Old School Koder: [JAVA] Encrypt/Decrypt With PGP On The Fly

Recently I've been working on a project that need to do PGP encrypt/decrypt. The best solution that I found is here. However the downside is the data need to be written to a file. I've modified the file so that encrypt/decrypt can be done on buffered streams. Below is how I do it.

Dependencies

    <dependency>
      <groupId>org.bouncycastle</groupId>
      <artifactId>bcpg-jdk15on</artifactId>
      <version>1.54</version>
    </dependency>

The Util Class

This is the main util class which will do all the encryption and decryption. I've named it SimplePgpUtil, you can name it however you want.

import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.NoSuchProviderException;
import java.security.SecureRandom;
import java.security.Security;
import java.util.Iterator;

import org.bouncycastle.bcpg.ArmoredOutputStream;
import org.bouncycastle.bcpg.PublicKeyAlgorithmTags;
import org.bouncycastle.bcpg.sig.KeyFlags;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openpgp.PGPCompressedData;
import org.bouncycastle.openpgp.PGPCompressedDataGenerator;
import org.bouncycastle.openpgp.PGPEncryptedData;
import org.bouncycastle.openpgp.PGPEncryptedDataGenerator;
import org.bouncycastle.openpgp.PGPEncryptedDataList;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPLiteralData;
import org.bouncycastle.openpgp.PGPLiteralDataGenerator;
import org.bouncycastle.openpgp.PGPObjectFactory;
import org.bouncycastle.openpgp.PGPOnePassSignatureList;
import org.bouncycastle.openpgp.PGPPrivateKey;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPPublicKeyEncryptedData;
import org.bouncycastle.openpgp.PGPPublicKeyRing;
import org.bouncycastle.openpgp.PGPPublicKeyRingCollection;
import org.bouncycastle.openpgp.PGPSecretKey;
import org.bouncycastle.openpgp.PGPSecretKeyRingCollection;
import org.bouncycastle.openpgp.PGPSignature;
import org.bouncycastle.openpgp.PGPSignatureSubpacketVector;
import org.bouncycastle.openpgp.PGPUtil;
import org.bouncycastle.openpgp.operator.PBESecretKeyDecryptor;
import org.bouncycastle.openpgp.operator.bc.BcKeyFingerprintCalculator;
import org.bouncycastle.openpgp.operator.bc.BcPBESecretKeyDecryptorBuilder;
import org.bouncycastle.openpgp.operator.bc.BcPGPDataEncryptorBuilder;
import org.bouncycastle.openpgp.operator.bc.BcPGPDigestCalculatorProvider;
import org.bouncycastle.openpgp.operator.bc.BcPublicKeyDataDecryptorFactory;
import org.bouncycastle.openpgp.operator.bc.BcPublicKeyKeyEncryptionMethodGenerator;

public class SimplePgpUtil {

 // private static final int BUFFER_SIZE = 1 << 16; // should always be power
 // of 2
 private static final int KEY_FLAGS = 27;
 private static final int[] MASTER_KEY_CERTIFICATION_TYPES = new int[] { PGPSignature.POSITIVE_CERTIFICATION,
   PGPSignature.CASUAL_CERTIFICATION, PGPSignature.NO_CERTIFICATION, PGPSignature.DEFAULT_CERTIFICATION };

 public static PGPPublicKey readPublicKey(InputStream in) throws IOException, PGPException {

  PGPPublicKeyRingCollection keyRingCollection = new PGPPublicKeyRingCollection(PGPUtil.getDecoderStream(in),
    new BcKeyFingerprintCalculator());

  //
  // we just loop through the collection till we find a key suitable for
  // encryption, in the real
  // world you would probably want to be a bit smarter about this.
  //
  PGPPublicKey publicKey = null;

  //
  // iterate through the key rings.
  //
  Iterator<PGPPublicKeyRing> rIt = keyRingCollection.getKeyRings();

  while (publicKey == null && rIt.hasNext()) {
   PGPPublicKeyRing kRing = rIt.next();
   Iterator<PGPPublicKey> kIt = kRing.getPublicKeys();
   while (publicKey == null && kIt.hasNext()) {
    PGPPublicKey key = kIt.next();

    if (key.isEncryptionKey()) {
     publicKey = key;
    }
   }
  }

  if (publicKey == null) {
   throw new IllegalArgumentException("Can't find public key in the key ring.");
  }
  if (!isForEncryption(publicKey)) {
   throw new IllegalArgumentException("KeyID " + publicKey.getKeyID() + " not flagged for encryption.");
  }

  return publicKey;
 }

 public static void encryptStream(OutputStream out, PGPPublicKey encKey, InputStream streamData)
   throws IOException, PGPException {
  Security.addProvider(new BouncyCastleProvider());

  out = new ArmoredOutputStream(out);

  ByteArrayOutputStream bOut = new ByteArrayOutputStream();
  PGPCompressedDataGenerator comData = new PGPCompressedDataGenerator(PGPCompressedData.ZIP);

  writeStreamToLiteralData(comData.open(bOut), PGPLiteralDataGenerator.BINARY, PGPLiteralData.CONSOLE,
    streamData);

  comData.close();

  BcPGPDataEncryptorBuilder dataEncryptor = new BcPGPDataEncryptorBuilder(PGPEncryptedData.TRIPLE_DES);
  dataEncryptor.setWithIntegrityPacket(true);
  dataEncryptor.setSecureRandom(new SecureRandom());

  PGPEncryptedDataGenerator encryptedDataGenerator = new PGPEncryptedDataGenerator(dataEncryptor);
  encryptedDataGenerator.addMethod(new BcPublicKeyKeyEncryptionMethodGenerator(encKey));

  byte[] bytes = bOut.toByteArray();
  OutputStream cOut = encryptedDataGenerator.open(out, bytes.length);
  cOut.write(bytes);
  cOut.close();
  out.close();
 }

 /**
  * decrypt the passed in message stream
  */
 @SuppressWarnings("unchecked")
 public static void decryptFile(InputStream in, OutputStream out, InputStream keyIn, char[] passwd)
   throws Exception {
  Security.addProvider(new BouncyCastleProvider());

  in = org.bouncycastle.openpgp.PGPUtil.getDecoderStream(in);

  PGPObjectFactory pgpF = new PGPObjectFactory(in, new BcKeyFingerprintCalculator());
  PGPEncryptedDataList enc;

  Object o = pgpF.nextObject();
  //
  // the first object might be a PGP marker packet.
  //
  if (o instanceof PGPEncryptedDataList) {
   enc = (PGPEncryptedDataList) o;
  } else {
   enc = (PGPEncryptedDataList) pgpF.nextObject();
  }

  //
  // find the secret key
  //
  Iterator<PGPPublicKeyEncryptedData> it = enc.getEncryptedDataObjects();
  PGPPrivateKey sKey = null;
  PGPPublicKeyEncryptedData pbe = null;

  while (sKey == null && it.hasNext()) {
   pbe = it.next();

   sKey = findPrivateKey(keyIn, pbe.getKeyID(), passwd);
  }

  if (sKey == null) {
   throw new IllegalArgumentException("Secret key for message not found.");
  }

  InputStream clear = pbe.getDataStream(new BcPublicKeyDataDecryptorFactory(sKey));

  PGPObjectFactory plainFact = new PGPObjectFactory(clear, new BcKeyFingerprintCalculator());

  Object message = plainFact.nextObject();

  if (message instanceof PGPCompressedData) {
   PGPCompressedData cData = (PGPCompressedData) message;
   PGPObjectFactory pgpFact = new PGPObjectFactory(cData.getDataStream(), new BcKeyFingerprintCalculator());

   message = pgpFact.nextObject();
  }

  if (message instanceof PGPLiteralData) {
   PGPLiteralData ld = (PGPLiteralData) message;

   InputStream unc = ld.getInputStream();
   int ch;

   while ((ch = unc.read()) >= 0) {
    out.write(ch);
   }
  } else if (message instanceof PGPOnePassSignatureList) {
   throw new PGPException("Encrypted message contains a signed message - not literal data.");
  } else {
   throw new PGPException("Message is not a simple encrypted file - type unknown.");
  }

  if (pbe.isIntegrityProtected()) {
   if (!pbe.verify()) {
    throw new PGPException("Message failed integrity check");
   }
  }
 }

 /**
  * Load a secret key ring collection from keyIn and find the private key
  * corresponding to keyID if it exists.
  *
  * @param keyIn
  *            input stream representing a key ring collection.
  * @param keyID
  *            keyID we want.
  * @param pass
  *            passphrase to decrypt secret key with.
  * @return
  * @throws IOException
  * @throws PGPException
  * @throws NoSuchProviderException
  */
 public static PGPPrivateKey findPrivateKey(InputStream keyIn, long keyID, char[] pass)
   throws IOException, PGPException, NoSuchProviderException {
  PGPSecretKeyRingCollection pgpSec = new PGPSecretKeyRingCollection(PGPUtil.getDecoderStream(keyIn),
    new BcKeyFingerprintCalculator());
  return findPrivateKey(pgpSec.getSecretKey(keyID), pass);

 }

 /**
  * Load a secret key and find the private key in it
  * 
  * @param pgpSecKey
  *            The secret key
  * @param pass
  *            passphrase to decrypt secret key with
  * @return
  * @throws PGPException
  */
 public static PGPPrivateKey findPrivateKey(PGPSecretKey pgpSecKey, char[] pass) throws PGPException {
  if (pgpSecKey == null)
   return null;

  PBESecretKeyDecryptor decryptor = new BcPBESecretKeyDecryptorBuilder(new BcPGPDigestCalculatorProvider())
    .build(pass);
  return pgpSecKey.extractPrivateKey(decryptor);
 }

 public static void encryptFile(OutputStream out, String fileName, PGPPublicKey encKey, boolean armor,
   boolean withIntegrityCheck) throws IOException, NoSuchProviderException, PGPException {
  Security.addProvider(new BouncyCastleProvider());

  if (armor) {
   out = new ArmoredOutputStream(out);
  }

  ByteArrayOutputStream bOut = new ByteArrayOutputStream();
  PGPCompressedDataGenerator comData = new PGPCompressedDataGenerator(PGPCompressedData.ZIP);

  PGPUtil.writeFileToLiteralData(comData.open(bOut), PGPLiteralData.BINARY, new File(fileName));

  comData.close();

  BcPGPDataEncryptorBuilder dataEncryptor = new BcPGPDataEncryptorBuilder(PGPEncryptedData.TRIPLE_DES);
  dataEncryptor.setWithIntegrityPacket(withIntegrityCheck);
  dataEncryptor.setSecureRandom(new SecureRandom());

  PGPEncryptedDataGenerator encryptedDataGenerator = new PGPEncryptedDataGenerator(dataEncryptor);
  encryptedDataGenerator.addMethod(new BcPublicKeyKeyEncryptionMethodGenerator(encKey));

  byte[] bytes = bOut.toByteArray();
  OutputStream cOut = encryptedDataGenerator.open(out, bytes.length);
  cOut.write(bytes);
  cOut.close();
  out.close();
 }

 private static void writeStreamToLiteralData(OutputStream os, char fileType, String name, InputStream streamData)
   throws IOException {
  int bufferLength = 2048;

  byte[] buff = new byte[bufferLength];
  PGPLiteralDataGenerator lData = new PGPLiteralDataGenerator();
  OutputStream pOut = lData.open(os, fileType, name, PGPLiteralData.NOW, buff);

  byte[] buffer = new byte[bufferLength];
  int len;
  while ((len = streamData.read(buffer)) > 0) {
   pOut.write(buffer, 0, len);
  }

  pOut.close();
 }

 @SuppressWarnings("deprecation")
 public static boolean isForEncryption(PGPPublicKey key) {
  if (key.getAlgorithm() == PublicKeyAlgorithmTags.RSA_SIGN || key.getAlgorithm() == PublicKeyAlgorithmTags.DSA
    || key.getAlgorithm() == PublicKeyAlgorithmTags.EC
    || key.getAlgorithm() == PublicKeyAlgorithmTags.ECDSA) {
   return false;
  }

  return hasKeyFlags(key, KeyFlags.ENCRYPT_COMMS | KeyFlags.ENCRYPT_STORAGE);
 }

 @SuppressWarnings("unchecked")
 private static boolean hasKeyFlags(PGPPublicKey encKey, int keyUsage) {
  if (encKey.isMasterKey()) {
   for (int i = 0; i != SimplePgpUtil.MASTER_KEY_CERTIFICATION_TYPES.length; i++) {
    for (Iterator<PGPSignature> eIt = encKey
      .getSignaturesOfType(SimplePgpUtil.MASTER_KEY_CERTIFICATION_TYPES[i]); eIt.hasNext();) {
     PGPSignature sig = eIt.next();
     if (!isMatchingUsage(sig, keyUsage)) {
      return false;
     }
    }
   }
  } else {
   for (Iterator<PGPSignature> eIt = encKey.getSignaturesOfType(PGPSignature.SUBKEY_BINDING); eIt.hasNext();) {
    PGPSignature sig = eIt.next();
    if (!isMatchingUsage(sig, keyUsage)) {
     return false;
    }
   }
  }
  return true;
 }

 private static boolean isMatchingUsage(PGPSignature sig, int keyUsage) {
  if (sig.hasSubpackets()) {
   PGPSignatureSubpacketVector sv = sig.getHashedSubPackets();
   if (sv.hasSubpacket(SimplePgpUtil.KEY_FLAGS)) {
    if (sv.getKeyFlags() == 0 && keyUsage == 0) {
     return false;
    }
   }
  }
  return true;
 }

}

Usage

Here is how to encrypt the file. You'll still need a physical key file, with you can generate it with PGP command line util. The example below encrypt it directly to a ByteArrayOutputStream out which you'll be able convert it to string. Bear in mind this I've hardcode in the Util class to always encrypt it in armored output.

private String encryptMessage(String data) throws IOException, PGPException {
 //the private key file
 InputStream fis = this.getClass().getResourceAsStream("/path/to/key/file.id");

 ByteArrayOutputStream out = new ByteArrayOutputStream();
 
 //convert the data to input stream
 InputStream stream = new ByteArrayInputStream(data.getBytes(StandardCharsets.UTF_8));

 //encrypt it!
 SimplePgpUtil.encryptStream(out, SimplePgpUtil.readPublicKey(fis), stream);

 //close all the stream
 out.close();
 stream.close();

 return new String(out.toByteArray());

}

Here is how the encryptedData looks like in string. Which is easier to send it over thru any type of transport, i.e. email/network/chat/etc

Here is how decrypt the file. You'll need a public key file. The key should be provided by the owner. Again, the encrypted message should be in armored format.

private String decryptMessage(String message) throws IOException, PGPException {
 
 //trim it, just to be safe
 message = message.trim();

 ByteArrayOutputStream baos = new ByteArrayOutputStream();
 
 //convert encrypted message to input stream
 ByteArrayInputStream bais = new ByteArrayInputStream(message.getBytes(StandardCharsets.UTF_8));
 
 //public key file
 InputStream fis = this.getClass().getResourceAsStream("/path/to/public/key/file.key");

 // the real action. 'password1' is the passphrase
 SimplePgpUtil.decryptFile(bais, baos, fis, new String("password1").toCharArray());
 
 //close all the stream
 baos.close();
 bais.close();
 fis.close();
 
 //return the decrypted message
 return new String(baos.toByteArray());

}

That's it.

2 comments:

NarendraNovember 27, 2018 at 7:23 PM
org.bouncycastle.openpgp.PGPException: org.bouncycastle.openpgp.PGPPublicKeyRing found where PGPSecretKeyRing expected got this.any help is appreciated.
Thanks.
rjNovember 18, 2019 at 1:58 PM
In decrypting the file Object o givers instanceOf PGPEncryptedDataList as always null(line 135). I have tried looking for answers but unable to solve it.
Added JCE certificates in lib as written in one of the solutions and nothing seems to be working.

Any help would be highly appreciated.

Thursday, October 6, 2016

[JAVA] Encrypt/Decrypt With PGP On The Fly

Dependencies

The Util Class

Usage

2 comments: