Verify OpenPGP signed data in Android

As of version 1.3 of DidiSoft OpenPGP Library for Android the methods for OpenPGP signatures verification has changed. The old version of this tutorial is available here.

This example shows how to verify a digitally signed OpenPGP archive from an Android application.

It assumes that the public key that will be used to verify the signature is located in the assets folder of the Android app.

The signed file is expected to be in the private context path of the application.

package android.demo;
 
import java.io.*;
import android.content.Context;
import android.content.res.AssetManager;
import android.os.Bundle;
import android.widget.TextView;
import com.didisoft.pgp.*;
 
public class SignStreamDemo extends Activity {
 @Override
 public void onCreate(Bundle savedInstanceState) {
   super.onCreate(savedInstanceState);
   TextView tv = new TextView(this);
 
   InputStream signedStream = null;
   InputStream keyStream = null;
   OutputStream decryptedStream = null;
 
   SignatureCheckResult signatureCheck = SignatureCheckResult.NoSignatureFound;
   try {
     // load data and public key stream
     signedStream = this.openFileInput("OUTPUT.pgp");
 
     AssetManager assets = getAssets();
     keyStream = assets.open("public_key.asc");
 
     // specify output stream
     decryptedStream = this.openFileOutput("OUTPUT.txt", MODE_PRIVATE);
 
     signatureCheck = pgp.verifyAndExtract(signedStream,
					keyStream,
					decryptedStream);
  } catch (Exception e) {
     tv.append(e.getMessage());
  } finally {
     // cleanup
     if (signedStream != null)
	signedStream.close();
     if (keyStream != null)
        keyStream.close();
     if (decryptedStream != null)
	decryptedStream.close();
  }
 
  tv.append("\n\n");
  if (signatureCheck == SignatureCheckResult.SignatureVerified) {
   tv.append("The signature is valid.");
  } else if (signatureCheck == SignatureCheckResult.SignatureBroken) {
   tv.append("Message corrupted or signature forged");
  } else if (signatureCheck == SignatureCheckResult.PublicKeyNotMatching) {
   tv.append("Signature not matching provided public key /it is from another sender/");
  } else {
   tv.append("No signature found in message");
  }
  setContentView(tv);
 }
}

You may also take a look at the OpenPGP signing example.

A complete working application with many other examples is available in the /Examples folder of the library distribution ZIP archive.