP PQC extension (RFC 9980)
A standards-track extension to OpenPGP that adds post-quantum encryption and signature options, including hybrid methods.
Archive inventory
A record of important encrypted archives, where they are stored, what keys they need, and how long their confidentiality matters.
0 comments