Seven articles on how OpenPGP actually works at the byte level, written for people who implement, audit or research it — not for people learning to send an encrypted email. Built against RFC 9580 and RFC 9980, with every major attack in the format's history worked through in mechanism rather than summary: the CFB quick-check oracle, EFAIL's gadget construction, SigSpoof's status-line injection, and the certificate flooding that permanently killed the SKS network.
The framing layer: OpenPGP vs legacy headers, all six length encodings, the tag table and the critical/non-critical split at 40, MPI vs native encoding, the message grammar, and a parser hardening checklist.
Certificates as signed graphs, v4 vs v6 key packets, how bad SHA-1 fingerprints really are, why key IDs are never identifiers, the back signature that stops attribution theft, and S2K through Argon2.
The quick-check oracle, why a trailing MDC could never protect a streaming decryptor, the full EFAIL gadget construction and its three integrity bypasses, and how chunked AEAD fixes it.
The hash input and trailer, the hashed/unhashed split that leaves half the packet forgeable, signature type confusion, cleartext canonicalization traps, and twenty years of spoofed verification in the interface.
Trust depth and amount, the real propagation algorithm and its network-flow formulation, how certificate flooding destroyed SKS without any software bug, and WKD, DANE and key transparency.
RFC 9980's composite ML-KEM and ML-DSA, why a KEM combiner must bind ciphertexts, SLH-DSA for long-lived roots, the RFC 9580 vs LibrePGP split, and a staged migration plan.
Every RFC, draft, paper, attack disclosure, book, talk, course, library, tool and mailing list worth your time — plus three learning roadmaps and what to be skeptical of.