Skip to content

Commit

Permalink
Fix cosmetic whitespace issues
Browse files Browse the repository at this point in the history
  • Loading branch information
neuhalje committed Dec 20, 2018
1 parent 983a4d4 commit b358dbf
Show file tree
Hide file tree
Showing 12 changed files with 59 additions and 59 deletions.
2 changes: 1 addition & 1 deletion CODE_OF_CONDUCT.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# Bouncy-GPG Code of Conduct

quod tibi non vis fieri
quod tibi non vis fieri
22 changes: 11 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ The encrypted message is then decrypted and the signature is verified. (This is
) {
Streams.pipeAll(is, outputStream);
// It is very important that outputStream is closed before the result stream is read.
// The reason is that GPG writes the signature at the end of the stream.
// The reason is that GPG writes the signature at the end of the stream.
// This is triggered by closing the stream.
// In this example outputStream is closed via the try-with-resources mechanism of Java
}
Expand Down Expand Up @@ -134,7 +134,7 @@ Uses the testing keys to decrypt a file. Useful for performance measurements and

Encrypt and sign a file.

* `encrypt.sh SOURCEFILE DESTFILE`
* `encrypt.sh SOURCEFILE DESTFILE`

Uses the testing keys to encrypt a file. Useful for performance measurements and `gpg` interoperability.

Expand Down Expand Up @@ -189,14 +189,14 @@ Add bouncy castle as a dependency and then install the provider before in your a
// build.gradle
// in build.gradle add a dependency to bouncy castle and bouncy-gpg
//...
//...
repositories {
mavenCentral()
jcenter()
}
//...
//...
// ...
dependencies {
Expand Down Expand Up @@ -230,7 +230,7 @@ and this dependency snippet:
<version>2.1.1</version>
   </dependency>
```
 

### Install Provider

```java
Expand Down Expand Up @@ -270,19 +270,19 @@ FAQ

<dt>How can I contribute?</dt>
<dd>Pullrequests are welcome! Please state in your PR that you put your code under the LICENSE.</dd>

<dt>I am getting 'org.bouncycastle.openpgp.PGPException: checksum mismatch ..' exceptions</dt>
<dd>The passphrase to your private key is very likely wrong (or you did not pass a passphrase).</dd>

<dt>I am getting 'java.security.InvalidKeyException: Illegal key size' / 'java.lang.SecurityException: Unsupported keysize or algorithm parameters'</dt>
<dd>The unrestricted policy files for the JVM are <a href="http://www.bouncycastle.org/wiki/display/JA1/Frequently+Asked+Questions">probably not installed</a>.</dd>

<dt>I am getting 'java.io.EOFException: premature end of stream in PartialInputStream' while decrypting / Sender can't validate signature</dt>
<dd>This often happens when encrypting to a 'ByteArrayOutputStream' and the <a href="https://stackoverflow.com/questions/48870074/bouncy-castle-pgp-premature-end-of-stream-in-partialinputstream/49544870#49544870">encryption stream is not propely closed</a>. The reason is that GPG writes the signature at the end of the stream. This is triggered by closing the stream.</dd>

<dt>Where is 'secring.pgp'?</dt>
<dd>'secring.gpg' has been <a href="https://gnupg.org/faq/whats-new-in-2.1.html#nosecring">removed in gpg 2.1</a>. Use the other methods to read private keys.</dd>

<dt>Should I <i>use</i> secring.pgp?</dt>
<dd>No, you should implement your own key handling strategy. See <a href="#using_sec_pubring">On using (sec|pub)ring.gpg</a> below.
</dl>
Expand All @@ -298,10 +298,10 @@ FAQ

Most applications should manage their keys in an application specific database. Though this might seem more complex than just using the existing keyring files it has a some nice advantages:

* No dependency on the `gpg` executable
* No dependency on the `gpg` executable
* Keys can be managed remotely (e.g. via the applications database)
* Key management is enforced to happen via the application
* Key management for distributed (_scale out_ / _cloud_) systems is much easier when keys are not managed by the operating system
* Key management for distributed (_scale out_ / _cloud_) systems is much easier when keys are not managed by the operating system

### HOWTO use InMemoryKeyring

Expand Down
2 changes: 1 addition & 1 deletion examples/maven/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ Maven Example
================

- `settings.xml` activates JCenter (if not already enabled -- see https://maven.apache.org/settings.html)


Running
==========
Expand Down
2 changes: 1 addition & 1 deletion examples/reencrypt/demo_reencrypt.sh
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ DRIVER_CLASS=name.neuhalfen.projects.crypto.bouncycastle.openpgp.example.MainExp

DEST=/tmp/gpg-example-$$

[ -d "${DEST}" ] && rm -rf "${DEST}"
[ -d "${DEST}" ] && rm -rf "${DEST}"
mkdir $DEST || exit 1
echo Writing results into \"$DEST\"

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ public ByEMailKeySelectionStrategy(final Instant dateOfTimestampVerification) {
* If the uid does not already include '&lt;...&gt;' then wrap it in "&lt;uid&gt;"
* to filter for e-mails. E.g. "peter@example.com" will be converted to
* "&lt;peter@example.com&gt;" but "Klaus &lt;klaus@example.com&gt;" or
* "&lt;klaus@example.com&gt;" will be leaved untouched.
* "&lt;klaus@example.com&gt;" will be left untouched.
*
* @param uid the userid as passed by upstream.
* @param keyringConfig the keyring config
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,31 +24,31 @@ To quote from [RFC5869](https://tools.ietf.org/html/rfc5869):
> cryptographic systems. Its goal is to take some source of initial
> keying material and derive from it one or more cryptographically
> strong secret keys.
The following code will derive an AES-128 key and IV (or nonce) for a record identified as version `3` of row #`2386221` in `MY_TABLE`:

```groovy result:#deriveKey
import java.security.GeneralSecurityException;
import name.neuhalfen.projects.crypto.symmetric.keygeneration.DerivedKeyGenerator;
import name.neuhalfen.projects.crypto.symmetric.keygeneration.DerivedKeyGeneratorFactory;
import org.bouncycastle.util.encoders.Hex;

// Rather obviously the master key MUST NOT be part of the source code!
// This is only for demonstration purposes!
byte[] masterkey = Hex.decode("81d0994d0aa21b786d6b8dc45fc09f31");

// The salt value should not be part of the source code.
// The same salt value can be reused for all key derivations.
byte[] salt = Hex.decode("b201445d3bcdc7a07c469b7d7ef8988c");

// These settings depend on the algorithms used.
// This combination could e.g. be used for AES-256 in CTR or CBC mode
final int IV_LENGTH_BYTES = 128 / 8;

// This is the length of the generated key.
// For AES-256 use KEY_LENGTH_BYTES = 256/8
final int KEY_LENGTH_BYTES = 128 / 8;

// The key to be generated depends on three things:
// - the master key
// - the salt value
Expand All @@ -63,30 +63,30 @@ The following code will derive an AES-128 key and IV (or nonce) for a record ide
String context = "MY_TABLE";
String databasePrimaryKey = "2386221";
String recordVersion = "3";

final DerivedKeyGenerator derivedKeyGenerator =
DerivedKeyGeneratorFactory
.fromInputKey(masterkey)
.andSalt(salt)
.withHKDFsha256();

final byte[] iv = new byte[IV_LENGTH_BYTES];
final byte[] key = new byte[KEY_LENGTH_BYTES];

// The key derivation creates (arbitrary long) streams of "randomness" (it is a PRF - pseudo random function).
// Request enough randomness to cover IV and key
final byte[] keyAndIV = derivedKeyGenerator
.deriveKey(context, databasePrimaryKey, recordVersion, IV_LENGTH_BYTES + KEY_LENGTH_BYTES);

System.arraycopy(keyAndIV, 0, key, 0, key.length);
System.arraycopy(keyAndIV, key.length, iv, 0, iv.length);

System.out.println("IV: " + Hex.toHexString(iv));
System.out.println("Key: " + Hex.toHexString(key));
```





#### [Example: Changing the version will change the derived key](- "Changing the version will change the derived key")

Changing the version of the record value will derive different keys. The IV for this example is not shown. Also the key length is set to 128 bit.
Expand All @@ -97,8 +97,8 @@ Changing the version of the record value will derive different keys. The IV for
| MY_TABLE | 2386221 | **2** | 0xe1ba165e7796a4eae010ba90831d00c5 | _Incrementing the version field will generate different keys._ |
| MY_TABLE | 2386221 | **3** | 0x551cb7df244e577b5b556634117c3895 | _The example shown above._ |
| **CarInsuranceContract** | 2386221 | 3 | 0x8cf4a7e699f51ad9fa01598898f02052 | _The same 'row' in different 'tables' yields different keys._ |
| CarInsuranceContract | **D9FF7A8A-5692-48D7-A4F7-45E149448BBA** | 3 | 0xb2381876a3b63a1e90f35f8880c6373b | _IDs just need to be distinct, not necessarily integers._ |
| CarInsuranceContract | D9FF7A8A-5692-48D7-A4F7-45E149448BBA | **9EBDF712-BBBE-480E-8369-A79F8E653B63** | 0x7eed3ff1996d95db97eefcbd55f2d8d3 | _Versions just need to be distinct, not necessarily integers._ |
| CarInsuranceContract | **D9FF7A8A-5692-48D7-A4F7-45E149448BBA** | 3 | 0xb2381876a3b63a1e90f35f8880c6373b | _IDs just need to be distinct, not necessarily integers._ |
| CarInsuranceContract | D9FF7A8A-5692-48D7-A4F7-45E149448BBA | **9EBDF712-BBBE-480E-8369-A79F8E653B63** | 0x7eed3ff1996d95db97eefcbd55f2d8d3 | _Versions just need to be distinct, not necessarily integers._ |
| CarInsuranceContract | D9FF7A8A-5692-48D7-A4F7-45E149448BBA | **570E7AA2-EC6A-4F14-A58E-BB3E7E671FED** | 0x2e7bc71432f52b1a868553de401c4f84 | |

[contextId]: - "#contextId"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -25,38 +25,38 @@ secure because the password is very long and random. If a shorter password was u

```groovy result:#generatedKey
import java.nio.charset.StandardCharsets;

import org.bouncycastle.util.encoders.Hex;

import name.neuhalfen.projects.crypto.symmetric.keygeneration.impl.stretching.KeyStretching;
import name.neuhalfen.projects.crypto.symmetric.keygeneration.impl.stretching.SCryptKeyStretching;

// the password
// Rather obviously the password should NOT be stored as part of the source code
String password = "39akldsAFQqwmsx-+#aQcsvcu82cQd,.-ask72=cq8csf";

// The salt value should be application or installation specific.
// It is an absolute MUST that the salt is never changed! A different salt WILL result in a different
// key being generated!
// The salt value SHOULD be roughly as long as the key (e.g. 128/256 bit).
// The salt value SHOULD be random (so this salt value is actually a bad example)
final byte[] SALT = Hex.decode("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f");

// In this case we are using a 256 bit key, e.g. for AES-256.
final int DESIRED_KEY_LENGTH = 256;

// Use forSensitiveStorage to derive e.g. a masterkey at application startup.
// forSensitiveStorage is really slow. If you are very sure that you have a very
// good (22 characters random or longer) password for 128 bit keys / 44 character
// good (22 characters random or longer) password for 128 bit keys / 44 character
// passwords for 256 bit keys you can consider using forQuickDerivation.
final SCryptKeyStretching.SCryptKeyStretchingParameters stretchingParameters = SCryptKeyStretching.SCryptKeyStretchingParameters.forStrongInputKeyMaterial();

final KeyStretching streching = new SCryptKeyStretching(stretchingParameters);

byte[] key = streching.strengthenKey(SALT, password.getBytes(StandardCharsets.UTF_8), DESIRED_KEY_LENGTH);
return key;
```

The key generated by this sequence is [0x89d4a9b23d8a88d09e559aeeaa7cfa4a029673b01d969a2f523a7c1f749c330b](- "?=toHex(#generatedKey)").

#### [Example](- "Key derivation is deterministic")
Expand Down
10 changes: 5 additions & 5 deletions website/content/HowTo/keys/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ Creating a key by using a secure random number generator:
graph LR;
SRNG[fa:fa-cog Secure Random Number Generator] --> K(fa:fa-key Key)
K -.-> AES[fa:fa-cog AES]

classDef dotted_border stroke-width:2,stroke-dasharray:2,4;
class AES dotted_border
{{< /mermaid >}}
Expand All @@ -66,7 +66,7 @@ graph LR;
IKM --> KDF[fa:fa-cog Key Derivation Function]
KDF --> K(fa:fa-key Key)
K -.-> AES[fa:fa-cog AES]

classDef dotted_border stroke-width:2,stroke-dasharray:2,4;
class SourceProcess,AES dotted_border
{{< /mermaid >}}
Expand All @@ -78,7 +78,7 @@ The words _password_ and _cryptographic key_ are often used interchangeably, alt

A _password_ is a sequence of characters of often arbitrary length. A _cryptographic key_ is a binary object that has an algorithm specific structure to it.

Passwords can be transformed into keys by applying a [password based key derivation functions](passwords/).
Passwords can be transformed into keys by applying a [password based key derivation functions](passwords/).
Providing a _salt_ value is highly recommended as it prevents pre-computation, and more importantly different salts generate different keys for the same password.

{{<mermaid align="left">}}
Expand Down Expand Up @@ -107,10 +107,10 @@ graph LR;
MK(fa:fa-key Masterkey) --> KDF[fa:fa-cog Key Derivation Function]
KeyID(Key identifier) --> KDF
S(Salt) -. optional .-> KDF

KDF --> nonce(fa:fa-key Nonce)
KDF --> SK(fa:fa-key Subkey)

SK -.-> AES[fa:fa-cog AES]
nonce -.-> AES

Expand Down
4 changes: 2 additions & 2 deletions website/content/HowTo/keys/passwords/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ graph LR;
class AES,S dotted_border
{{< /mermaid >}}

To properly derive a key from a passwords a few aspects are important to consider.
To properly derive a key from a passwords a few aspects are important to consider.


{{% panel theme="success" header="TL;RD: Recommendation" %}}
Expand All @@ -39,7 +39,7 @@ To properly derive a key from a passwords a few aspects are important to conside
* Always use a key derivation function. _Never_ use input key material without a key derivation function.
* Use long and complex passwords as key source (128 bit key => 22 characters, 256 bit keys => 44 characters!)
* Use a random salt value that is as long as the key (128 or 256 bits)
* Configure the key stretching to be as slow (sic!) as possible
* Configure the key stretching to be as slow (sic!) as possible
{{% /panel %}}

Cryptographic key derivation functions should be used to derive a key from a password (or _any_ other source material).
Expand Down
2 changes: 1 addition & 1 deletion website/content/_header.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@
title = "header"
description = ""
+++
Bouncy GPG Documentation
Bouncy GPG Documentation
18 changes: 9 additions & 9 deletions website/content/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ The encrypted file is written to `/tmp/encrypted.gpg`.
final KeyringConfig keyringConfig = KeyringConfigs
.withKeyRingsFromFiles(
"pubring.gpg",
"secring.gpg",
"secring.gpg",
KeyringConfigCallbacks.withPassword("s3cr3t"));

try (
Expand Down Expand Up @@ -72,7 +72,7 @@ The following snippet decrypts the file created in the snippet above.
final KeyringConfig keyringConfig = KeyringConfigs
.withKeyRingsFromFiles(
"pubring.gpg",
"secring.gpg",
"secring.gpg",
KeyringConfigCallbacks.withPassword("s3cr3t"));

try (
Expand Down Expand Up @@ -118,7 +118,7 @@ Uses the testing keys to decrypt a file. Useful for performance measurements and

Encrypt and sign a file.

* `encrypt.sh SOURCEFILE DESTFILE`
* `encrypt.sh SOURCEFILE DESTFILE`

Uses the testing keys to encrypt a file. Useful for performance measurements and `gpg` interoperability.

Expand Down Expand Up @@ -172,14 +172,14 @@ Add bouncy castle as a dependency and then install the provider before in your a
// build.gradle
// in build.gradle add a dependency to bouncy castle and bouncy-gpg
//...
//...
repositories {
mavenCentral()
jcenter()
}
//...
//...
// ...
dependencies {
Expand Down Expand Up @@ -213,7 +213,7 @@ and this dependency snippet:
<version>2.1.0</version>
   </dependency>
```
 

### #2 Install Provider

```java
Expand Down Expand Up @@ -250,10 +250,10 @@ and this dependency snippet:

<dt>How can I contribute?</dt>
<dd>Pullrequests are welcome! Please state in your PR that you put your code under the LICENSE.</dd>

<dt>I am getting 'org.bouncycastle.openpgp.PGPException: checksum mismatch ..' exceptions</dt>
<dd>The passphrase to your private key is very likely wrong (or you did not pass a passphrase).</dd>

<dt>I am getting 'java.security.InvalidKeyException: Illegal key size' / 'java.lang.SecurityException: Unsupported keysize or algorithm parameters'</dt>
<dd>The unrestricted policy files for the JVM are <a href="http://www.bouncycastle.org/wiki/display/JA1/Frequently+Asked+Questions">probably not installed</a>.</dd>

Expand All @@ -276,7 +276,7 @@ The coverage report (incl. running tests) is generated with `./gradlew check`.
* Preview: `./gradlew previewWebsite`
* Publish: `./gradlew publishWebsite`

All [Concordion](https//concordion.org) [specifications](src/test/resources/specs) are executed and the result is copied into `website/content/specification`.
All [Concordion](https//concordion.org) [specifications](src/test/resources/specs) are executed and the result is copied into `website/content/specification`.

## CAVE

Expand Down
4 changes: 2 additions & 2 deletions website/content/about.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ date = "2017-10-10"
menu = "main"
+++

Cryptography is a powerful tool to implement some very tricky business requirements.
Requirement that include the words _confidentiality_, _integrity_, or _availability_ are very likely to have efficient and effective solutions that leverage cryptography.
Cryptography is a powerful tool to implement some very tricky business requirements.
Requirement that include the words _confidentiality_, _integrity_, or _availability_ are very likely to have efficient and effective solutions that leverage cryptography.

These requirements have many sources, and cryptography is not always the obvious answer. Here are some use cases that show how cryptography can help to solve problems seemingly unrelated to cryptography:

Expand Down

0 comments on commit b358dbf

Please sign in to comment.