1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2024-10-31 17:45:58 +01:00
Simple to use OpenPGP API based on Bouncycastle https://pgpainless.org
Find a file
Paul Schaub 8cb773841b
Revert certificate-store integration
Integration of certificate-store and pgpainless-cert-d makes packaging
complicated. Alternatively, users can simply integrate the certificate-store
with PGPainless themselves.
2023-01-13 19:18:02 +01:00
.github Rename build job and point build badge to github action 2022-07-22 20:53:42 +02:00
.reuse Add manpages, script to generate manpages 2022-08-08 00:23:58 +02:00
_layouts Tweaks to layout 2022-08-04 15:48:35 +02:00
assets Add pages logo 2022-08-04 15:38:44 +02:00
config/checkstyle Reuse compliance 2021-10-07 16:28:31 +02:00
docs Add more docs for Policy related configuration 2023-01-02 15:23:29 +01:00
gradle/wrapper Bump gradlew to 7.5 2023-01-02 15:35:55 +01:00
LICENSES Fix licenses for gh pages layout stuff 2022-08-04 15:21:16 +02:00
misc Add grammar from RFC to diagram 2022-09-07 20:32:47 +02:00
pgpainless-cli Enable test for reading broken keys in SOP 2022-11-24 22:20:02 +01:00
pgpainless-core Revert certificate-store integration 2023-01-13 19:18:02 +01:00
pgpainless-sop Add regression test for #351 2023-01-09 16:56:05 +01:00
sop-java sop-java, sop-java-picocli placeholder readme: add links to codeberg 2022-02-05 14:41:43 +01:00
sop-java-picocli sop-java, sop-java-picocli placeholder readme: add links to codeberg 2022-02-05 14:41:43 +01:00
.editorconfig Reuse compliance 2021-10-07 16:28:31 +02:00
.gitignore Fix mermaid-cli cmd 2022-07-08 00:21:40 +02:00
.readthedocs.yaml Fix mermaid-cli cmd 2022-07-08 00:21:40 +02:00
.travis.yml Add reuse tool to CI 2021-10-07 16:28:31 +02:00
_config.yml Exclude irrelevant md files from gh-pages 2022-08-04 15:33:09 +02:00
build.gradle Create gradle mavenCentralChecksums task to quickly fetch checksums of published artifacts 2022-12-15 18:03:58 +01:00
CHANGELOG.md Fix NPE when sop generate-key --with-key-password is used with multiple uids 2023-01-09 16:54:58 +01:00
CNAME Merge gh-pages stuff into main 2022-08-04 15:15:58 +02:00
CODE_OF_CONDUCT.md Reuse compliance 2021-10-07 16:28:31 +02:00
gradlew Declare gradle license via .reuse/dep5 2021-10-08 14:52:37 +02:00
gradlew.bat Declare gradle license via .reuse/dep5 2021-10-08 14:52:37 +02:00
LICENSE Add licenses for external dependencies to LICENSE file 2021-10-07 16:28:31 +02:00
README.md PGPainless 1.4.1 2022-12-22 15:31:32 +01:00
SECURITY.md Update SECURITY.md 2022-11-23 20:42:17 +01:00
settings.gradle Moved sop-java and sop-java-picocli to its own repositories 2022-01-15 02:46:42 +01:00
version.gradle Revert certificate-store integration 2023-01-13 19:18:02 +01:00

PGPainless - Use OpenPGP Painlessly!

Build Status Coverage Status Interoperability Test-Suite PGP REUSE status Documentation Status

PGPainless is an easy-to-use OpenPGP library for Java and Android applications

Packaging status Maven Central

About

PGPainless aims to make using OpenPGP in Java projects as simple as possible. It does so by introducing an intuitive Builder structure, which allows easy setup of encryption/decryption operations, as well as straight forward key generation.

PGPainless is based around the Bouncy Castle java library and can be used on Android down to API level 10. It can be configured to either use the Java Cryptographic Engine (JCE), or Bouncy Castles lightweight reimplementation.

While signature verification in Bouncy Castle is limited to signature correctness, PGPainless goes much further. It also checks if signing subkeys are properly bound to their primary key, if keys are expired or revoked, as well as if keys are allowed to create signatures in the first place.

These rigorous checks make PGPainless stand out from other Java-based OpenPGP libraries and are the reason why PGPainless currently scores second place on Sequoia-PGPs Interoperability Test-Suite.

At FlowCrypt we are using PGPainless in our Kotlin code bases on Android and on server side. The ergonomics of legacy PGP tooling on Java is not very good, and PGPainless improves it greatly. We were so happy with our initial tests and with Paul - the maintainer, that we decided to sponsor further development of this library.

-Tom @ FlowCrypt.com

Finally, testing irrefutably confirmed that the library removes many associated difficulties with PGP use in its provision of an approachable and uncomplicated API. In this regard, Paul Schaub deserves the utmost praise.

-Mario @ Cure53.de

Get Started

The very easiest way to start using OpenPGP on Java/Kotlin based systems is to use an implementation of sop-java. sop-java defines a very stripped down API and is super easy to get started with. Luckily PGPainless provides an implementation for the sop-java interface definitions in the form of pgpainless-sop.

If you need more flexibility, directly using pgpainless-core is the way to go.

Features

Most of PGPainless' features can be accessed directly from the PGPainless class. If you want to get started, this class is your friend :)

For further details you should check out the javadoc!

Handle Keys

Reading keys from ASCII armored strings or from binary files is easy:

        String key = "-----BEGIN PGP PRIVATE KEY BLOCK-----\n"...
        PGPSecretKeyRing secretKey = PGPainless.readKeyRing()
                .secretKeyRing(key);

Similarly, keys can quickly be exported::

        PGPSecretKeyRing secretKey = ...;
        String armored = PGPainless.asciiArmor(secretKey);
        ByteArrayOutputStream binary = new ByteArrayOutputStream();
        secretKey.encode(binary);

Extract a public key certificate from a secret key:

        PGPSecretKeyRing secretKey = ...;
        PGPPublicKeyRing certificate = PGPainless.extractCertificate(secretKey);

Easily Generate Keys

PGPainless comes with a simple to use KeyRingBuilder class that helps you to quickly generate modern OpenPGP keys. There are some predefined key archetypes, but it is possible to fully customize key generation to your needs.

        // RSA key without additional subkeys
        PGPSecretKeyRing secretKeys = PGPainless.generateKeyRing()
                .simpleRsaKeyRing("Juliet <juliet@montague.lit>", RsaLength._4096);
                
        // EdDSA primary key with EdDSA signing- and XDH encryption subkeys
        PGPSecretKeyRing secretKeys = PGPainless.generateKeyRing()
                .modernKeyRing("Romeo <romeo@montague.lit>", "I defy you, stars!");

        // Customized key
        PGPSecretKeyRing keyRing = PGPainless.buildKeyRing()
                .setPrimaryKey(KeySpec.getBuilder(
                        RSA.withLength(RsaLength._8192),
                        KeyFlag.SIGN_DATA, KeyFlag.CERTIFY_OTHER))
                .addSubkey(
                        KeySpec.getBuilder(ECDSA.fromCurve(EllipticCurve._P256), KeyFlag.SIGN_DATA)
                                .overrideCompressionAlgorithms(CompressionAlgorithm.ZLIB)
                ).addSubkey(
                        KeySpec.getBuilder(
                                        ECDH.fromCurve(EllipticCurve._P256),
                                        KeyFlag.ENCRYPT_COMMS, KeyFlag.ENCRYPT_STORAGE)
                ).addUserId("Juliet <juliet@montague.lit>")
                .addUserId("xmpp:juliet@capulet.lit")
                .setPassphrase(Passphrase.fromPassword("romeo_oh_Romeo<3"))
                .build();

Encrypt and Sign Data

PGPainless makes it easy and painless to encrypt and/or sign data. Passed in keys are automatically evaluated, so that you don't accidentally encrypt to revoked or expired keys. PGPainless will furthermore detect which algorithms are supported by recipient keys and will negotiate algorithms accordingly. Still it allows you to manually specify which algorithms to use of course.

        EncryptionStream encryptionStream = PGPainless.encryptAndOrSign()
                .onOutputStream(outputStream)
                .withOptions(
                        ProducerOptions.signAndEncrypt(
                                new EncryptionOptions()
                                        .addRecipient(aliceKey)
                                        .addRecipient(bobsKey)
                                        // optionally encrypt to a passphrase
                                        .addPassphrase(Passphrase.fromPassword("password123"))
                                        // optionally override symmetric encryption algorithm
                                        .overrideEncryptionAlgorithm(SymmetricKeyAlgorithm.AES_192),
                                new SigningOptions()
                                        // Sign in-line (using one-pass-signature packet)
                                        .addInlineSignature(secretKeyDecryptor, aliceSecKey, signatureType)
                                        // Sign using a detached signature
                                        .addDetachedSignature(secretKeyDecryptor, aliceSecKey, signatureType)
                                        // optionally override hash algorithm
                                        .overrideHashAlgorithm(HashAlgorithm.SHA256)
                        ).setAsciiArmor(true) // Ascii armor or not
                );

        Streams.pipeAll(plaintextInputStream, encryptionStream);
        encryptionStream.close();

        // Information about the encryption (algorithms, detached signatures etc.)
        EncryptionResult result = encryptionStream.getResult();

Decrypt and Verify Signatures

Decrypting data and verifying signatures is being done similarly. PGPainless will not only verify correctness of signatures, but also if the signing key was allowed to create the signature. A key might not be allowed to create signatures if, for example, it expired or was revoked, or was not properly bound to the key ring. Furthermore, PGPainless will reject signatures made using weak algorithms like SHA-1. This behaviour can be modified though using the Policy class.

        DecryptionStream decryptionStream = PGPainless.decryptAndOrVerify()
                .onInputStream(encryptedInputStream)
                .withOptions(new ConsumerOptions()
                        .addDecryptionKey(bobSecKeys, secretKeyProtector)
                        .addVerificationCert(alicePubKeys)
                );

        Streams.pipeAll(decryptionStream, outputStream);
        decryptionStream.close();

        // Result contains information like signature status etc.
        OpenPgpMetadata metadata = decryptionStream.getResult();

After the DecryptionStream was closed, you can get metadata about the processed data by retrieving the OpenPgpMetadata. Again, this object will contain information about how the message was encrypted, who signed it and so on.

Many more examples can be found in the examples package!!!

Include PGPainless in your Project

PGPainless is available on maven central. In order to include it in your project, just add the maven central repository and add PGPainless as a dependency.

repositories {
	mavenCentral()
}

dependencies {
	implementation 'org.pgpainless:pgpainless-core:1.4.1'
}

Professional Support

Do you need a custom feature? Are you unsure of what's the best way to integrate PGPainless into your product? We offer paid professional services. Don't hesitate to send an inquiry to info@pgpainless.org.

Development

Join the projects IRC channel #pgpainless on OFTC if you have any questions!

PGPainless is developed in - and accepts contributions from - the following places:

We are using SemVer (MAJOR.MINOR.PATCH) versioning, although MINOR releases could contain breaking changes from time to time.

If you want to contribute a bug fix, please check the release/X.Y branches first to see, what the oldest release is which contains the bug you are fixing. That way we can update older revisions of the library easily.

Please follow the code of conduct if you want to be part of the project.

Acknowledgements

Development on PGPainless is generously sponsored by FlowCrypt.com. Thank you very very very much! FlowCrypt Logo

Parts of PGPainless development (project page) will be funded by NGI Assure through NLNet.
NGI Assure is made possible with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology. NGI Assure Logo

Thanks to YourKit for providing a free license of the YourKit Java Profiler to support PGPainless Development! YourKit Logo

Big thank you also to those who decided to support the work by donating!
Notably @msfjarvis

You make my day!