The identity of a PGP user is given by a master key. This key usually has a very long expiration to keep the same identity for a long time. The master key is a key pair made up of the master public key and the master private key.

One or more User IDs can be bound to a master key. A User ID is made up of three parts in this format:

real name (comment) <email address>

For example:

John Smith (Doc Services) <john.smith@example.org>

It is possible to have multiple User IDs for situations where the user is known by different names in different circles. For example, another User ID can be created for the personal email address. This would help keep the personal communication separate from work.

A PGP user needs more than one key. For example, it is a good idea to use different keys for signature and encryption. It is also a good idea to change the encryption key regularly to reduce the risk of an attack.

PGP defines a subkey as a key bound to a master key. A subkey is an ordinary key that has been signed by the master key to indicate it belongs to the same identity. The advantage is a subkey can be revoked independently of the master key. For example, the master key is usually restricted to key creation and signing. A separate subkey is used just for encryption. This approach makes it possible to change the encryption key more frequently and still keep the user identity intact as the master key. It is also possible to have subkeys for signature but this is less common.

The master key together with all its subkeys is called a key ring. PGP often stores a key ring in a file which is also called a key ring. This is somewhat confusing, since a key ring file may contain multiple key rings, and is therefore more akin to a key ring collection. The public keys are stored in a public key ring file, and the private keys are stored in a secret key ring file. The public and the secret key rings are created when the first master key is created.

It is possible to retrieve a key from a key ring file based on the User ID or one of its subparts (usually the email address). Since the User IDs are bound to a master key, the search will first identify the first key ring that matches in the key ring file. It will then return the first suitable key among the key ring, which could be the master key or one of its subkeys. This search is somewhat ambiguous but is often adequate.

To retrieve a (sub)key more precisely, it is possible to use the Key ID which is a string of 16 hexadecimal digits computed from a hash of the key. PGP also defines the Short Key ID as the right-most 8 hexadecimal digits of the Key ID. Short Key IDs are more convenient for humans at the expense of a somewhat higher risk of collision. For extremely precise identification of the key, PGP defines the fingerprint as a string of 40 hexadecimal digits. The chance of collision with a fingerprint is extremely small.

You will need to distribute your public key to let partners verify your signature and encrypt messages destined to you. PGP makes it easy to export your public key from your public key ring. The resulting document is called a public key, but it is more akin to a certificate since it contains the master public key, the public keys of the subkeys, and the User IDs. The public key can be uploaded to a public key server, posted on a web site, or sent directly to the partner. The partner will import this public key within his public key ring. Conversely, you will import your partner public keys in your own public key ring. This will add another master key to the public key ring. This one is different than your master key because there is no associated private master key in the secret key ring.

PGP defines a web of trust to certify a key really belongs to a user. A user can claim complete or partial trust in the identity of another user. This is a generalization of the strictly hierarchical model used in X509. The PGP extension has complete trust in all public keys in the public key ring. The contents of the public key ring must be carefully managed to reflect this assumption.