Public and private PGP keys with Java BouncyCastle, in PEM format

We explain how to generate public and private PGP keys, in Java, using the BouncyCastle library. Then, we store the keys in PEM base64 files, and add the keys to our GPG keyring. Finally, we test the keys by encrypting and decrypting a text file using the Linux gpg command line interface (CLI).

1) BouncyCastle dependency in pom.xml

Add the following dependency to your pom.xml:

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpg-jdk15on</artifactId>
    <version>1.69</version>
</dependency>

2) Required parameters

In your Java code, prepare the following parameters, and replace with your own values:

String workFolder = System.getProperty("user.home") + "/Desktop/pgp/";
String keyUserId = "john@doe.com";
String keyPassPhrase = "secret";

The workFolder is a folder on your local machine, where we will generate the PGP keys. We will also generate a dummy text file in this folder, encrypt it and decrypt it using the Linux gpg command line interface.
The keyUserId is the User ID that will be associated with the generated PGP keys.
The keyPassPhrase is the pass phrase that will be used to decrypt your PGP private key on your machine, every time you want to use it.

3) Build the PGPKeyRingGenerator

import java.io.*;
import java.math.BigInteger;
import java.security.SecureRandom;
import java.util.Date;

import org.bouncycastle.bcpg.*;
import org.bouncycastle.bcpg.sig.*;
import org.bouncycastle.crypto.generators.RSAKeyPairGenerator;
import org.bouncycastle.crypto.params.RSAKeyGenerationParameters;
import org.bouncycastle.openpgp.*;
import org.bouncycastle.openpgp.operator.*;
import org.bouncycastle.openpgp.operator.bc.*;

import static org.bouncycastle.bcpg.HashAlgorithmTags.*;
import static org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags.*;
import static org.bouncycastle.bcpg.sig.KeyFlags.*;

static PGPKeyRingGenerator buildKeyRingGenerator(String keyID, char[] keyPassPhraseAr) throws PGPException {
    RSAKeyPairGenerator kpg = new RSAKeyPairGenerator();
    kpg.init(new RSAKeyGenerationParameters(BigInteger.valueOf(0x10001), new SecureRandom(), 2048, 12));

    PGPKeyPair rsakp_sign = new BcPGPKeyPair(PGPPublicKey.RSA_SIGN, kpg.generateKeyPair(), new Date());
    PGPKeyPair rsakp_enc = new BcPGPKeyPair(PGPPublicKey.RSA_ENCRYPT, kpg.generateKeyPair(), new Date());

    PGPSignatureSubpacketGenerator signhashgen = new PGPSignatureSubpacketGenerator();
    signhashgen.setKeyFlags(false, SIGN_DATA | CERTIFY_OTHER);
    signhashgen.setPreferredSymmetricAlgorithms(false, new int[]{AES_256, AES_192, AES_128});
    signhashgen.setPreferredHashAlgorithms(false, new int[]{SHA256, SHA1, SHA384, SHA512, SHA224});
    signhashgen.setFeature(false, Features.FEATURE_MODIFICATION_DETECTION);

    PGPSignatureSubpacketGenerator enchashgen = new PGPSignatureSubpacketGenerator();
    enchashgen.setKeyFlags(false, ENCRYPT_COMMS | ENCRYPT_STORAGE);

    PGPDigestCalculator sha1Calc = new BcPGPDigestCalculatorProvider().get(SHA1);
    PGPDigestCalculator sha256Calc = new BcPGPDigestCalculatorProvider().get(SHA256);

    PGPContentSignerBuilder pcsb = new BcPGPContentSignerBuilder(rsakp_sign.getPublicKey().getAlgorithm(), HashAlgorithmTags.SHA1);
    PBESecretKeyEncryptor pske = (new BcPBESecretKeyEncryptorBuilder(AES_256, sha256Calc, 0xc0)).build(keyPassPhraseAr);

    PGPKeyRingGenerator keyRingGen = new PGPKeyRingGenerator(PGPSignature.POSITIVE_CERTIFICATION, rsakp_sign, keyID, sha1Calc,
signhashgen.generate(), null, pcsb, pske);

    keyRingGen.addSubKey(rsakp_enc, enchashgen.generate(), null);
    return keyRingGen;
}

4) Write the PEM public and private keys to files

static void writePEMKeys(String workFolder, String keyID, String keyPassPhrase) throws IOException, PGPException {
    PGPKeyRingGenerator krgen = buildKeyRingGenerator(keyID, keyPassPhrase.toCharArray());

    PGPPublicKeyRing pkr = krgen.generatePublicKeyRing();
    try (BufferedOutputStream pubout = new BufferedOutputStream(new FileOutputStream(workFolder + "public.key"))) {
        try (ArmoredOutputStream ao = new ArmoredOutputStream(pubout)) {
            pkr.encode(ao);
        }
    }

    PGPSecretKeyRing skr = krgen.generateSecretKeyRing();
    try (BufferedOutputStream secout = new BufferedOutputStream(new FileOutputStream(workFolder + "private.key"))) {
        try (ArmoredOutputStream ao = new ArmoredOutputStream(secout)) {
            skr.encode(ao);
        }
    }
}

(fully working Java code main is available at the bottom of this article).

The generated public key PEM public.key looks like this:

The generated private key PEM private.key looks like this:

5) Test the PGP public key with the gpg ENCRYPT command

Open a terminal, and go to the workFolder we defined in step 1). First, let’s import the public key. Run:

gpg --import public.key

Now, let’s generate a dummy text file with some random content. We will use this file to test PGP encryption and decryption. Let’s call this file foo.txt:

echo "hello" > foo.txt

Then, let’s find the ID of the key we will use to encrypt the file, by listing the keys in our GPG keyring:

gpg --list-keys

In the terminal, you should see something like this:

--------------------------------
pub   rsa2048 2021-11-05 [SC]
      EFAB4FA2CF7B8A1B7407532DF438E6F1BA99B396
uid           [ unknown] john@doe.com
sub   rsa2048 2021-11-05 [E

Here, our key ID is the bold value:

EFAB4FA2CF7B8A1B7407532DF438E6F1BA99B396

Finally, let’s encrypt the text file:

gpg --encrypt --trust-model always --recipient EFAB4FA2CF7B8A1B7407532DF438E6F1BA99B396 -o encrypted.gpg foo.txt

In your work folder, a new file called encrypted.gpg has been created. It is the encrypted version of the clear text file foo.txt.

6) Test the PGP private key with the gpg DECRYPT command

Now, let’s decrypt the file we encrypted at previous step: encrypted.gpg. To do this, we need the PGP private key. So let’s import it to our key ring. Open a terminal, and go to the work folder where you have the PGP private key called private.key and the encrypted file called encrypted.gpg (this could be on the same machine as in step 5), or on a different machine). First, let’s import the private key:

gpg --import private.key

You will be prompted for the keyPassPhrase that we setup in step 1).

Then, to decrypt the file in a new clear file called decrypted.txt, simply run:

gpg --decrypt -o decrypted.txt encrypted.gpg

You will be prompted for thekeyPassPhrase one last time. Now you should be able to read the original content of the text file:

$ cat decrypted.txt 
hello

7) Fully working Java code main

That’s it for this tutorial on Java BouncyCastle and PGP keys ! Thanks for reading. Please leave a reply below, if you encounter any problem. We reply within 24h.