GnuPG 2.5.19 Arrives with Post-Quantum Encryption — and a Two-Month Warning

GnuPG 2.5.19 Arrives with Post-Quantum Encryption — and a Two-Month Warning

Werner Koch has released GnuPG 2.5.19, bringing new features and bug fixes while sounding an urgent reminder: the widely-used 2.4 branch reaches end-of-life in approximately two months.

On April 24, 2026, Werner Koch — lead developer and founder of the GnuPG project — announced the release of version 2.5.19. The update adds a handful of new options, resolves several bugs, and carries forward the flagship feature of the entire 2.5 series: support for Kyber, the post-quantum key encapsulation mechanism standardized as ML-KEM (FIPS-203), designed to resist decryption by future quantum computers.

What Changed in 2.5.19

This is not a security-emergency release — the urgency is about the 2.4 end-of-life clock, not a newly discovered vulnerability. The changelog for version 2.5.19 (released 2026-04-24) lists the following noteworthy additions:

• New --use-ocb-sym option for gpg — enables OCB (Offset Codebook Mode) for symmetric encryption, offering authenticated encryption with better performance characteristics.
• New --show-[only-]session-hash options for gpg — exposes session hash details useful for debugging and verification workflows.
• gpgsm cipher mode flexibility — the cipher mode can now be specified directly as part of the algorithm string passed to --cipher-algo.
• Improved CRL diagnostics in gpgsm — more verbose output when a CRL distribution point (crlDP) check fails, aiding certificate troubleshooting.
• Various additional bug fixes compared to version 2.5.18.

The Bigger Picture: Post-Quantum Cryptography in the 2.5 Series

The headline capability of the entire 2.5.x series — introduced in earlier releases and now carried into 2.5.19 — is support for Kyber, also known as ML-KEM or FIPS-203. This is a post-quantum cryptography (PQC) algorithm standardized by NIST, designed specifically to withstand attacks from large-scale quantum computers that would break today’s RSA and ECC-based encryption.

“The main features in the 2.5 series are improvements for 64-bit Windows and the introduction of Kyber (aka ML-KEM or FIPS-203) as PQC encryption algorithm.” — Werner Koch, GnuPG Announce List, April 24, 2026

The threat model Kyber addresses is sometimes called “harvest now, decrypt later” — where adversaries intercept and store encrypted traffic today with the intent of decrypting it once quantum computers become powerful enough. Adopting PQC algorithms now protects against that future scenario.

Importantly, Koch notes that the forthcoming 2.6 stable series will not differ dramatically from 2.4 in terms of user-visible behavior. The 2.5 series exists as a bridge: fully production-ready and supported, but still receiving features before the 2.6 stable freeze. All versions remain fully interoperable.

GnuPG at a Glance

For those less familiar: GNU Privacy Guard (GnuPG, or GPG) is a free, open-source implementation of the OpenPGP standard. It is the dominant tool for encrypting files and email, verifying digital signatures, and authenticating identities on Linux and beyond. It underpins APT package verification on Debian-based systems, powers the pass password manager, enables Git commit signing on platforms like GitHub, and provides the S/MIME and SSH authentication functions used by millions of developers worldwide.

Key Workflows, Refreshed

Encryption: asymmetric key exchange

GPG uses a hybrid approach. Asymmetric public-key cryptography (RSA, ECC, or now Kyber for PQC) secures the key exchange; a fast symmetric cipher (AES-256 by default since 2.1) handles the actual data. A sender encrypts using the recipient’s public key; only the holder of the corresponding private key can decrypt. This elegantly solves the problem of transmitting decryption keys over untrusted channels.

Digital signatures: integrity and authenticity

When signing, GPG computes a cryptographic hash of the file and encrypts that hash with the sender’s private key. The recipient verifies the signature using the sender’s public key — confirming both that the file came from the claimed author and that it has not been modified in transit. This is how Linux distributions guarantee the integrity of software packages: every apt update silently verifies GPG signatures on repository metadata.

Common commands

# Generate a new key pair (interactive)
gpg --full-generate-key

# List your public keys
gpg --list-keys

# Encrypt a file for a recipient
gpg -e -r recipient@example.com file.txt

# Decrypt a file
gpg -d file.txt.gpg

# Sign a file (detached signature)
gpg --detach-sign file.txt

# Verify a signature
gpg --verify file.txt.sig file.txt

Why the 2.4 EOL Matters to You

GnuPG’s policy is to maintain older branches for at least two years after a new stable series is declared. The 2.4 series has served as “old stable” since the 2.5 branch was declared stable — and its time is almost up. After EOL, the 2.4 branch will no longer receive bug fixes or security patches.

For system administrators managing servers that rely on GPG for package verification, encrypted backups, or signed deployments — and for developers using GPG for commit signing or secret management via pass — upgrading to 2.5.19 before the EOL window closes is the recommended path. The migration is straightforward: GnuPG guarantees full compatibility between versions, so existing keys, signatures, and encrypted files all continue to work without modification.

Looking Ahead: GnuPG 2.6

The 2.6 series — the next stable milestone — is not expected to introduce sweeping changes for most users. Koch has described it as largely a re-platform of the 2.4 codebase to take advantage of newer APIs in the underlying Libgcrypt library, plus the post-quantum Kyber additions that have already landed in 2.5. The 2.5 series serves as the functional equivalent of a release candidate for 2.6, and it is fully supported for production use today.

GnuPG 2.5.19 is available now from gnupg.org. Packages for Debian, Devuan, and Ubuntu are available through repos.gnupg.org.