Top Description Fields Constructors Methods
org.bouncycastle.bcpg

public Class SecretKeyPacket

extends ContainedPacket
implements PublicKeyAlgorithmTags
Class Inheritance
All Implemented Interfaces
org.bouncycastle.bcpg.PublicKeyAlgorithmTags
Known Direct Subclasses
org.bouncycastle.bcpg.SecretSubkeyPacket
Imports
java.io.ByteArrayInputStream, .ByteArrayOutputStream, .IOException, org.bouncycastle.util.Arrays, org.bouncycastle.util.io.Streams
Base class for OpenPGP secret (primary) keys.

Field Summary

Modifier and TypeField and Description
private int
aeadAlgorithm

private int
encAlgorithm

private byte[]
iv

private PublicKeyPacket
pubKeyPacket

private S2K
s2k

private int
s2kUsage

private byte[]
secKeyData

public static final int
USAGE_AEAD

S2K-usage octet indicating that the secret key material is protected using an AEAD scheme.

public static final int
USAGE_CHECKSUM

Deprecated Use of MalleableCFB is deprecated.
S2K-usage octet indicating that the secret key material is protected using malleable CFB.
public static final int
USAGE_NONE

S2K-usage octet indicating that the secret key material is unprotected.

public static final int
USAGE_SHA1

S2K-usage octet indicating that the secret key material is protected using a cipher in CFB mode.

Constructor Summary

AccessConstructor and Description
pack-priv
SecretKeyPacket(BCPGInputStream
packet input stream
in)

Parse a primary OpenPGP secret key packet from the given OpenPGP BCPGInputStream.

pack-priv
SecretKeyPacket(BCPGInputStream
packet input stream
in, boolean
current or legacy packet format
newPacketFormat)

Parse a primary OpenPGP secret key packet from the given OpenPGP BCPGInputStream.

pack-priv
SecretKeyPacket(int
packet type ID
keyTag, BCPGInputStream
packet input stream
in)

Parse a SecretKeyPacket or SecretSubkeyPacket from the given OpenPGP BCPGInputStream.

pack-priv
SecretKeyPacket(int
packet type ID
keyTag, BCPGInputStream
packet input stream
in, boolean
packet format
newPacketFormat)

Parse a SecretKeyPacket or SecretSubkeyPacket from an OpenPGP BCPGInputStream.

public
SecretKeyPacket(PublicKeyPacket
pubkey packet corresponding to this secret key packet.
pubKeyPacket, int
algorithm id of the symmetric key algorithm that was used to encrypt the secret key material
encAlgorithm, S2K
s2k identifier for deriving a key from a passphrase
s2k, byte[]
IV that was used to encrypt the secret key material
iv, byte[]
encrypted/checksum'd secret key material
secKeyData)

Construct a SecretKeyPacket.

pack-priv
SecretKeyPacket(int
packet type ID
keyTag, PublicKeyPacket
pubkey packet corresponding to this secret key packet.
pubKeyPacket, int
algorithm id of the symmetric key algorithm that was used to encrypt the secret key material
encAlgorithm, S2K
s2k identifier for deriving a key from a passphrase
s2k, byte[]
IV that was used to encrypt the secret key material
iv, byte[]
encrypted/checksum'd secret key material
secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

public
SecretKeyPacket(PublicKeyPacket
pubkey packet corresponding to this secret key packet.
pubKeyPacket, int
algorithm id of the symmetric key algorithm that was used to encrypt the secret key material
encAlgorithm, int
octet indicating, how the secert key material was protected
s2kUsage, S2K
s2k identifier for deriving a key from a passphrase
s2k, byte[]
IV that was used to encrypt the secret key material
iv, byte[]
encrypted/checksum'd secret key material
secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

public
SecretKeyPacket(PublicKeyPacket
pubkey packet corresponding to this secret key packet.
pubKeyPacket, int
algorithm id of the symmetric key algorithm that was used to encrypt the secret key material
encAlgorithm, int
AEAD algorithm scheme used to protect the secret key material with
aeadAlgorithm, int
octet indicating how the secret key material was encrypted
s2kUsage, S2K
s2k identifier for deriving a key from a passphrase
s2k, byte[]
IV that was used to encrypt the secret key material
iv, byte[]
encrypted/checksum'd secret key material
secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

pack-priv
SecretKeyPacket(int
packet type ID
keyTag, PublicKeyPacket
pubkey packet corresponding to this secret key packet.
pubKeyPacket, int
algorithm id of the symmetric key algorithm that was used to encrypt the secret key material
encAlgorithm, int
AEAD algorithm scheme used to protect the secret key material with
aeadAlgorithm, int
octet indicating how the secret key material was encrypted
s2kUsage, S2K
s2k identifier for deriving a key from a passphrase
s2k, byte[]
IV that was used to encrypt the secret key material
iv, byte[]
encrypted/checksum'd secret key material
secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

Method Summary

Modifier and TypeMethod and Description
public void
encode(BCPGOutputStream
packet output stream
out)

Implements abstract org.bouncycastle.bcpg.ContainedPacket.encode.

Encode the packet into the given BCPGOutputStream.

private byte[]
encodeConditionalParameters()

public int

Returns:

aead algorithm id
getAeadAlgorithm()

Return the algorithm ID of the AEAD algorithm that was used to protect the secret key material.

public int

Returns:

symmetric key enc algorithm id
getEncAlgorithm()

Return the algorithm ID of the symmetric key algorithm that was used to encrypt the secret key material.

public byte[]

Returns:

encoded packet contents
getEncodedContents()

Return the encoded packet content without packet frame.

public byte[]

Returns:

IV
getIV()

Return the IV that was used to protect the secret key material.

public PublicKeyPacket

Returns:

public key packet
getPublicKeyPacket()

Return the public key packet corresponding to the secret key packet.

public S2K

Returns:

s2k identifier
getS2K()

Return the S2K identifier describing, how to derive the symmetric key to protect the secret key material with.

public int

Returns:

s2k usage
getS2KUsage()

Return the S2K usage mode indicating how the secret key material is protected.

public byte[]

Returns:

secret key data
getSecretKeyData()

Return the encrypted/checksum'd secret key data.

Inherited from org.bouncycastle.bcpg.ContainedPacket:
getEncodedgetEncoded

Field Detail

aeadAlgorithmback to summary
private int aeadAlgorithm
encAlgorithmback to summary
private int encAlgorithm
ivback to summary
private byte[] iv
pubKeyPacketback to summary
private PublicKeyPacket pubKeyPacket
s2kback to summary
private S2K s2k
s2kUsageback to summary
private int s2kUsage
secKeyDataback to summary
private byte[] secKeyData
USAGE_AEADback to summary
public static final int USAGE_AEAD

S2K-usage octet indicating that the secret key material is protected using an AEAD scheme. This usage protects against above-mentioned attacks. Passphrase-protected secret key material in a v6 Secret Key or v6 Secret Subkey packet SHOULD be protected with AEAD encryption unless it will be transferred to an implementation that is known to not support AEAD. Users should migrate to AEAD with all due speed.

USAGE_CHECKSUMback to summary
public static final int USAGE_CHECKSUM

Deprecated

Use of MalleableCFB is deprecated. For v4 keys, use USAGE_SHA1 instead. For v6 keys use USAGE_AEAD instead.

S2K-usage octet indicating that the secret key material is protected using malleable CFB. Malleable-CFB-encrypted keys are vulnerable to corruption attacks that can cause leakage of secret data when the secret key is used.

See Also
Klíma, V. and T. Rosa, "Attack on Private Signature Keys of the OpenPGP Format, PGP(TM) Programs and Other Applications Compatible with OpenPGP", Bruseghini, L., Paterson, K. G., and D. Huigens, "Victory by KO: Attacking OpenPGP Using Key Overwriting"
USAGE_NONEback to summary
public static final int USAGE_NONE

S2K-usage octet indicating that the secret key material is unprotected.

USAGE_SHA1back to summary
public static final int USAGE_SHA1

S2K-usage octet indicating that the secret key material is protected using a cipher in CFB mode. CFB-encrypted keys are vulnerable to corruption attacks that can cause leakage of secret data when the secret key is use.

See Also
Klíma, V. and T. Rosa, "Attack on Private Signature Keys of the OpenPGP Format, PGP(TM) Programs and Other Applications Compatible with OpenPGP", Bruseghini, L., Paterson, K. G., and D. Huigens, "Victory by KO: Attacking OpenPGP Using Key Overwriting"

Constructor Detail

SecretKeyPacketback to summary
pack-priv SecretKeyPacket(BCPGInputStream in) throws IOException

Parse a primary OpenPGP secret key packet from the given OpenPGP BCPGInputStream. The packet format is remembered as PacketFormat#LEGACY.

Parameters
in:BCPGInputStream

packet input stream

SecretKeyPacketback to summary
pack-priv SecretKeyPacket(BCPGInputStream in, boolean newPacketFormat) throws IOException

Parse a primary OpenPGP secret key packet from the given OpenPGP BCPGInputStream. If 

newPacketFormat
is true, the packet format will be remembered as PacketFormat#CURRENT, otherwise as PacketFormat#LEGACY.
Parameters
in:BCPGInputStream

packet input stream

newPacketFormat:boolean

current or legacy packet format

SecretKeyPacketback to summary
pack-priv SecretKeyPacket(int keyTag, BCPGInputStream in) throws IOException

Parse a SecretKeyPacket or SecretSubkeyPacket from the given OpenPGP BCPGInputStream. The return type depends on the 

keyTag
: PacketTags#SECRET_KEY means the result is a SecretKeyPacket. PacketTags#SECRET_SUBKEY results in a SecretSubkeyPacket. The packet format will be remembered as PacketFormat#LEGACY.
Parameters
keyTag:int

packet type ID

in:BCPGInputStream

packet input stream

SecretKeyPacketback to summary
pack-priv SecretKeyPacket(int keyTag, BCPGInputStream in, boolean newPacketFormat) throws IOException

Parse a SecretKeyPacket or SecretSubkeyPacket from an OpenPGP BCPGInputStream. The return type depends on the 

keyTag
: PacketTags#SECRET_KEY means the result is a SecretKeyPacket. PacketTags#SECRET_SUBKEY results in a SecretSubkeyPacket.
Parameters
keyTag:int

packet type ID

in:BCPGInputStream

packet input stream

newPacketFormat:boolean

packet format

Exceptions
IOException:
if the secret key packet cannot be parsed
See Also
OpenPGP - Secret-Key Packet Formats, LibrePGP - Secret-Key Packet Formats, Hardware-Backed Secret Keys
SecretKeyPacketback to summary
public SecretKeyPacket(PublicKeyPacket pubKeyPacket, int encAlgorithm, S2K s2k, byte[] iv, byte[] secKeyData)

Construct a SecretKeyPacket.

Note 

secKeyData
needs to be prepared by applying encryption/checksum beforehand.
Parameters
pubKeyPacket:PublicKeyPacket

pubkey packet corresponding to this secret key packet.

encAlgorithm:int

algorithm id of the symmetric key algorithm that was used to encrypt the secret key material

s2k:S2K

s2k identifier for deriving a key from a passphrase

iv:byte[]

IV that was used to encrypt the secret key material

secKeyData:byte[]

encrypted/checksum'd secret key material

SecretKeyPacketback to summary
pack-priv SecretKeyPacket(int keyTag, PublicKeyPacket pubKeyPacket, int encAlgorithm, S2K s2k, byte[] iv, byte[] secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

Note 

secKeyData
needs to be prepared by applying encryption/checksum beforehand.
Parameters
keyTag:int

packet type ID

pubKeyPacket:PublicKeyPacket

pubkey packet corresponding to this secret key packet.

encAlgorithm:int

algorithm id of the symmetric key algorithm that was used to encrypt the secret key material

s2k:S2K

s2k identifier for deriving a key from a passphrase

iv:byte[]

IV that was used to encrypt the secret key material

secKeyData:byte[]

encrypted/checksum'd secret key material

SecretKeyPacketback to summary
public SecretKeyPacket(PublicKeyPacket pubKeyPacket, int encAlgorithm, int s2kUsage, S2K s2k, byte[] iv, byte[] secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

Note 

secKeyData
needs to be prepared by applying encryption/checksum beforehand.
Parameters
pubKeyPacket:PublicKeyPacket

pubkey packet corresponding to this secret key packet.

encAlgorithm:int

algorithm id of the symmetric key algorithm that was used to encrypt the secret key material

s2kUsage:int

octet indicating, how the secert key material was protected

s2k:S2K

s2k identifier for deriving a key from a passphrase

iv:byte[]

IV that was used to encrypt the secret key material

secKeyData:byte[]

encrypted/checksum'd secret key material

SecretKeyPacketback to summary
public SecretKeyPacket(PublicKeyPacket pubKeyPacket, int encAlgorithm, int aeadAlgorithm, int s2kUsage, S2K s2k, byte[] iv, byte[] secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

Note 

secKeyData
needs to be prepared by applying encryption/checksum beforehand.
Parameters
pubKeyPacket:PublicKeyPacket

pubkey packet corresponding to this secret key packet.

encAlgorithm:int

algorithm id of the symmetric key algorithm that was used to encrypt the secret key material

aeadAlgorithm:int

AEAD algorithm scheme used to protect the secret key material with

s2kUsage:int

octet indicating how the secret key material was encrypted

s2k:S2K

s2k identifier for deriving a key from a passphrase

iv:byte[]

IV that was used to encrypt the secret key material

secKeyData:byte[]

encrypted/checksum'd secret key material

SecretKeyPacketback to summary
pack-priv SecretKeyPacket(int keyTag, PublicKeyPacket pubKeyPacket, int encAlgorithm, int aeadAlgorithm, int s2kUsage, S2K s2k, byte[] iv, byte[] secKeyData)

Construct a SecretKeyPacket or SecretSubkeyPacket.

Note 

secKeyData
needs to be prepared by applying encryption/checksum beforehand.
Parameters
keyTag:int

packet type ID

pubKeyPacket:PublicKeyPacket

pubkey packet corresponding to this secret key packet.

encAlgorithm:int

algorithm id of the symmetric key algorithm that was used to encrypt the secret key material

aeadAlgorithm:int

AEAD algorithm scheme used to protect the secret key material with

s2kUsage:int

octet indicating how the secret key material was encrypted

s2k:S2K

s2k identifier for deriving a key from a passphrase

iv:byte[]

IV that was used to encrypt the secret key material

secKeyData:byte[]

encrypted/checksum'd secret key material

Method Detail

encodeback to summary
public void encode(BCPGOutputStream out) throws IOException

Implements abstract org.bouncycastle.bcpg.ContainedPacket.encode.

Encode the packet into the given BCPGOutputStream. If the packet output stream has PacketFormat#ROUNDTRIP set, the packet format to encode the packet length with depends on the result of hasNewPacketFormat(). Otherwise, the packet output stream dictates the packet format.

Parameters
out:BCPGOutputStream

packet output stream

encodeConditionalParametersback to summary
private byte[] encodeConditionalParameters() throws IOException
getAeadAlgorithmback to summary
public int getAeadAlgorithm()

Return the algorithm ID of the AEAD algorithm that was used to protect the secret key material.

Returns:int

aead algorithm id

getEncAlgorithmback to summary
public int getEncAlgorithm()

Return the algorithm ID of the symmetric key algorithm that was used to encrypt the secret key material.

Returns:int

symmetric key enc algorithm id

getEncodedContentsback to summary
public byte[] getEncodedContents() throws IOException

Return the encoded packet content without packet frame.

Returns:byte[]

encoded packet contents

getIVback to summary
public byte[] getIV()

Return the IV that was used to protect the secret key material.

Returns:byte[]

IV

getPublicKeyPacketback to summary
public PublicKeyPacket getPublicKeyPacket()

Return the public key packet corresponding to the secret key packet.

Returns:PublicKeyPacket

public key packet

getS2Kback to summary
public S2K getS2K()

Return the S2K identifier describing, how to derive the symmetric key to protect the secret key material with.

Returns:S2K

s2k identifier

getS2KUsageback to summary
public int getS2KUsage()

Return the S2K usage mode indicating how the secret key material is protected.

Returns:int

s2k usage

getSecretKeyDataback to summary
public byte[] getSecretKeyData()

Return the encrypted/checksum'd secret key data.

Returns:byte[]

secret key data