Hello No Spam thank you for your constructive comment. We’ve reached out to our developers and here’s the response.
The main reason we didn’t use an open source PGP library is the message authentication would give away the sender. For our use cases like “private linking”, we do not want validation that leaks metadata about the sender. Off-The-Record had the same problem (Deniable authentication and conflates non-repudiation) with PGP: https://otr.cypherpunks.ca/otr-wpes.pdf For the rest of VPG, we cherry-picked PGP’s strong attributes.
Some will say that we could implement the deniable authentication with PGP by creating ephemeral keys but it would have been a workaround mess. Also, none of the PGP or GPG libraries we could find had the up to date algorithms (Sept 2018). For PGP, backward compatibility is a high priority so it supports so many algorithms that are not used anymore but kept so the code bases are bloated and confusing to use. VPG has a small footprint (not much code) and is lightweight because it doesn’t need to support legacy algorithms. It produces smaller ciphertext because it doesn’t need to add info in the header about which algorithms were used and the other legacy info PGP adds to the message header. VPG should also run faster and support large group encryption better than PGP.
Adding the algorithms needed and working around the message auth issue with OpenVGP or GnuPG would have been far more work than writing VGP. Proton Mail uses GoLang and they added the extra algorithms needed to support curve25519 and ed25519. We didn’t want to use several GoLang libraries from C++. Again, not impossible but not a good idea.
If the code was FOSS, we wouldn’t be getting so many negative comments because many (including our team) do not like proprietary open source code. Many think open source should be free as well.
The license could be subject to change in the future, but it is needed right now to prevent forking BDAP before release.
If you would be interested in asking any questions directly to our developers or just have a chat, join us on Discord https://discord.gg/3Wg7CaT
