Before starting I would like to thank all the people who have viewed my posts on using Bouncy Castle. I have been monitoring the hits on my blog and I’ve noticed that my series on encryption with Bouncy Castle has been getting a lot of attention. I did promise to make Part 4 about encrypting and signing a single file all in one, but from lack of time I do not think it will make it to Part 4.
One of the main reasons is that Bouncy Castle is largely undocumented and what little documentation there exists on the net is not enough. The way I have created my posts where by reading the unit test cases from the Bouncy Castle source package and doing some trial and error and testing with PGP Desktop and GPG. So there isn’t enough time for me to continue to do that. So for Part 4 I have decided to show how we add Bouncy Castle support to Android!
Continuing my 5 part series on using the Bouncy Castle API to create your own Java library to manage Private / Public key pairs. Part 2 went over digitally signing and verifying messages using the generated key pair from Part 1. Also, just a note, the signature generation from Part 2 are not detached signatures, they’re embedded within the information. I’ll talk about why I prefer to do this when we get to Part 4.
Encryption is done using the recipients public key and does not require us to enter a pass phrase. When the recipient receives the encrypted message they will need to enter their pass phrase in order to decrypt the message. This is mainly so because their public key is protected by password based symmetric encryption inside the key ring.
Below we add the encrypt and decrypt methods to our PGPCryptoTools source file.
In part 1 I went over PGP Key pair generation, DSA/El Gamal key pairs to be exact, and how we can generate them using the Legion of the Bouncy Castle cryptography API. These key pairs can be imported directly into PGP for use or used programmatically via the Bouncy Castle API.
OK, so now that we know how to generate our PGP key pair we now will learn how to digitally sign and verify files. Signing files allows our recipient to verify the authenticity of the origin of the file we send them. It also verifies the integrity of the file as well.
Signing a file
- PGP Private Key of sender
- Private Key Passphrase
Verifying a file
- Public Key of sender
To make a developers life easier I’ve decided to create a static class called PGPCryptoTools which include the sign and verify methods. One just has to send the appropriate parameters (as shown in the bullet points above) to sign and verify files.
Some of my favorite things to do in software engineering is use libraries with cool names. Nothing beats The Legion of the Bouncy Castle. I like that name so much that I decided to just start using it! Well actually I really needed to use PGP cryptography in one of my projects and though it would be nice to blog about it, but yeah cool name though.
So one of the tricky issues with using Bouncy Castle (we seriously do it a disservice by shortening its amazing name to just 2 words) is the lack of proper, complete and friendly documentation. You may find many articles on the net or tutorials, but I found them way too complex and some just didn’t know what they were doing.
The best option was to look at the Bouncy Castle source code and go directly to their examples package. There they give some pretty good examples and enough to build your own tools for their API. In this part of my series I will go over generating a full fledged DSA/El Gamal PGP Key Ring that is importable into PGP.