How PGP works in 5 minutes

To understand how PGP works at a high level, you need to understand two key methods of cryptography:

• Symmetric key cryptography
• Asymmetric key cryptography (public key cryptography)

Symmetric key cryptography is analogous to two parties using the same key to lock and unlock a box containing secret contents. It's symmetric because the keys used to lock and unlock are identical. In a an exchange using symmetric key cryptography, Bob encrypts data using key A and sends it over to Alice who decrypts it using key A. Anyone who possesses key A can decrypt the data.

Asymmetric key cryptography is when two parties use a pair of different keys to lock and unlock a box containing secret contents. One key to lock, the other one to unlock. One is known as the public key (shared with senders) and the other the private key (guarded by receiver). They're asymmetric because the locking key is not the same as the unlocking key. In an exchange using asymmetric key cryptography, Bob shares his public key with Alice and Alice uses the public key to encrypt the data. Alice sends the data to Bob and he decrypts it using his private key. Since Bob is the only person with the private key, only he can decrypt the data. The public key is like a mailbox you can give to anyone where anyone can put messages in but the only person who can take messages out is the owner of the mailbox. 

PGP combines both methods to allow for secure communication. Basically, it uses public key cryptography to encrypt a randomly generated temporary session key which is also used to encrypt data. 

Here's how it works:

1. Bob shares his public PGP key with Alice.
2. Alice wants to send a message and generates a random session key. 
3. Alice uses the session key to encrypt her message.
4. Alice encrypts the session key itself using Bob's public key so that the session key can be sent securely with the encrypted data.
5. Bob receives the encrypted data and the encrypted session key.
6. Bob decrypts the session key. 
7. Bob uses the decrypted session key to decrypt the data.