What is PGP and how is it used on Tor markets?

Pretty Good Privacy (PGP), and its free-software equivalent GnuPG, are tools that implement the OpenPGP standard for asymmetric encryption and digital signing. On Tor marketplaces PGP appears in three places: encrypting an order note to a vendor, verifying that a mirror-rotation announcement came from the marketplace operator, and signing your own messages so that a counterparty can prove they came from you.

Encrypting an order note

Each vendor publishes a public key on their profile page. Import it into your PGP client. Encrypt your shipping address against the vendor’s key, paste the encrypted block into the order notes. The marketplace operator never sees the plaintext — only the vendor can decrypt it.

Verifying a mirror announcement

Operators publish endpoint rotations as detached-PGP-signed messages on Dread. Import the operator’s public key once. Paste a signed announcement into your PGP client; if the signature validates, the announcement came from the operator. If the signature does not validate, treat the announcement as untrusted regardless of how convincing the formatting looks.

Which client to use

Desktop: Kleopatra (Windows; ships in Gpg4win), GPG Suite (macOS), gpg command-line (Linux, BSD, macOS). Mobile: OpenKeychain on Android. Tor Browser does not bundle PGP; key management is handled outside the browser process.

Key hygiene

Your private key is the credential. Keep it under a passphrase on a volume that you do not use for unrelated browsing. Back up the revocation certificate offline at the moment of generation; a revoked key cannot be unrevoked, and a lost private key cannot be regenerated.

See also

Two jobs, and people learn one

It encrypts, so only the intended reader can open a message. It signs, so a reader can prove a message came from the holder of a particular key. Both matter here for different reasons, and learning to encrypt while never verifying a signature is doing the half that protects you least.

What to encrypt and what not to bother with

Encrypt anything that identifies a person or a place, because anything typed into a message box otherwise sits on the platform in readable form. Do not bother encrypting whether an item is in stock. Making routine exchanges tedious is how people fall out of the habit for the messages that actually matter.

Where keys should be generated

On your own machine, with a local tool. A key generated in a browser on somebody else server is a key somebody else has seen, which makes it worthless for both jobs. Set a passphrase on the private half, keep it on the machine, and never paste it anywhere for any reason.

Verification is the highest value piece

If you learn one part, learn to check a signed announcement. It is the strongest available defence against a fake address, stronger than anything a directory can offer, because it does not require trusting the directory. It also does not require managing a key of your own at all.