generate keys using PGPainless

[tomholub]

part of #1051

PGPainless can be used directly to generate ECC / RSA2048 / RSA 3072 / RSA 4096 keys.

        PGPSecretKeyRing secretKeys = PGPainless.generateKeyRing()
                .withPrimaryKey(KeySpec.getBuilder(KeyType.RSA(RsaLength._3072))
                        .withKeyFlags(KeyFlag.CERTIFY_OTHER, KeyFlag.SIGN_DATA, KeyFlag.ENCRYPT_COMMS)
                        .withDefaultAlgorithms())
                .withPrimaryUserId("primary@user.id")
                .setExpirationDate(expiration)
                .withoutPassphrase()
                .build();

You can also add more user ids this way, or pass phrase. Can completely drop dependency on Node for keygen.

I imagine right now we generate first and create a pass phrase later? If so, we could instead ask for pass phrase first, then generate.

[tomholub]

Correction - it's better to use the simplified API:

        PGPKeyRing keyRing = PGPainless.generateKeyRing()
                .simpleRsaKeyRing("Juliet <juliet@montague.lit>", RsaLength._4096);

[tomholub]

There should be ECC keyring option there too that's as simple as this.

[DenBond7]

@tomholub Please look at this. Need to port getting keywords from Node to complete this issue

flowcrypt-android/FlowCrypt/src/main/java/com/flowcrypt/email/extensions/PGPKeyRingExt.kt

Line 48 in 0558575

keywords = ""//fix me

[DenBond7]

@tomholub

When I use the following code to generate a key (use ed25519)

PGPainless.generateKeyRing().simpleEcKeyRing(
            UserId.nameAndEmail(accountEntity.displayName
                ?: accountEntity.email, accountEntity.email), passphrase)

I receive the following error when I create an encrypted message :

{
   "error":{
      "message":"Error: Error encrypting message: Could not find valid key packet for encryption in key 2e5aaad3795c3bec",
      "stack":"Error: Error encrypting message: Could not find valid key packet for encryption in key 2e5aaad3795c3bec\n    at [eval]:66772:15"
   }
}

[tomholub]

You can drop all keywords usage across the whole app. We just use fingerprints now.

[tomholub]

Try this for key gen

  // NOTE: must remain in this case exactly
  enum class PgpKeyType { rsa2048, rsa3072, rsa4096, curve25519, p256 }

  @Suppress("unused")
  fun generateKey(users: Array<String>, type: PgpKeyType, expiration: Instant?): Pair {
    if (users.isEmpty()) {
      throw IllegalArgumentException("Expecting at least one User ID.")
    }

    @Suppress("deprecation")
    val encryptionKeyType = when (type) {
      PgpKeyType.rsa2048 -> RSA.withLength(RsaLength._2048)
      PgpKeyType.rsa3072 -> RSA.withLength(RsaLength._3072)
      PgpKeyType.rsa4096 -> RSA.withLength(RsaLength._4096)
      PgpKeyType.curve25519 -> KeyType.XDH(XDHCurve._X25519)
      PgpKeyType.p256 -> KeyType.ECDH(EllipticCurve._P256)
    }

    @Suppress("deprecation")
    val signingKeyType = when (type) {
      PgpKeyType.rsa2048 -> RSA.withLength(RsaLength._2048)
      PgpKeyType.rsa3072 -> RSA.withLength(RsaLength._3072)
      PgpKeyType.rsa4096 -> RSA.withLength(RsaLength._4096)
      PgpKeyType.curve25519 -> KeyType.EDDSA(EdDSACurve._Ed25519)
      PgpKeyType.p256 -> KeyType.ECDSA(EllipticCurve._P256)
    }

    val generate = PGPainless.generateKeyRing()
      .withSubKey(
        KeySpec.getBuilder(encryptionKeyType)
          .withKeyFlags(KeyFlag.ENCRYPT_COMMS, KeyFlag.ENCRYPT_STORAGE)
          .withDefaultAlgorithms()
      )
      .withPrimaryKey(
        KeySpec.getBuilder(signingKeyType)
          .withKeyFlags(KeyFlag.SIGN_DATA, KeyFlag.CERTIFY_OTHER)
          .withDefaultAlgorithms()
      )
      .withPrimaryUserId(users.first())

    for (user in users.drop(1)) {
      generate.withAdditionalUserId(user)
    }

    var prvKeyRing = generate.withoutPassphrase().build()
    if (expiration != null) {
      // pgp sig times are coarse per 1 second
      // need to wait another second to ensure the added signature is "newer"
      // else some pgp clients may ignore the added sig
      Thread.sleep(1_000)
      val expiring = updateKeyExpiration(armor(prvKeyRing), expiration)
      prvKeyRing = PGPainless.readKeyRing().secretKeyRing(expiring.prv.armored)
    }
    val pubKeyRing = KeyRingUtils.publicKeyRingFrom(prvKeyRing)
    return parseKeyPair(
      armoredPub = armor(pubKeyRing),
      armoredPrv = armor(prvKeyRing),
      expectedId = null
    )
  }