We have released OpenPGP Library for Java version 3.2.6.1 which is now based on BouncyCastle 1.84 This transition resolves the following vulnerabilities: – https://github.com/advisories/GHSA-574f-3g2m-x479 – https://github.com/advisories/GHSA-p93r-85wp-75v3 – https://github.com/advisories/GHSA-cj8j-37rh-8475 The next release 3.5.6.2 will support side-by-side direct usage of GnuPG private keys from an in-memory keystore. PS * Special thanks to Andreas Pillath for the feedback.
OpenPGP Library for Java News
Articles related to DidiSoft OpenPGP Library for Java
OpenPGP updates, LibrePGP and RFC 9580
The OpenPGP standard format for encrypted data is now on a crossroad. The previous attempt for an updated specification (RFC4880 bis), that aimed to reflect the newly invented cryptography algorithms (e.g. Elliptic Curves) and to deprecate those which are no longer treated as safe, has been implemented halfway between the open source implementations (leaded by […]
OpenPGP Library for Java 3.2.4 offers support for AEAD
We at DidiSoft are excited to announce the release of OpenPGP Library for Java 3.2.4, which now supports authenticated encryption with associated data (AEAD) for OpenPGP. With this latest update, users can now enjoy the added security and integrity of AEAD in their OpenPGP communications. AEAD is a mode of operation that provides both confidentiality […]
OpenPGP for Java v3.2.2 supports EdDsa/Curve25519
DidiSoft OpenPGP Library for Java version 3.2.2 has been released today with full support for EdDsa based on Curve-25519 and Elliptic Curve Diffie-Helman (ECDH) based on Curve 25519. What is Curve-25519? Curve 25519 is an Elliptic curve designed to be both high security and with high-speed operations. The previous Elliptic Curves used in OpenPGP were suggested by […]
Custom storage for the KeyStore class
As of version 3.2.1 DidiSoft OpenPGP Library for Java offers a custom storage mechanism for its KeyStore class. Up till now, the KeyStore class was limited to in-memory and file-based storage. If an application design required the keys to be stored on a different kind of media, for example in a database BLOB field, the […]
OpenPGP Library for Java 3.1.3.9 can import GnuPG kbx files
We are happy to announce version 3.1.3.9 of DidiSoft OpenPGP Library for Java. In this new updated version a new method has been added for importing public keys from GnuPG keybox (.kbx) key storage format. Below is a short example that demonstrates the usage of the new method: 1 2 3 4 5 6 7 […]
OpenPGP Library for Java v3.1.3.6 with a critical bugfix
Today has been released version 3.1.3.6 of DidiSoft OpenPGP Library for Java which provides a critical bug fix. The bug prevents decrypting .pgp data that was encrypted and compressed with the BZip-2 algorithm. The error message thrown in such cases is: “com.didisoft.pgp.PGPException: I/O problem with stream: java.io.IOException: Not a BZIP2 marked stream : Not a BZIP2 marked stream […]
GnuPG 2.2.8 compatibility with Java
Recent changes in GnuPG version 2.2.8 in response to the EFAIL attack reject all encrypted data that don’t have Modification Detection Code (MDC) packet. In order to address this as of version 3.1.3.2 DidiSoft OpenPGP Library for Java exposes a new property in the PGPLib class: PGPLib.isIntegrityProtectArchives() PGPLib.setIntegrityProtectArchives(boolean)PGPLib.isIntegrityProtectArchives() PGPLib.setIntegrityProtectArchives(boolean) Example usage: PGPLib pgp = new […]
Brainpool ECC curves support for Java
As of version 3.1.3.1 of DidiSoft OpenPGP Library for Java Elliptic Curve (ECC) OpenPGP keys can be created over the field of Brainpool curves. Usage of keys based on the Brainpool curves was possible by older versions of the library, but it couldn’t create keys based on them. These Elliptic Curves are not yet a […]
Heap Inspection fix in OpenPGP Library for Java
A memory dump of the Java Virtual Machine can reveal passwords stored in class members in clear text (String variables, char arrays, etc.) and until recently DidiSoft OpenPGP Library for Java was impacted by this security threat. Thanks to a hint from an Intel team we have made steps in order to fix those issues. […]
