Java & PGP

One of the Java projects I’m working on required that the application encrypted certain pieces of information (not files, but strings) using PGP, and from what I can tell, there aren’t a whole lot of libraries and/or examples out there. The one I saw mentioned most frequently was the Bouncy Castle Crypto API, but in the short time that I looked through the documentation and the examples (org.bouncycastle.openpgp.examples), I saw nothing that looked like it would help me. So I downloaded PGP 6.5.8 (the version we’ve standardized on at work) from pgpi.org and hacked away at a version that works from the command line. Here’s the result:

String information = "The random text information I want to encrypt.";
String filename = "tempfile.txt";
// path to where I have pgp installed
String directory = "c:\\pgp6.5.8\\";
// my pgp key
String pgpkey = "aaron.s.johnson@gmail.com";
// create a file and write the string to it
File outputfile = new File(directory + filename);
FileWriter out = new FileWriter(outputfile);
out.write(information.toCharArray());
out.close();
// get a runtime object
Runtime rt = Runtime.getRuntime();
// execute pgp from the command line
// e=encrypt a=ascii t=text file w=wipe the file
Process process = rt.exec(directory + "pgp -eatw " + directory + filename + " " + pgpkey);
// wait for the execution to end
process.waitFor();
// read the armored ASCII file
File inputfile = new File(directory + filename + ".asc");
BufferedReader isr = new BufferedReader(new FileReader(inputfile));
StringBuffer decrypted = new StringBuffer();
String line = "";
while ((line = isr.readLine()) != null) {
  decrypted.append(line + "\n");
}
// close the reader
isr.close();
inputfile.delete();
// print out the encrypted string for kicks
System.out.println(decrypted.toString());

A quick summary. The PGP executable assumes that you’re encrypting and decrypting files, so I first take the string that I want to encrypt and write it to a text file using the File and FileWriter classes. Then I use the Runtime class to execute PGP from the command line, which encrypts the file and deletes the original plain text unencrypted file that I just created. I call the waitFor() method on the Process to make sure that the execution is complete, and then I read in resulting armored ASCII file using the File, FileReader and BufferedReader classes. Finally, I delete the armored ASCII file. Obviously in production you’d want to use a unique name for the file so that you don’t overwrite or delete a file that another thread just created. Other than that, are there any issues that I missed?

5 thoughts on “Java & PGP”

  1. I implemented some PGP functionality last year using the Cryptix Open PGP implementation. http://www.cryptix.org (seems to be offline at the moment). They provided pretty good examples for common use cases and it was happily compatible with GnuPG.

  2. I had the same problem within the last month. I used the Cryptix library too. I had to read the example code given to figure out how the library worked, but that wasn’t hard.

    The only issue was finding the Cryptix library since the web site is out of commission, as Andrew Crump mentioned. However, I found a mirror of the Cryptix download site when I googled for Cryptix. If you are comfortable using the library from the mirror site, here is the url:
    http://www.mirrors.wiretapped.net/security/cryptography/libraries/cryptix/

  3. I checked the pgpi site to see if I can get the decryption command. I could not find anything that uses a passphrase to decrypt a file..Do you have a sample code to decrypt using pass phrase for private key.
    Thanks in advance,

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>