2022, people still use and make new implementations of OpenPGP. In 2015, I was already describing OpenPGP as a horror show for cryptographers. People need to move on! The format is wrong. The implementations are wrong. The mandatory ciphers are outdated. The web of trust is mostly dead since the key servers are broken.
What are the alternatives to OpenPGP that I can start using today?
Very good question. Thank you for asking.
To sign documents, I would recommend using signify or minisign.
To encrypt files, I guess one could use age
If you need a cryptolibrary, I would recommend nacl or sodium. In Go, I use nacl a lot. If you need to encrypt or sign very large files, I wrote a small library based on nacl.
Emails are the tricky part. It really depends on your workflow. When I was working for a gov infosec agency, we learned to never use any integrated email crypto solution. Save the blob, decrypt the blob in a secure environment. This helps significantly against leaks and against creating an oracle to the attacker’s benefit.
For data containers, I would use dm-crypt and dm-verity + a signed root. But that’s just me and I would probably not recommend this to other people :)
OpenPGP is rarely used in messaging protocols, but if it was I would probably advise leveraging a double ratchet library.
One example of issues with OpenPGP implementations that are a direct consequence of the poor format desgin… https://www.ssi.gouv.fr/uploads/2015/05/format-Oracles-on-OpenPGP.pdf
