OpenPGP Class
Properties Methods Events Config Settings Errors
The OpenPGP class is used to encrypt/decrypt and sign/verify PGP messages.
Syntax
ipworksopenpgp.OpenPGP
Remarks
The OpenPGP class supports encrypting/decrypting and signing/verifying OpenPGP messages. Supported message formats are specified by RFC 4880, in addition to draft-ietf-openpgp-crypto-refresh-13, which introduces support for OpenPGP Version 6.
The Encrypt, Sign, and SignAndEncrypt methods are used to create a message to be sent to your partner. You can additionally create messages bound for multiple recipients with different keys, simultaneously encrypt and compress with the most popular compression algorithms, and control other aspects such as the encrypting algorithm to use.
When a message is received, the Decrypt, VerifySignature, and DecryptAndVerifySignature methods are used to process the incoming message.
The Keys property holds the key (with private key) used to sign and decrypt.
The SignerKeys property holds the key used to verify a signature.
The RecipientKeys property holds the key used to encrypt.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
ASCIIArmor | Specifies whether to use ASCII armor to encode the output message. |
AutoSelectAlgorithms | Whether to automatically select algorithms when encrypting or signing. |
ClearSignature | Specifies whether or not to create a cleartext signature. |
CompressionMethod | The compression algorithm used. |
DetachedSignature | Specifies whether or not to generate a detached signature when signing a message. |
EncryptingAlgorithm | The encryption algorithm used when encrypting. |
InputFile | The file to process. |
InputMessage | The message to process. |
Keys | A collection of keys used for cryptographic operations. |
MessageHeaders | A collection of headers in the ASCII armored message. |
OutputFile | The output file. |
OutputMessage | The output message after processing. |
Overwrite | Indicates whether or not the class should overwrite files. |
RecipientKeys | The collection of keys belonging to the recipient of the message. |
SignerKeys | The collection of keys belonging to the signer of the message. |
SigningAlgorithm | The signature hash algorithm used when signing. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
Config | Sets or retrieves a configuration setting. |
Decrypt | Decrypts the message. |
DecryptAndVerifySignature | Decrypts and verifies the signature of the message. |
Encrypt | Encrypts the message. |
GetRecipientInfo | Gets recipient information for an encrypted message. |
Interrupt | Interrupt the current method. |
Reset | Resets the class properties. |
SetInputStream | Sets the stream from which the class will read data to encrypt or decrypt. |
SetOutputStream | The stream to which the class will write the fully encrypted or decrypted OpenPGP data. |
Sign | Signs the message. |
SignAndEncrypt | Signs and encrypts the current message. |
VerifySignature | Verifies the signature of the current message. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
Error | Fired when information is available about errors during data delivery. |
KeyPassphrase | Fired if the passphrase of current key is incorrect or empty. |
Progress | Fired as progress is made. |
RecipientInfo | Fired for each recipient key of the encrypted message. |
SignatureInfo | Fired during verification of the signed message. |
Status | Shows the progress of the operation. |
VerificationStatus | Fired after verification of the signed message. |
Config Settings
The following is a list of config settings for the class with short descriptions. Click on the links for further details.
AEADChunkSizeExp | Specifies the exponent used to calculate the plaintext chunk size for encryption. |
AllowEmptyInput | Whether to allow empty files for input. |
AllowOldPacketType | Whether to allow the older encrypted packet type. |
Argon2Iterations | Specifies the number of iterations used for Argon2. |
Argon2MemorySizeExp | Specifies the exponent used to calculate the memory size used when creating a key. |
Argon2Parallelism | Specifies the degree of parallelism used for Argon2. |
CloseInputStreamAfterProcessing | Determines whether or not the input stream is closed after processing. |
CloseOutputStreamAfterProcessing | Determines whether or not the output stream is closed after processing. |
CompressionLevel | The level of compression used. |
DeleteOutputFileOnError | Whether to delete the output file on an error. |
DetachedSignatureData | The detached signature. |
EnsureValidDSASignatureHashAlgorithm | Whether or not to select a suitable signature hash algorithm automatically. |
FileName | The original name of the encrypted file. |
ForceV3Signature | Whether to use v3 signatures. |
KeyIdLength | The length of the KeyId available. |
KeySelectionMethod | The method used to select a key for encryption or signing. |
LogLevel | Specifies the level of detail that is logged. |
PGPZipDir | The directory used when creating or extracting a PGP zip file. |
ProgressEventThreshold | The amount of data in bytes to process before firing the progress event. |
PublicKeyringFile | The file name of the public keyring file. |
ReadFromProgressEvent | Whether to read input data from inside the progress event. |
RecursiveDecryptMode | Whether the encrypted data should be decrypted recursively. |
RequireEncryption | Whether to throw an error when decrypting and encryption is not detected. |
RequireIntegrityProtectedPacket | Whether an MDC packet is required for decryption. |
RequireSignature | Whether to throw an error when verifying a signature and no signature is found. |
RequireValidSignature | Specifies if an invalid signature is considered an error condition. |
SecretKeyringFile | The file name of the secret keyring file. |
SplitHeaders | Controls whether ASCII Armor headers are split or not. |
SymmetricPassphrase | The password used for symmetric encryption or decryption. |
UseArgon2 | Whether to use Argon2 for key derivation during symmetric encryption or decryption. |
VerifyClearTextSignatureWithCache | Whether the cleartext message is cached in memory when verifying a cleartext signature. |
VersionHeader | The Version header value in the ASCII armored OpenPGP message. |
WriteToProgressEvent | Whether to write output data so it is accessible from inside the progress event. |
BuildInfo | Information about the product's build. |
GUIAvailable | Whether or not a message loop is available for processing events. |
LicenseInfo | Information about the current license. |
MaskSensitiveData | Whether sensitive data is masked in log messages. |
UseDaemonThreads | Whether threads created by the class are daemon threads. |
UseFIPSCompliantAPI | Tells the class whether or not to use FIPS certified APIs. |
UseInternalSecurityAPI | Whether or not to use the system security libraries or an internal implementation. |
ASCIIArmor Property (OpenPGP Class)
Specifies whether to use ASCII armor to encode the output message.
Syntax
public boolean isASCIIArmor(); public void setASCIIArmor(boolean ASCIIArmor);
Default Value
False
Remarks
This property controls whether or not ASCII armoring is used on the output message. The default value is False.
AutoSelectAlgorithms Property (OpenPGP Class)
Whether to automatically select algorithms when encrypting or signing.
Syntax
public int getAutoSelectAlgorithms(); public void setAutoSelectAlgorithms(int autoSelectAlgorithms);
Default Value
0
Remarks
This property is set to the binary 'OR' of one or more options indicating which algorithms to automatically select.
When enabled automatic selection is performed by examining the preferred algorithms specified by the key.
When Encrypt is called the class will read the preferred encryption algorithm and compression method from the key specified in RecipientKeys .
If multiple keys are specified the preferred encryption algorithm and compression method from the last key is used. The EncryptingAlgorithm and CompressionMethod properties are ignored.
When Sign is called the class will read the preferred MAC algorithm and compression method from the private key specified in Keys . If multiple keys are specified the preferred MAC algorithm and compression method from the last key is used. The SigningAlgorithm and CompressionMethod properties are ignored.
The list below defines available options.
Compression Algorithm | 1 (Hex 0x01) |
Cipher Algorithm | 2 (Hex 0x02) |
MAC Algorithm | 4 (Hex 0x04) |
The default value is 0 which means algorithms are not automatically selected.
ClearSignature Property (OpenPGP Class)
Specifies whether or not to create a cleartext signature.
Syntax
public boolean isClearSignature(); public void setClearSignature(boolean clearSignature);
Default Value
False
Remarks
This property controls whether or not a cleartext signature is created during signing. The default value is False. When set to true a clear text signature will be created when Sign is called.
CompressionMethod Property (OpenPGP Class)
The compression algorithm used.
Syntax
public String getCompressionMethod(); public void setCompressionMethod(String compressionMethod);
Default Value
"zip"
Remarks
This property specifies which compression method is used when generating output. Possible values are:
- zip (default)
- zlib
- bzip2
- none or uncompressed
DetachedSignature Property (OpenPGP Class)
Specifies whether or not to generate a detached signature when signing a message.
Syntax
public boolean isDetachedSignature(); public void setDetachedSignature(boolean detachedSignature);
Default Value
False
Remarks
This property specifies whether or not a detached signature is created when signing a message. The default value is False.
If set to true the output will only be the signature. The data being signed will not be included in the output. If set to true ClearSignature will be ignored.
When this property is false (default) the signature is not detached. The output will contain both the signed data and the signature.
EncryptingAlgorithm Property (OpenPGP Class)
The encryption algorithm used when encrypting.
Syntax
public String getEncryptingAlgorithm(); public void setEncryptingAlgorithm(String encryptingAlgorithm);
Default Value
"AES128"
Remarks
This property specifies the encryption algorithm used when encrypting. Possible values are:
- CAST5
- 3DES or TripleDES
- AES256
- AES192
- AES128 (default)
- BLOWFISH
- TWOFISH
- IDEA
- AES256-OCB (AEAD)
- AES192-OCB (AEAD)
- AES128-OCB (AEAD)
- AES256-GCM (AEAD)
- AES192-GCM (AEAD)
- AES128-GCM (AEAD)
Note that if UseArgon2 is enabled, and SymmetricPassphrase is specified, an AEAD encryption algorithm (AES*-OCB and AES*-GCM) must be specified for symmetric encryption. If UseArgon2 is disabled, and an AEAD encryption algorithm is specified, the AEAD mode (OCB or GCM) will be ignored when performing symmetric encryption.
An AEAD encryption algorithm may optionally be utilized when encrypting messages (when calling Encrypt). In this case, the AEADChunkSizeExp configuration will specify the chunk size for splitting plaintext for encryption. Please see AEADChunkSizeExp for additional details.
InputFile Property (OpenPGP Class)
The file to process.
Syntax
public String getInputFile(); public void setInputFile(String inputFile);
Default Value
""
Remarks
This property specifies the file to be processed. Set this property to the full or relative path to the file which will be processed.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
InputMessage Property (OpenPGP Class)
The message to process.
Syntax
public byte[] getInputMessage(); public void setInputMessage(byte[] inputMessage);
Default Value
""
Remarks
This property specifies the message to be processed. Set this property to the OpenPGP message content.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Keys Property (OpenPGP Class)
A collection of keys used for cryptographic operations.
Syntax
public KeyList getKeys(); public void setKeys(KeyList keys);
Remarks
This collection holds keys that are used for signing and decrypting. In most cases only one key will be specified, however multiple keys may be needed in some cases.
This property is not available at design time.
Please refer to the Key type for a complete list of fields.MessageHeaders Property (OpenPGP Class)
A collection of headers in the ASCII armored message.
Syntax
public HeaderList getMessageHeaders(); public void setMessageHeaders(HeaderList messageHeaders);
Remarks
This property holds a collection of headers specified in the message. It is only applicable when ASCIIArmor is set to true.
When generating ASCII armored output the class will include the headers specified here in addition to the standard Version header.
After decrypting or verifying a message that is ASCII armored this collection will be populated with the headers that were present in the message.
This property is not available at design time.
Please refer to the Header type for a complete list of fields.OutputFile Property (OpenPGP Class)
The output file.
Syntax
public String getOutputFile(); public void setOutputFile(String outputFile);
Default Value
""
Remarks
This property specifies the file to which the output will be written. This may be set to an absolute or relative path.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
OutputMessage Property (OpenPGP Class)
The output message after processing.
Syntax
public byte[] getOutputMessage(); public void setOutputMessage(byte[] outputMessage);
Default Value
""
Remarks
This property will be populated with the output from the operation if OutputFile and SetOutputStream are not set.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Overwrite Property (OpenPGP Class)
Indicates whether or not the class should overwrite files.
Syntax
public boolean isOverwrite(); public void setOverwrite(boolean overwrite);
Default Value
False
Remarks
This property indicates whether or not the class will overwrite OutputFile. If Overwrite is False, an error will be thrown whenever OutputFile exists before an operation. The default value is False.
RecipientKeys Property (OpenPGP Class)
The collection of keys belonging to the recipient of the message.
Syntax
public KeyList getRecipientKeys(); public void setRecipientKeys(KeyList recipientKeys);
Remarks
This property contains the keys of the message recipient.
Set this property before calling Encrypt or SignAndEncrypt.
This property is not available at design time.
Please refer to the Key type for a complete list of fields.SignerKeys Property (OpenPGP Class)
The collection of keys belonging to the signer of the message.
Syntax
public KeyList getSignerKeys(); public void setSignerKeys(KeyList signerKeys);
Remarks
This property contains the keys of the message signer.
Set this property before calling VerifySignature or DecryptAndVerifySignature.
This property is not available at design time.
Please refer to the Key type for a complete list of fields.SigningAlgorithm Property (OpenPGP Class)
The signature hash algorithm used when signing.
Syntax
public String getSigningAlgorithm(); public void setSigningAlgorithm(String signingAlgorithm);
Default Value
"SHA256"
Remarks
This property specifies the signature hash algorithm used when signing. Possible values are:
- SHA1
- MD5
- SHA256 (default)
- SHA384
- SHA512
- SHA224
- RIPEMD160
- SHA3-256
- SHA3-512
Config Method (OpenPGP Class)
Sets or retrieves a configuration setting.
Syntax
public String config(String configurationString);
Remarks
Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.
These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.
To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).
To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.
Decrypt Method (OpenPGP Class)
Decrypts the message.
Syntax
public void decrypt();
Remarks
This method decrypts the specified message.
The message will be decrypted using the keys specified in Keys. Before decryption begins the class will fire the RecipientInfo event with information about the encrypted message, including the key used to encrypt the message. Within this event you may use the available information to load the correct key into Keys.
DecryptAndVerifySignature Method (OpenPGP Class)
Decrypts and verifies the signature of the message.
Syntax
public void decryptAndVerifySignature();
Remarks
This method attempts to both decrypt and verify the signature of the message. All of the properties affected by calling the Decrypt and VerifySignature methods are affected in the same manner.
This method may be used when the data is signed, encrypted, or signed and encrypted. For instance, if the data is encrypted but not signed you may still use this method and the class will perform the decryption without error.
The message will be decrypted using the keys specified in Keys. Before decryption begins the class will fire the RecipientInfo event with information about the encrypted message, including the key used to encrypt the message. Within this event you may use the available information to load the correct key into Keys.
The message will be verified using the keys specified in SignerKeys. Before verification begins the class will fire the SignatureInfo event with information about the signature including the key used to sign the message. Within this event you may use the information available to load the correct key into SignerKeys.
By default, if the signature is not valid the class throws an exception. The configuration setting RequireValidSignature may be set to False to disable this requirement. When RequireValidSignature is set to False, the Status parameter of the VerificationStatus event should be checked to determine the result of the operation.
NOTE: This method does not attempt to check the validity of the signing key itself.
Encrypt Method (OpenPGP Class)
Encrypts the message.
Syntax
public void encrypt();
Remarks
This method encrypts the specified message.
The message is encrypted with the public keys specified in RecipientKeys.
When encrypting, the following properties may be used to further configure the class:
GetRecipientInfo Method (OpenPGP Class)
Gets recipient information for an encrypted message.
Syntax
public void getRecipientInfo();
Remarks
This method will fire a RecipientInfo event for every recipient key for which the message has been encrypted. The event will provide the KeyId and Fingerprint, which can be used to identify the correct key to be used for decryption.
Interrupt Method (OpenPGP Class)
Interrupt the current method.
Syntax
public void interrupt();
Remarks
If there is no method in progress, Interrupt simply returns, doing nothing.
Reset Method (OpenPGP Class)
Resets the class properties.
Syntax
public void reset();
Remarks
This method resets all message and key properties to their default values.
SetInputStream Method (OpenPGP Class)
Sets the stream from which the class will read data to encrypt or decrypt.
Syntax
public void setInputStream(java.io.InputStream inputStream);
Remarks
This method sets the stream from which the class will read data to encrypt or decrypt. If an input stream is set before the class attempts to encode or decode an OpenPGP message, the data is read from the input stream instead of from the InputFile or InputMessage properties.
Encrypt and/or Sign
You can call this method to set the input stream that you would like to sign and/or encrypt. Then call Sign, Encrypt, or SignAndEncrypt to sign and/or encrypt the message. The appropriate ASCII Armor headers will be generated in MessageHeaders.
Decrypt and/or Verify
You can call this method to specify a valid input stream that contains the signed and/or encrypted data you would like to verify or decrypt. Then call VerifySignature, Decrypt, or DecryptAndVerifySignature to verify and/or decrypt the message.
The content of the stream will be read from the current position all the way to the end and no bytes will be skipped.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
SetOutputStream Method (OpenPGP Class)
The stream to which the class will write the fully encrypted or decrypted OpenPGP data.
Syntax
public void setOutputStream(java.io.OutputStream outputStream);
Remarks
This method sets the stream to which the class will write the fully encrypted or decrypted OpenPGP data. If an output stream is set before the class attempts to encode or decode an OpenPGP message, the class will write the data to the output stream instead of populating OutputMessage or writing to OutputFile.
Sign and/or Encrypt
To sign and/or encrypt a message to an output stream, you must first populate the Message property with the data you would like to sign and/or encrypt. Next, this method must be called with a valid output stream for which the class may write the signed or encrypted data. Then call Sign, Encrypt, or SignAndEncrypt to sign and/or encrypt the message. The appropriate ASCII Armor headers will be generated in MessageHeaders.
Decrypt and/or Verify
If you would like to decrypt a message or verify its signature and write the resulting message to an output stream, you should set the Message property to the signed and/or encrypted message you would like to verify or decrypt. Next, you must call this method to specify a valid stream for the component to write the data to. Then call VerifySignature, Decrypt, or DecryptAndVerifySignature to verify and/or decrypt the message.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Sign Method (OpenPGP Class)
Signs the message.
Syntax
public void sign();
Remarks
This method signs the specified message.
The message is signed with the private key specified in Keys .
When signing, the following properties may be used to further configure the class:
SignAndEncrypt Method (OpenPGP Class)
Signs and encrypts the current message.
Syntax
public void signAndEncrypt();
Remarks
This method signs and encrypts the specified message.
The message is encrypted with the public keys specified in RecipientKeys and signed with the private key specified in Keys.
When encrypting, the following properties may be used to further configure the class:
When signing, the following properties may be used to further configure the class:
VerifySignature Method (OpenPGP Class)
Verifies the signature of the current message.
Syntax
public void verifySignature();
Remarks
This method verifies the signature of the message.
The message will be verified using the keys specified in SignerKeys. Before verification begins the class will fire the SignatureInfo event with information about the signature including the key used to sign the message. Within this event you may use the information available to load the correct key into SignerKeys.
By default, if the signature is not valid the class throws an exception. The configuration setting RequireValidSignature may be set to False to disable this requirement. When RequireValidSignature is set to False, the Status parameter of the VerificationStatus event should be checked to determine the result of the operation.
Error Event (OpenPGP Class)
Fired when information is available about errors during data delivery.
Syntax
public class DefaultOpenPGPEventListener implements OpenPGPEventListener { ... public void error(OpenPGPErrorEvent e) {} ... } public class OpenPGPErrorEvent { public int errorCode; public String description; }
Remarks
The Error event is fired in case of exceptional conditions during message processing. Normally the class throws an exception.
The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.
KeyPassphrase Event (OpenPGP Class)
Fired if the passphrase of current key is incorrect or empty.
Syntax
public class DefaultOpenPGPEventListener implements OpenPGPEventListener { ... public void keyPassphrase(OpenPGPKeyPassphraseEvent e) {} ... } public class OpenPGPKeyPassphraseEvent { public String userId; public String keyId; public String fingerprint; public String passphrase; //read-write }
Remarks
This event fires when the passphrase for the key is required. The passphrase must be specified before operations requiring the secret key are attempted. The passphrase may be supplied by setting the Passphrase parameter in this event, or by specifying the Passphrase field before attempting the operation.
The passphrase is required when using the following methods in KeyMgr:
- AddUserId
- SignUserId
- ChangeExpirationDate
- ChangePassphrase
When using the OpenPGP class, or an email-based class, the following methods require a passphrase for the key:
UserId holds the user Id of the key the passphrase is required for.
The UserId format is:
FirstName LastName (Comment) <Email>Not all values are required when selecting or generating a key, but at least FirstName or Email are required.
Note that for OpenPGP v6, a key may be created with or without a UserId, as the field is optional. If a key was created without a UserId, the key's Fingerprint can be used as it's identifier instead.
KeyId is the hex-encoded, 4-byte or 8-byte Id of the key the passphrase is required for. For OpenPGP v4 keys and earlier, the key Id corresponds to the last 4 or 8 bytes of the key's Fingerprint. For OpenPGP v6 keys, the key Id corresponds to the first 8 bytes of the key's Fingerprint instead. For instance:
5E70662EA810E768
Fingerprint holds the hex-encoded, 20-byte fingerprint of the key the passphrase is required for. This is in the form:
5E70662EA810E768391A2FE8F7B7D49C89C9D7B1
Progress Event (OpenPGP Class)
Fired as progress is made.
Syntax
public class DefaultOpenPGPEventListener implements OpenPGPEventListener { ... public void progress(OpenPGPProgressEvent e) {} ... } public class OpenPGPProgressEvent { public long bytesProcessed; public int percentProcessed; public int operation; public boolean isEOF; //read-write }
Remarks
This event is fired automatically as data is processed by the class.
The PercentProcessed parameter indicates the current status of the operation.
The BytesProcessed parameter holds the total number of bytes processed so far.
The Operation parameter is only applicable when either ReadFromProgressEvent or WriteToProgressEvent is set to True. This parameter defines whether a Read or Write operation is required. If the configuration settings are not set this parameter will always return 0. Possible values are:
0 | None |
1 | Read |
2 | Write |
The IsEOF parameter is only applicable when either ReadFromProgressEvent or WriteToProgressEvent is set to True. This parameter defines whether the Read or Write operation is complete. When the Operation is Read (1) this parameter must be set to indicate that all data has been supplied to the class. When the Operation is Write (2) this value may be queried to determine when all data has been processed.
RecipientInfo Event (OpenPGP Class)
Fired for each recipient key of the encrypted message.
Syntax
public class DefaultOpenPGPEventListener implements OpenPGPEventListener { ... public void recipientInfo(OpenPGPRecipientInfoEvent e) {} ... } public class OpenPGPRecipientInfoEvent { public String keyId; public String fingerprint; public String publicKeyAlgorithm; }
Remarks
This event fires when the Decrypt or DecryptAndVerifySignature method is called.
KeyId is the hex-encoded 4- or 8-byte Id of the key used to encrypt the message. If a subkey was used to encrypt the message this will be the Id of that subkey. For OpenPGP v4 keys and earlier, the key Id corresponds to the last 4 or 8 bytes of the key's Fingerprint. For OpenPGP v6 keys, the key Id corresponds to the first 8 bytes of the key's Fingerprint instead. For instance:
5E70662EA810E768
Fingerprint holds the hex-encoded, 20-byte fingerprint of the key. This is in the form:
5E70662EA810E768391A2FE8F7B7D49C89C9D7B1
The KeyId and Fingerprint parameters can be used to identify the correct key to specify in Keys. Keys can be set from within this event as this event fires directly before the decryption process begins.
It is recommended to use the Fingerprint to identify the correct key, as it is possible for different keys to have the same KeyId.
PublicKeyAlgorithm is the algorithm of the public key used to encrypt the message. Possible values are:
- RSA
- DSA
- ECDSA
- EdDSA
- Ed25519
- Ed448
- RSA-Legacy
- ECDH (Subkeys only)
- X25519 (Subkeys only)
- X448 (Subkeys only)
SignatureInfo Event (OpenPGP Class)
Fired during verification of the signed message.
Syntax
public class DefaultOpenPGPEventListener implements OpenPGPEventListener { ... public void signatureInfo(OpenPGPSignatureInfoEvent e) {} ... } public class OpenPGPSignatureInfoEvent { public String keyId; public String fingerprint; public String signingAlgorithm; public String publicKeyAlgorithm; }
Remarks
This event fires when the VerifySignature or DecryptAndVerifySignature method is called. It provides information about the signature of the message.
KeyId is the hex-encoded 4- or 8-byte Id of the key used to sign the message. If a subkey was used to sign the message this will be the Id of that subkey. For OpenPGP v4 keys and earlier, the key Id corresponds to the last 4 or 8 bytes of the key's Fingerprint. For OpenPGP v6 keys, the key Id corresponds to the first 8 bytes of the key's Fingerprint instead. For instance:
5E70662EA810E768
Fingerprint holds the hex-encoded, 20-byte fingerprint of the key. This is in the form:
5E70662EA810E768391A2FE8F7B7D49C89C9D7B1
The KeyId and Fingerprint parameters can be used to identify the correct key to specify in SignerKeys. SignerKeys can be set from within this event as this event fires directly before the verification process begins.
It is recommended to use the Fingerprint to identify the correct key, as it is possible for different keys to have the same KeyId.
SigningAlgorithm describes the hash algorithm used when the message was originally signed. This value is applicable only to the message signature, not the key used to sign the message. Possible values are:
- SHA1
- MD5
- SHA256
- SHA384
- SHA512
- SHA224
- RIPEMD160
- SHA3-256
- SHA3-512
PublicKeyAlgorithm is the algorithm of the public key used to sign the message. Possible values are:
- RSA
- DSA
- ECDSA
- EdDSA
- Ed25519
- Ed448
- RSA-Legacy
- ECDH (Subkeys only)
- X25519 (Subkeys only)
- X448 (Subkeys only)
Status Event (OpenPGP Class)
Shows the progress of the operation.
Syntax
public class DefaultOpenPGPEventListener implements OpenPGPEventListener { ... public void status(OpenPGPStatusEvent e) {} ... } public class OpenPGPStatusEvent { public String message; }
Remarks
The event is fired for informational and logging purposes only. It may be used to track the progress of an operation.
The level of detail is controlled by the LogLevel setting.
VerificationStatus Event (OpenPGP Class)
Fired after verification of the signed message.
Syntax
public class DefaultOpenPGPEventListener implements OpenPGPEventListener { ... public void verificationStatus(OpenPGPVerificationStatusEvent e) {} ... } public class OpenPGPVerificationStatusEvent { public String keyId; public String fingerprint; public int status; }
Remarks
This event fires when VerifySignature or DecryptAndVerifySignature is called. It provides information about the result.
KeyId is the hex-encoded 4- or 8-byte Id of the key used to sign the message. For OpenPGP v4 keys and earlier, the key Id corresponds to the last 4 or 8 bytes of the key's Fingerprint. For OpenPGP v6 keys, the key Id corresponds to the first 8 bytes of the key's Fingerprint instead. For instance:
5E70662EA810E768
Fingerprint holds the hex-encoded, 20-byte fingerprint of the key. This is in the form:
5E70662EA810E768391A2FE8F7B7D49C89C9D7B1
Status holds the result of the operation. Possible values are:
0 | Verification succeeded |
1 | Verification failed |
2 | The required key could not be found |
3 | Verification succeeded but the key is expired. |
Header Type
This is an HTTP header as it is received from the server.
Remarks
When a header is received through a Header event, it is parsed into a Header type. This type contains a Field, and its corresponding Value.
Fields
Field
String
Default Value: ""
This field contains the name of the HTTP Header (this is the same case as it is delivered).
Value
String
Default Value: ""
This field contains the Header contents.
Constructors
public Header();
public Header( field, value);
Key Type
The OpenPGP key being used.
Remarks
This type describes the current key. The key may be a public or secret key. The fields are used to identify or select the key.
Fields
Curve
String (read-only)
Default Value: ""
This field specifies the elliptic curve if PublicKeyAlgorithm is ECDSA, EdDSA, Ed25519, or Ed448. Possible values are:
Curve | Valid Public Key Algorithms | Description |
secp256r1 | ECDSA | NIST curve P-256 |
secp384r1 | ECDSA | NIST curve P-384 |
secp521r1 | ECDSA | NIST curve P-521 |
secp256k1 | ECDSA | Secp256k1 |
Ed25519 | EdDSA, Ed25519 | Ed25519 |
Ed448 | Ed448 | Ed448 |
EffectiveDate
String (read-only)
Default Value: ""
The date when this key becomes valid. Prior to this it is not valid. The following is an example of a valid encoded date:
23-Jan-2000 15:00:00.
Encoded
String
Default Value: ""
The key. This field can be used to assign a specific key. The Fingerprint, Id, and UserId fields may also be used to specify a key.
EncodedB
byte[]
Default Value: ""
The key. This field can be used to assign a specific key. The Fingerprint, Id, and UserId fields may also be used to specify a key.
ExpirationDate
String (read-only)
Default Value: ""
The date the key expires. After this date the key will no longer be valid. The following is an example of a valid encoded date:
23-Jan-2001 15:00:00.
Fingerprint
String
Default Value: ""
The hex-encoded, 20-byte fingerprint of the key.
When a key is loaded, this field is populated with the Fingerprint associated with the key. This field may be set to load a key from the Keyring. When this field is set the classwill search the Keyring for a key associated with the Fingerprint specified.
This is in the form:
5E70662EA810E768391A2FE8F7B7D49C89C9D7B1
Id
String
Default Value: ""
The hex-encoded, 4-byte or 8-byte key Id. For OpenPGP v4 keys and earlier, the key Id corresponds to the last 4 or 8 bytes of the key's Fingerprint. For OpenPGP v6 keys, the key Id corresponds to the first 8 bytes of the key's Fingerprint instead. For instance:
5E70662EA810E768
When a key is loaded, this field is populated with the Id associated with the key. This field may be set to load a key from the Keyring. When this field is set the class will search the Keyring for a key associated with the Id specified.
The KeyIdLength setting may be set to control the length of the returned key Id.
Note: It is recommended to use the Fingerprint field when loading a key from the Keyring, as it is possible for different keys to have the same Id.
OtherUserIds
String (read-only)
Default Value: ""
If the specified key has alternate user Ids associated with it, this field returns a comma-separated list of the other user Ids.
Passphrase
String
Default Value: ""
The passphrase for the key's secret key (if any). This must be specified before operations requiring the secret key are attempted. The passphrase may be supplied in this field or through the KeyPassphrase event, which will fire when a passphrase is required.
The passphrase is required when using the following methods in KeyMgr:
- AddUserId
- SignUserId
- ChangeExpirationDate
- ChangePassphrase
When using the OpenPGP class, or an email-based class, the following methods require a passphrase for the key:
- Decrypt
- Sign
- SignAndEncrypt
PublicKey
String (read-only)
Default Value: ""
The public key of the key. The key is provided as ASCII armored data.
PublicKeyAlgorithm
String (read-only)
Default Value: ""
A text description of the public key algorithm of the key. Possible values are:
- RSA
- DSA
- ECDSA
- EdDSA
- Ed25519
- Ed448
- RSA-Legacy
PublicKeyLength
int (read-only)
Default Value: 0
The length of the public key in bits. Common values are 512, 1024, and 2048.
If the PublicKeyAlgorithm field is ECDSA, EdDSA, Ed25519, or Ed448, the length of the public key is determined by the Curve. Possible lengths are:
Curve | Public Key Length (bits) |
secp256r1 | 256 |
secp384r1 | 384 |
secp521r1 | 528 |
secp256k1 | 256 |
Ed25519 | 256 |
Ed448 | 456 |
Revoked
boolean (read-only)
Default Value: False
Whether or not the key is revoked.
SecretKey
String (read-only)
Default Value: ""
The secret key of the key (if available). The key is provided as ASCII armored data.
SecretKeyAvailable
boolean (read-only)
Default Value: False
Whether or not a secret key is available for the selected key.
Usage
String (read-only)
Default Value: ""
A text description of UsageFlags.
The value will be of one or more of the following strings, separated by commas:
- Certifying Other Certificates
- Signing Emails and Files
- Encrypting Emails and Files
- Split Key
- Authenticate Against Servers
- Group Key
UsageFlags
int (read-only)
Default Value: 47
Flags that show the intended use for the key. The default value is 0x0F. The value of UsageFlags is a combination of the following flags:
0x01 | This key may be used to certify other keys. |
0x02 | This key may be used to sign data. |
0x0C | This key may be used to encrypt communications and encrypt storage. |
0x10 | The private component of this key may have been split by a secret-sharing mechanism. |
0x20 | This key may be used for authentication. |
0x80 | The private component of this key may be in the possession of more than one person. |
Please refer to the Usage field for a text representation of UsageFlags.
UserId
String
Default Value: ""
The user Id of the key. When a key is loaded this field is populated with the user Id associated with the key. This field may be set to load a key from the Keyring. When this field is set the class will search the Keyring for a key associated with the UserId specified.
When loading a key with multiple user Ids, this field will be populated with the UserId that was most recently added to the key. To discover all of the UserIds associated with a key query this field and OtherUserIds after loading the key.
The UserId format is:
FirstName LastName (Comment) <Email>Not all values are required when selecting or generating a key, but at least FirstName or Email are required.
Note that for OpenPGP v6, a key may be created with or without a UserId, as the field is optional. If a key was created without a UserId, the key's Fingerprint can be used as it's identifier instead.
When using this field to select a key you may also specify the key's Id, or any of its subkeys' Ids, instead of a user Id. The class will then search for a key with a matching Id. This is helpful in situations where you do not have the UserId but still need to load the key, such as within the OpenPGP class's RecipientInfo event.
Version
int (read-only)
Default Value: 4
This field can be used to query the OpenPGP version of the currently selected Key. Possible values are:
- 4 - OpenPGP v4 (default)
- 6 - OpenPGP v6
Constructors
public Key( keyring);
Reads the OpenPGP public key from the specified Keyring . If multiple keys are present only the first one is used.
public Key( encoded);
Reads the OpenPGP key from the specified Encoded . Both binary-formatted and ASCII-armored data are accepted.
public Key( keyring, userId);
Searches the Keyring for an OpenPGP key with a matching UserId . If UserId is set to "*" the first key will be used.
public Key( keyring, secretKeyringFile, publicKeyringFile, userId);
Searches the Keyring for the specified SecretKeyRingFile and PublicKeyringFile . If UserId is set to "*" the first key will be used.
public Key( encoded, userId);
Searches the Encoded for an OpenPGP key with a matching UserId . If UserId is set to "*" the first key will be used.
Config Settings (OpenPGP Class)
The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.OpenPGP Config Settings
By default, this value is 6. Valid values range from 6 to 22.
The chunk size is calculated as 2^exp (in octets, or bytes), where exp is the value of this configuration setting. For example, the default chunk size would be: 2^(6) = 64 bytes. In this case, the plaintext would be split into chunks of 64 bytes, each of which will be individually encrypted using the specified EncryptingAlgorithm.
When set to True the class will read the features from the recipient key to determine if the older packet type is required. If the key does require the old packet type, then the older packet type will be used. If the key does not require the old packet type, then the new integrity protected packet type will still be used.
By default this value is False. This means under no conditions is the older less secure packet type used. The newer integrity protected packet type is always used.
Only enable this setting if you have a requirement to do so.
The default value is 3. Valid values range from 1 to 2^(32)-1. Higher values provide more brute-force protection for the key passphrase at the cost of performance. This configuration can be used to tune the running time independently of the memory size (see Argon2MemorySizeExp).
The default value is 16. Valid values range from 3 to 31, though the minimum can vary depending on the value of Argon2Parallelism (see below). The memory size (in KB) is calculated as 2^exp, where exp is the value of this configuration setting. For example, the default memory size would be: 2^(16) = 65,536 KB.
Note: The memory size must be an integer number of kilobytes ranging from 8*p to 2^(32)-1, where p is the value of Argon2Parallelism. Therefore, Argon2MemorySizeExp must be an integer ranging from 3+ceil(log2(p)) to 31. For example, if Argon2Parallelism is set to 8, valid values for Argon2MemorySizeExp range from 6 to 31.
The default value is 4. Valid values range from 1 to 2^(24)-1.
zlib | 1-6 |
zip | 1-6 |
bzip2 | 1-9 |
89011C04000102000605025100459B000A0910E2...
DSA Notes
DSA requires that the hash be 160 bits or larger, which means MD5 is not a suitable algorithm. When DSA Signature Hash Algorithm selection is enabled (default) the class will use the preferred algorithm from the key if it meets the requirements for DSA. If the preferred algorithm is MD5 and does not meed the requirements for DSA the class will automatically use a suitable algorithm based on the Q element of the DSA key (may be SHA1, SHA224, or SHA256).
ECDSA Notes
The ECDSA Signature Hash Algorithm requirements are directly related to the Curve used by the key. When this setting is enabled (default) the class will use the preferred algorithm from the key if it meets the requirements for ECDSA. If the preferred algorithm does not meet the requirements the class will automatically select a valid hash algorithm based on the curve as follows:
Curve | Hash Algorithm |
secp256r1 | SHA256 |
secp384r1 | SHA384 |
secp521r1 | SHA512 |
secp256k1 | SHA256 |
The default value is False.
For OpenPGP v4 keys and earlier, the key Id corresponds to the last 4 or 8 bytes of the key's Fingerprint. For OpenPGP v6 keys, the key Id corresponds to the first 8 bytes of the key's Fingerprint instead. For instance:
5E70662EA810E768
0 | Automatic selection, first suitable subkey. Expired keys accepted. |
1 | Automatic selection, first suitable subkey. Expired keys not accepted. |
2 | Automatic selection, newest suitable subkey. Expired keys not accepted (Default). |
99 | Manual Selection. |
Manual Selection
To manually select a key for any operation pass the key's Id in the constructor.
Openpgp pgp = new Openpgp();
pgp.Config("KeySelectionMethod=99");
pgp.RecipientKeys.Add(new Key(@"C:\path\to\key.asc", "7CA1376C39768977")); // Key with Id 7CA1376C39768977 will be used for encryption.
0 (None) | No events are logged. |
1 (Info - default) | Informational events are logged. |
2 (Verbose) | Detailed data is logged. |
3 (Debug) | Debug data is logged. |
- To create a PGP zip file set this value to a location on disk including a filemask and call Encrypt. For instance:
OpenPGP1.Config("PGPZipDir=C:\MyFiles\*.txt"); OpenPGP1.OutputFile = "C:\PGPZip.pgp"; OpenPGP1.Encrypt();
The created file returned in the OutputFile property is the PGP zip. If InputFile is specified it is used to temporarily hold the Tar archive while creating the PGP zip file. The temporary file is not automatically deleted. If InputFile is not specified the Tar archive is held in memory while creating the PGP zip file. - To extract a PGP zip file set this value to a location on disk and call Decrypt. For instance:
OpenPGP1.Config("PGPZipDir=C:\MyFiles"); OpenPGP1.InputFile = "C:\PGPZip.pgp"; OpenPGP1.Decrypt();
The extracted files will be present in the specified directory. If OutputFile is specified it is used to temporarily hold the Tar archive. The temporary file is not automatically deleted. If OutputFile is not specified the Tar archive is held in memory while extracting the PGP zip file. Note that if the OpenPGP message supplied is not a PGP zip file the decryption will occur as normal without error.
0 | Automatic - If the PGP message contains the special header version "PGP Command Line" then recursive decryption will be attempted. (Default) |
1 | Always attempt recursive decryption. |
2 | Never attempt recursive decryption. |
The default value is false.
The default value is false.
This configuration is only applicable when SymmetricPassphrase is specified and when calling Encrypt or Decrypt. Additionally, the following configuration settings are applicable when this config is set to True:
Note that if UseArgon2 is enabled, EncryptingAlgorithm must be specified as an AEAD encryption algorithm (e.g., AES192-OCB). Please see the EncryptingAlgorithm for additional details.
This config is True by default, and must be true when verifying an OpenPGP v6 cleartext signature. When enabled, the cleartext portion will be cached in memory until the signature is fully processed.
Note: If the signature is known to be an OpenPGP v4 cleartext signature beforehand (i.e., signed with a v4 key), this config may be set to False. However, if this config is disabled, the class will be unable to verify OpenPGP v6 cleartext signatures. In this case, the class will throw an exception when calling VerifySignature or DecryptAndVerifySignature.
This setting will be populated after calling Decrypt, VerifySignature, or DecryptAndVerifySignature.
Base Config Settings
In some non-GUI applications, an invalid message loop may be discovered that will result in errant behavior. In these cases, setting GUIAvailable to false will ensure that the class does not attempt to process external events.
- Product: The product the license is for.
- Product Key: The key the license was generated from.
- License Source: Where the license was found (e.g., RuntimeLicense, License File).
- License Type: The type of license installed (e.g., Royalty Free, Single Server).
- Last Valid Build: The last valid build number for which the license will work.
This setting only works on these classes: AS3Receiver, AS3Sender, Atom, Client(3DS), FTP, FTPServer, IMAP, OFTPClient, SSHClient, SCP, Server(3DS), Sexec, SFTP, SFTPServer, SSHServer, TCPClient, TCPServer.
The Java edition requires installation of the FIPS-certified Bouncy Castle library regardless of the target operating system. This can be downloaded from https://www.bouncycastle.org/fips-java/. Only the "Provider" library is needed. The jar file should then be installed in a JRE search path.
The following classes must be imported in the application in which the component will be used:
import java.security.Security;
import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
The Bouncy Castle provider must be added as a valid provider and must also be configured to operate in FIPS mode:
System.setProperty("org.bouncycastle.fips.approved_only","true");
Security.addProvider(new BouncyCastleFipsProvider());
When UseFIPSCompliantAPI is true, Secure Sockets Layer (SSL)-enabled classes can optionally be configured to use the Transport Layer Security (TLS) Bouncy Castle library. When SSLProvider is set to sslpAutomatic (default) or sslpInternal, an internal TLS implementation is used, but all cryptographic operations are offloaded to the Bouncy Castle FIPS provider to achieve FIPS-compliant operation. If SSLProvider is set to sslpPlatform, the Bouncy Castle JSSE will be used in place of the internal TLS implementation.
To enable the use of the Bouncy Castle JSSE take the following steps in addition to the steps above. Both the Bouncy Castle FIPS provider and the Bouncy Castle JSSE must be configured to use the Bouncy Castle TLS library in FIPS mode. Obtain the Bouncy Castle TLS library from https://www.bouncycastle.org/fips-java/. The jar file should then be installed in a JRE search path.
The following classes must be imported in the application in which the component will be used:
import java.security.Security;
import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
//required to use BCJSSE when SSLProvider is set to sslpPlatform
import org.bouncycastle.jsse.provider.BouncyCastleJsseProvider;
The Bouncy Castle provider must be added as a valid provider and also must be configured to operate in FIPS mode:
System.setProperty("org.bouncycastle.fips.approved_only","true");
Security.addProvider(new BouncyCastleFipsProvider());
//required to use BCJSSE when SSLProvider is set to sslpPlatform
Security.addProvider(new BouncyCastleJsseProvider("fips:BCFIPS"));
//optional - configure logging level of BCJSSE
Logger.getLogger("org.bouncycastle.jsse").setLevel(java.util.logging.Level.OFF);
//configure the class to use BCJSSE
component.setSSLProvider(1); //platform
component.config("UseFIPSCompliantAPI=true");
Note: TLS 1.3 support requires the Bouncy Castle TLS library version 1.0.14 or later.
FIPS mode can be enabled by setting the UseFIPSCompliantAPI configuration setting to true. This is a static setting that applies to all instances of all classes of the toolkit within the process. It is recommended to enable or disable this setting once before the component has been used to establish a connection. Enabling FIPS while an instance of the component is active and connected may result in unexpected behavior.
For more details, please see the FIPS 140-2 Compliance article.
Note: Enabling FIPS compliance requires a special license; please contact sales@nsoftware.com for details.
Setting this configuration setting to true tells the class to use the internal implementation instead of using the system security libraries.
This setting is set to false by default on all platforms.
Trappable Errors (OpenPGP Class)
OpenPGP Errors
101 | Cannot decode ASCII Armor data. |
102 | Unknown ASCII Armor data type. |
103 | Checksum failed. |
104 | Unknown ASCII Armor header. |
105 | Cannot decode PGP packet. |
106 | Cannot encode PGP packet. |
107 | Unknown PGP packet tag. |
108 | Unsupported version. |
109 | Unsupported algorithm. |
110 | Unknown subpacket. |
111 | Internal error. |
112 | Feature not supported. |
113 | Secret data was not encrypted. |
114 | Cannot find the key. |
115 | Error reading file. |
116 | Error writing file. |
117 | Error reading key. |
118 | Error writing key. |
119 | Cannot verify signature. |
120 | Cannot create signature. |
121 | Invalid UserId. |
122 | Invalid passphrase. |
123 | Data encryption failed. |
124 | Error creating key. |
125 | Unsupported symmetric algorithm. |
126 | Unsupported hash. |
127 | Unsupported compression algorithm. |
128 | Invalid key usage. |
129 | Component is busy. |
130 | Error decrypting data. |
131 | Data is not compressed. |
132 | Error decompressing data. |
133 | Error compressing data. |
134 | Unsupported signature. |
135 | Failed to overwrite file. |
141 | No input. |
142 | Signing was required, but the message was not signed. |
143 | Encryption was required, but the message was not encrypted. |
146 | No data integrity packet was found (MDC), but one was required. |
200 | Out of memory. |