GPG, GnuPG, OpenPGP

The purpose of this page is to help you get started with PGP concepts. PGP, Pretty Good Privacy, is a set of tools to encrypt and decrypt data using public and private keys.

The easiest way to learn and play with these concepts is using this tutorial. Here you use GPG, an implementation of the OpenPGP standard, from the Linux command line.

In the last 5 years, we have used external web services that required the use of encrypting sensitive data. Most of these companies/services required the use of OpenPGP compliant tools. Here are the tools we have used:

• DidiSoft OpenPGP Library for Java - pgplib-3.2. 1.jar (paid)

Install on debian:

• sudo apt update
• sudo apt install gpg #most likely already installed

References:

• /credential-and-authentication-primer/ - using gpg for password protection

Example using Simple CLI

Generate a key. Note that if you get a permissions error using the below gen-key command, you can run this command in a tmux session to resolve the issue.

gpg --gen-key

List your keys:

gpg --list-keys

Share your public key:

gpg --output public.pgp --armor --export username@email

Copy and paste your key details to a password safe like keepass if applicable:

gpg --output public.pgp --armor --export username@email
gpg --output private.pgp --armor --export-secret-key username@email

Encrypt a file for more than one recipient (it is a good practice to include yourself):

gpg --encrypt --sign --armor -r name1@email1.com -r name2@email2.com somefile.txt

Decrypt the file. Note that if you get a permissions error using the below gen-key command, you can run this command in a tmux session to resolve the issue.

gpg --decrypt somefile.txt.asc > somefile.txt

In case there are issues, use the following bullets to help debug this situation:

• Compare the following results with the person who sent you the file
  • sha256sum somefile.txt.asc

Example using Credit Card Details

Below is an example were we allowed an external phone system to send customer payment information to iDempiere for payment processing using the iDempiere implementation's credit card integration.

Notice that the bolded RequestJson column contains json formatted credit card details. It is not acceptable for others to see this data, and it is not acceptable that this data remain in iDempiere's logs in plain text.

The solution is to replace this data:

• "val": "{\"SearchKey\":\"bp1052394\", \"CreditCardNumber\":\"4..... .....:1}"

With this data (the encrypted version of the json message):

• "val": "{lkajsflkejrwerwerwejrw897+897rwlker+werjwelrj78*rwe}"

Example showing unencrypted data:

 > Body Params :
 > 
 > {
 >     "ModelRunProcessRequest":{
 >       "ModelRunProcess":{
 >          "serviceType":"PhonePayment",
 >          "ParamValues":{
 >             "field":[
 >                {
 >                   "@column":"RequestJson",
 >                   "val":
 >                      "{\"SearchKey\":\"bp1052394\",
\"CreditCardNumber\":\"4788250
000121443\",\"CCV\":\"6125\",\
"DateExpire\":\"1025\",\"Zip\"
:369845,\"Amount\":1}"
 >                }
 >             ]
 >          }
 >       },
 >         "ADLoginRequest": {
 >             "user": "SuperUser",
 >             "pass": "password",
 >             "lang": "en_US",
 >             "ClientID": "1000000",
 >             "RoleID": "1000000",
 >         }
 >     }
 > }