issue #1098 encrypt and decrypt private keys with PGPainless

FlowCrypt/src/androidTest/java/com/flowcrypt/email/ui/activity/ImportPrivateKeyActivityFromSettingsTest.kt

@@ -80,7 +80,6 @@ class ImportPrivateKeyActivityFromSettingsTest : BaseTest() {
  .around(ScreenshotTestRule())
 
  @Test
- @ReadyForCIAnnotation
  fun testImportKeyFromBackup() {
  useIntentionFromRunCheckKeysActivity()
 

FlowCrypt/src/main/java/com/flowcrypt/email/api/email/gmail/GmailApiHelper.kt

@@ -1,6 +1,8 @@
 /*
  * © 2016-present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com
- * Contributors: DenBond7
+ * Contributors:
+ * DenBond7
+ * Ivan Pizhenko
  */
 
 package com.flowcrypt.email.api.email.gmail
@@ -16,7 +18,6 @@ import com.flowcrypt.email.api.email.gmail.api.GMailRawAttachmentFilterInputStre
 import com.flowcrypt.email.api.email.gmail.api.GMailRawMIMEMessageFilterInputStream
 import com.flowcrypt.email.api.email.model.AttachmentInfo
 import com.flowcrypt.email.api.email.model.LocalFolder
-import com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor
 import com.flowcrypt.email.api.retrofit.response.base.Result
 import com.flowcrypt.email.api.retrofit.response.model.node.NodeKeyDetails
 import com.flowcrypt.email.database.FlowCryptRoomDatabase
@@ -27,6 +28,7 @@ import com.flowcrypt.email.extensions.contentId
 import com.flowcrypt.email.extensions.disposition
 import com.flowcrypt.email.extensions.isMimeType
 import com.flowcrypt.email.extensions.uid
+import com.flowcrypt.email.security.pgp.PgpKey
 import com.flowcrypt.email.ui.notifications.ErrorNotificationManager
 import com.flowcrypt.email.util.exception.CommonConnectionException
 import com.flowcrypt.email.util.exception.ExceptionUtil
@@ -668,7 +670,7 @@ class GmailApiHelper {
  }
 
  try {
- list.addAll(NodeCallsExecutor.parseKeys(backup))
+ list.addAll(PgpKey.parseKeysC(backup.toByteArray()))
  } catch (e: NodeException) {
  e.printStackTrace()
  ExceptionUtil.handleError(e)

FlowCrypt/src/main/java/com/flowcrypt/email/api/retrofit/response/model/node/NodeKeyDetails.kt

@@ -1,6 +1,8 @@
 /*
  * © 2016-present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com
- * Contributors: DenBond7
+ * Contributors:
+ * DenBond7
+ * Ivan Pizhenko
  */
 
 package com.flowcrypt.email.api.retrofit.response.model.node

FlowCrypt/src/main/java/com/flowcrypt/email/extensions/pgp/PGPKeyRingExt.kt

@@ -11,11 +11,6 @@ import com.flowcrypt.email.api.retrofit.response.model.node.Algo
 import com.flowcrypt.email.api.retrofit.response.model.node.KeyId
 import com.flowcrypt.email.api.retrofit.response.model.node.NodeKeyDetails
 import com.flowcrypt.email.security.pgp.PgpArmor
-import java.io.ByteArrayOutputStream
-import java.io.IOException
-import java.nio.charset.StandardCharsets
-import java.time.Instant
-import java.util.concurrent.TimeUnit
 import org.bouncycastle.bcpg.ArmoredOutputStream
 import org.bouncycastle.openpgp.PGPKeyRing
 import org.bouncycastle.openpgp.PGPSecretKeyRing
@@ -24,6 +19,11 @@ import org.pgpainless.key.OpenPgpV4Fingerprint
 import org.pgpainless.key.generation.type.eddsa.EdDSACurve
 import org.pgpainless.key.info.KeyInfo
 import org.pgpainless.key.info.KeyRingInfo
+import java.io.ByteArrayOutputStream
+import java.io.IOException
+import java.nio.charset.StandardCharsets
+import java.time.Instant
+import java.util.concurrent.TimeUnit
 
 /**
  * @author Denis Bondarenko
@@ -56,11 +56,11 @@ fun PGPKeyRing.toNodeKeyDetails(): NodeKeyDetails {
  )
  }
 
- val privateKey = if (keyRingInfo.isSecretKey) this.armor(PgpArmor.FLOWCRYPT_HEADERS) else null
+ val privateKey = if (keyRingInfo.isSecretKey) armor() else null
  val publicKey = if (keyRingInfo.isSecretKey) {
- (this as PGPSecretKeyRing).toPublicKeyRing().armor(PgpArmor.FLOWCRYPT_HEADERS)
+ (this as PGPSecretKeyRing).toPublicKeyRing().armor()
  } else {
-this.armor(PgpArmor.FLOWCRYPT_HEADERS)
+ armor()
  }
 
  return NodeKeyDetails(
@@ -80,7 +80,7 @@ fun PGPKeyRing.toNodeKeyDetails(): NodeKeyDetails {
 }
 
 @Throws(IOException::class)
-fun PGPKeyRing.armor(headers: List<Pair<String, String>>? = null): String {
+fun PGPKeyRing.armor(headers: List<Pair<String, String>>? = PgpArmor.FLOWCRYPT_HEADERS): String {
  ByteArrayOutputStream().use { out ->
  ArmoredOutputStream(out).use { armoredOut ->
  if (headers != null) {

FlowCrypt/src/main/java/com/flowcrypt/email/jetpack/viewmodel/LoadPrivateKeysViewModel.kt

@@ -1,6 +1,8 @@
 /*
  * © 2016-present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com
- * Contributors: DenBond7
+ * Contributors:
+ * DenBond7
+ * Ivan Pizhenko
  */
 
 package com.flowcrypt.email.jetpack.viewmodel
@@ -15,10 +17,10 @@ import com.flowcrypt.email.api.email.EmailUtil
 import com.flowcrypt.email.api.email.SearchBackupsUtil
 import com.flowcrypt.email.api.email.gmail.GmailApiHelper
 import com.flowcrypt.email.api.email.protocol.OpenStoreHelper
-import com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor
 import com.flowcrypt.email.api.retrofit.response.base.Result
 import com.flowcrypt.email.api.retrofit.response.model.node.NodeKeyDetails
 import com.flowcrypt.email.database.entity.AccountEntity
+import com.flowcrypt.email.security.pgp.PgpKey
 import com.flowcrypt.email.util.exception.ExceptionUtil
 import com.flowcrypt.email.util.exception.NodeException
 import com.google.android.gms.auth.GoogleAuthException
@@ -111,7 +113,7 @@ class LoadPrivateKeysViewModel(application: Application) : BaseAndroidViewModel(
  }
 
  try {
- details.addAll(NodeCallsExecutor.parseKeys(backup))
+ details.addAll(PgpKey.parseKeysC(backup.toByteArray()))
  } catch (e: NodeException) {
  e.printStackTrace()
  ExceptionUtil.handleError(e)

FlowCrypt/src/main/java/com/flowcrypt/email/jetpack/viewmodel/PrivateKeysViewModel.kt

@@ -1,6 +1,8 @@
 /*
  * © 2016-present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com
- * Contributors: DenBond7
+ * Contributors:
+ * DenBond7
+ * Ivan Pizhenko
  */
 
 package com.flowcrypt.email.jetpack.viewmodel
@@ -22,7 +24,6 @@ import com.flowcrypt.email.api.email.protocol.OpenStoreHelper
 import com.flowcrypt.email.api.email.protocol.SmtpProtocolUtil
 import com.flowcrypt.email.api.retrofit.ApiRepository
 import com.flowcrypt.email.api.retrofit.FlowcryptApiRepository
-import com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor
 import com.flowcrypt.email.api.retrofit.node.NodeRepository
 import com.flowcrypt.email.api.retrofit.node.PgpApiRepository
 import com.flowcrypt.email.api.retrofit.request.model.InitialLegacySubmitModel
@@ -40,6 +41,7 @@ import com.flowcrypt.email.model.PgpContact
 import com.flowcrypt.email.security.KeyStoreCryptoManager
 import com.flowcrypt.email.security.KeysStorageImpl
 import com.flowcrypt.email.security.SecurityUtils
+import com.flowcrypt.email.security.pgp.PgpKey
 import com.flowcrypt.email.service.actionqueue.actions.BackupPrivateKeyToInboxAction
 import com.flowcrypt.email.service.actionqueue.actions.RegisterUserPublicKeyAction
 import com.flowcrypt.email.service.actionqueue.actions.SendWelcomeTestEmailAction
@@ -375,7 +377,7 @@ class PrivateKeysViewModel(application: Application) : BaseNodeApiViewModel(appl
  newPassphrase: String,
  originalPrivateKey: String?): NodeKeyDetails =
  withContext(Dispatchers.IO) {
- val keyDetailsList = NodeCallsExecutor.parseKeys(originalPrivateKey!!)
+ val keyDetailsList = PgpKey.parseKeysC(originalPrivateKey!!.toByteArray())
  if (CollectionUtils.isEmpty(keyDetailsList) || keyDetailsList.size != 1) {
  throw IllegalStateException("Parse keys error")
  }
@@ -387,19 +389,19 @@ class PrivateKeysViewModel(application: Application) : BaseNodeApiViewModel(appl
  throw IllegalStateException("Passphrase for key with longid $longId not found")
  }
 
- val (decryptedKey) = NodeCallsExecutor.decryptKey(nodeKeyDetails.privateKey!!, oldPassphrase!!)
+ val decryptedKey = PgpKey.decryptKey(nodeKeyDetails.privateKey!!, oldPassphrase!!)
 
  if (TextUtils.isEmpty(decryptedKey)) {
  throw IllegalStateException("Can't decrypt key with longid " + longId!!)
  }
 
- val (encryptedKey) = NodeCallsExecutor.encryptKey(decryptedKey!!, newPassphrase)
+ val encryptedKey = PgpKey.encryptKey(decryptedKey, newPassphrase)
 
  if (TextUtils.isEmpty(encryptedKey)) {
  throw IllegalStateException("Can't encrypt key with longid " + longId!!)
  }
 
- val modifiedKeyDetailsList = NodeCallsExecutor.parseKeys(encryptedKey!!)
+ val modifiedKeyDetailsList = PgpKey.parseKeysC(encryptedKey.toByteArray())
  if (CollectionUtils.isEmpty(modifiedKeyDetailsList) || modifiedKeyDetailsList.size != 1) {
  throw IllegalStateException("Parse keys error")
  }

FlowCrypt/src/main/java/com/flowcrypt/email/security/SecurityUtils.kt

@@ -1,6 +1,8 @@
 /*
  * © 2016-present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com
- * Contributors: DenBond7
+ * Contributors:
+ * DenBond7
+ * Ivan Pizhenko
  */
 
 package com.flowcrypt.email.security
@@ -12,6 +14,7 @@ import com.flowcrypt.email.R
 import com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor
 import com.flowcrypt.email.database.FlowCryptRoomDatabase
 import com.flowcrypt.email.database.entity.AccountEntity
+import com.flowcrypt.email.security.pgp.PgpKey
 import com.flowcrypt.email.util.exception.DifferentPassPhrasesException
 import com.flowcrypt.email.util.exception.NoKeyAvailableException
 import com.flowcrypt.email.util.exception.NoPrivateKeysAvailableException
@@ -93,12 +96,11 @@ class SecurityUtils {
  else -> throw IllegalArgumentException(context.getString(R.string.missing_pass_phrase_strength_evaluation))
  }
 
- val nodeKeyDetailsList = NodeCallsExecutor.parseKeys(private)
+ val nodeKeyDetailsList = PgpKey.parseKeysC(private.toByteArray())
  val keyDetails = nodeKeyDetailsList.first()
 
  val encryptedKey = if (keyDetails.isFullyDecrypted == true) {
- val encryptKeResult = NodeCallsExecutor.encryptKey(private, passPhrase)
- encryptKeResult.encryptedKey
+ PgpKey.encryptKey(private, passPhrase)
  } else {
  keyDetails.privateKey
  }

FlowCrypt/src/main/java/com/flowcrypt/email/security/pgp/PgpKey.kt

@@ -8,8 +8,8 @@ package com.flowcrypt.email.security.pgp
 import com.flowcrypt.email.api.retrofit.response.model.node.MsgBlock
 import com.flowcrypt.email.api.retrofit.response.model.node.NodeKeyDetails
 import com.flowcrypt.email.core.msg.MsgBlockParser
+import com.flowcrypt.email.extensions.pgp.armor
 import com.flowcrypt.email.extensions.pgp.toNodeKeyDetails
-import java.nio.charset.StandardCharsets
 import org.bouncycastle.bcpg.ArmoredInputStream
 import org.bouncycastle.openpgp.PGPKeyRing
 import org.bouncycastle.openpgp.PGPObjectFactory
@@ -21,29 +21,59 @@ import org.bouncycastle.openpgp.PGPSignature
 import org.bouncycastle.openpgp.jcajce.JcaPGPPublicKeyRingCollection
 import org.bouncycastle.openpgp.jcajce.JcaPGPSecretKeyRingCollection
 import org.bouncycastle.openpgp.operator.jcajce.JcaKeyFingerprintCalculator
+import org.pgpainless.PGPainless
+import org.pgpainless.util.Passphrase
+import java.nio.charset.StandardCharsets
 
 object PgpKey {
+ fun encryptKey(armored: String, passphrase: String): String {
+ return try {
+ val keys = parseAndNormalizeKeyRings(armored)
+ PGPainless.modifyKeyRing(keys[0] as PGPSecretKeyRing)
+ .changePassphraseFromOldPassphrase(null)
+ .withSecureDefaultSettings()
+ .toNewPassphrase(Passphrase.fromPassword(passphrase))
+ .done()
+ .armor()
+ } catch (e: Exception) {
+ ""
+ }
+ }
+
+ fun decryptKey(armored: String, passphrase: String): String {
+ return try {
+ val keys = parseAndNormalizeKeyRings(armored)
+ PGPainless.modifyKeyRing(keys[0] as PGPSecretKeyRing)
+ .changePassphraseFromOldPassphrase(Passphrase.fromPassword(passphrase))
+ .withSecureDefaultSettings()
+ .toNoPassphrase()
+ .done()
+ .armor()
+ } catch (ex: Exception) {
+ ""
+ }
+ }
 
  /**
  * Parses multiple keys, binary or armored.
  *
  * @return Pair.first indicates armored (true) or binary (false) format
  * Pair.second list of keys
  */
- fun parseKeys(source: ByteArray): Pair<Boolean, List<NodeKeyDetails>> {
+ fun parseKeys(source: ByteArray): Pair<Boolean, List<PGPKeyRing>> {
  val blockType = PgpMsg.detectBlockType(source)
  if (blockType.second == MsgBlock.Type.UNKNOWN) {
  throw IllegalArgumentException("Unknown message type")
  }
 
- val allKeys = mutableListOf<NodeKeyDetails>()
+ val allKeys = mutableListOf<PGPKeyRing>()
  if (blockType.first) {
  // armored text format
  val blocks = MsgBlockParser.detectBlocks(String(source, StandardCharsets.UTF_8))
  for (block in blocks) {
  val content = block.content
  if (content != null) {
- val keys = parse(content)
+ val keys = parseAndNormalizeKeyRings(content)
  allKeys.addAll(keys)
  }
  }
@@ -53,24 +83,33 @@ object PgpKey {
  while (true) {
  val obj = objectFactory.nextObject() ?: break
  if (obj is PGPKeyRing) {
- allKeys.add(obj.toNodeKeyDetails())
+ allKeys.add(obj)
  }
  }
  }
 
  return Pair(blockType.first, allKeys)
  }
 
- fun parse(armored: String): List<NodeKeyDetails>
- = parseAndNormalizeKeyRings(armored).map { it.toNodeKeyDetails() }.toList()
+ /**
+ * Parse a list of [NodeKeyDetails] from the given string. It can take one key or many keys, it can be
+ * private or public keys, it can be armored or binary... doesn't matter.
+ *
+ * This method should be dropped in the future. Currently it should be used just for compatibility.
+ *
+ * @return list of keys
+ */
+ fun parseKeysC(source: ByteArray): List<NodeKeyDetails> {
+ return parseKeys(source).second.map { it.toNodeKeyDetails() }
+ }
 
  private fun parseAndNormalizeKeyRings(armored: String): List<PGPKeyRing> {
  val normalizedArmored = PgpArmor.normalize(armored, MsgBlock.Type.UNKNOWN)
  val keys = mutableListOf<PGPKeyRing>()
  if (PgpArmor.ARMOR_HEADER_DICT_REGEX[MsgBlock.Type.PUBLIC_KEY]!!
  .beginRegexp.containsMatchIn(normalizedArmored)) {
  val keyRingCollection = JcaPGPPublicKeyRingCollection(
- ArmoredInputStream(normalizedArmored.toByteArray(StandardCharsets.UTF_8).inputStream())
+ArmoredInputStream(normalizedArmored.toByteArray(StandardCharsets.UTF_8).inputStream())
  )
  // We have to use reflection because BouncyCastle declares "order" list as a private field
  // https://stackoverflow.com/a/1196207/1540501

FlowCrypt/src/main/java/com/flowcrypt/email/service/CheckClipboardToFindKeyService.kt

@@ -1,6 +1,8 @@
 /*
  * © 2016-present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com
- * Contributors: DenBond7
+ * Contributors:
+ * DenBond7
+ * Ivan Pizhenko
  */
 
 package com.flowcrypt.email.service
@@ -18,9 +20,9 @@ import android.os.Message
 import android.os.Messenger
 import android.os.RemoteException
 import android.text.TextUtils
-import com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor
 import com.flowcrypt.email.model.KeyDetails
 import com.flowcrypt.email.model.KeyImportModel
+import com.flowcrypt.email.security.pgp.PgpKey
 import com.flowcrypt.email.util.LogsUtil
 import com.flowcrypt.email.util.exception.ExceptionUtil
 import com.google.android.gms.common.util.CollectionUtils
@@ -111,7 +113,7 @@ class CheckClipboardToFindKeyService : Service(), ClipboardManager.OnPrimaryClip
  * The incoming handler realization. This handler will be used to communicate with current
  * service and the worker thread.
  */
- private class ReplyHandler internal constructor(checkClipboardToFindKeyService: CheckClipboardToFindKeyService)
+ private class ReplyHandler(checkClipboardToFindKeyService: CheckClipboardToFindKeyService)
  : Handler() {
  private val weakRef: WeakReference<CheckClipboardToFindKeyService> = WeakReference(checkClipboardToFindKeyService)
 
@@ -138,14 +140,14 @@ class CheckClipboardToFindKeyService : Service(), ClipboardManager.OnPrimaryClip
  * This handler will be used by the instance of [HandlerThread] to receive message from
  * the UI thread.
  */
- private class ServiceWorkerHandler internal constructor(looper: Looper) : Handler(looper) {
+ private class ServiceWorkerHandler(looper: Looper) : Handler(looper) {
 
  override fun handleMessage(msg: Message) {
  when (msg.what) {
  MESSAGE_WHAT -> {
  val clipboardText = msg.obj as String
  try {
- val nodeKeyDetails = NodeCallsExecutor.parseKeys(clipboardText)
+ val nodeKeyDetails = PgpKey.parseKeysC(clipboardText.toByteArray())
  if (!CollectionUtils.isEmpty(nodeKeyDetails)) {
  sendReply(msg)
  }