Package org.pgpainless.policy
Class Policy
java.lang.Object
org.pgpainless.policy.Policy
Policy class used to configure acceptable algorithm suites etc.
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionstatic final class
static final class
static final class
static enum
static final class
-
Method Summary
Modifier and TypeMethodDescriptionstatic Policy
Return the singleton instance of PGPainless' policy.Return the currentAlgorithmSuite
which defines preferred algorithms used during key generation.Return theNotationRegistry
of PGPainless.Return the current public key algorithm policy.Return the hash algorithm policy for revocations.Return the hash algorithm policy for signatures.Return the level of validation PGPainless shall do onSignerUserID
subpackets.Return the symmetric encryption algorithm policy for decryption.Return the symmetric encryption algorithm policy for encryption.boolean
Return true, if countermeasures against the KOpenPGP attacks are enabled, false otherwise.void
setEnableKeyParameterValidation
(boolean enable) Enable or disable validation of public key parameters when unlocking private keys.void
setKeyGenerationAlgorithmSuite
(AlgorithmSuite algorithmSuite) Set a customAlgorithmSuite
which defines preferred algorithms used during key generation.void
setPublicKeyAlgorithmPolicy
(Policy.PublicKeyAlgorithmPolicy publicKeyAlgorithmPolicy) Set a custom public key algorithm policy.void
Set a custom hash algorithm policy for revocations.void
Set a custom hash algorithm policy for signatures.setSignerUserIdValidationLevel
(Policy.SignerUserIdValidationLevel signerUserIdValidationLevel) Specify, howSignerUserID
subpackets on signatures shall be validated.void
Set a custom symmetric encryption algorithm policy for decrypting messages.void
Set a custom symmetric encryption algorithm policy for encrypting messages.
-
Method Details
-
getInstance
Return the singleton instance of PGPainless' policy.- Returns:
- singleton instance
-
getSignatureHashAlgorithmPolicy
Return the hash algorithm policy for signatures.- Returns:
- hash algorithm policy
-
setSignatureHashAlgorithmPolicy
Set a custom hash algorithm policy for signatures.- Parameters:
policy
- custom policy
-
getRevocationSignatureHashAlgorithmPolicy
Return the hash algorithm policy for revocations. This policy is separate fromgetSignatureHashAlgorithmPolicy()
, as PGPainless by default uses a less strict policy when it comes to acceptable algorithms.- Returns:
- revocation signature hash algorithm policy
-
setRevocationSignatureHashAlgorithmPolicy
Set a custom hash algorithm policy for revocations.- Parameters:
policy
- custom policy
-
getSymmetricKeyEncryptionAlgorithmPolicy
Return the symmetric encryption algorithm policy for encryption. This policy defines which symmetric algorithms are acceptable when producing encrypted messages.- Returns:
- symmetric algorithm policy for encryption
-
getSymmetricKeyDecryptionAlgorithmPolicy
Return the symmetric encryption algorithm policy for decryption. This policy defines which symmetric algorithms are acceptable when decrypting encrypted messages.- Returns:
- symmetric algorithm policy for decryption
-
setSymmetricKeyEncryptionAlgorithmPolicy
Set a custom symmetric encryption algorithm policy for encrypting messages.- Parameters:
policy
- custom policy
-
setSymmetricKeyDecryptionAlgorithmPolicy
Set a custom symmetric encryption algorithm policy for decrypting messages.- Parameters:
policy
- custom policy
-
getCompressionAlgorithmPolicy
-
setCompressionAlgorithmPolicy
-
getPublicKeyAlgorithmPolicy
Return the current public key algorithm policy.- Returns:
- public key algorithm policy
-
setPublicKeyAlgorithmPolicy
Set a custom public key algorithm policy.- Parameters:
publicKeyAlgorithmPolicy
- custom policy
-
getNotationRegistry
Return theNotationRegistry
of PGPainless. The notation registry is used to decide, whether a Notation is known or not. Background: Critical unknown notations render signatures invalid.- Returns:
- Notation registry
-
getKeyGenerationAlgorithmSuite
Return the currentAlgorithmSuite
which defines preferred algorithms used during key generation.- Returns:
- current algorithm suite
-
setKeyGenerationAlgorithmSuite
Set a customAlgorithmSuite
which defines preferred algorithms used during key generation.- Parameters:
algorithmSuite
- custom algorithm suite
-
getSignerUserIdValidationLevel
Return the level of validation PGPainless shall do onSignerUserID
subpackets. By default, this value isPolicy.SignerUserIdValidationLevel.DISABLED
.- Returns:
- the level of validation
-
setSignerUserIdValidationLevel
public Policy setSignerUserIdValidationLevel(Policy.SignerUserIdValidationLevel signerUserIdValidationLevel) Specify, howSignerUserID
subpackets on signatures shall be validated.- Parameters:
signerUserIdValidationLevel
- level of verification PGPainless shall do onSignerUserID
subpackets.- Returns:
- policy instance
-
setEnableKeyParameterValidation
Enable or disable validation of public key parameters when unlocking private keys. Disabled by default. When enabled, PGPainless will validate, whether public key parameters have been tampered with. This is a countermeasure against possible attacks described in the paper "Victory by KO: Attacking OpenPGP Using Key Overwriting" by Lara Bruseghini, Daniel Huigens, and Kenneth G. Paterson. Since these attacks are only possible in very special conditions (attacker has access to the encrypted private key), and the countermeasures are very costly, they are disabled by default, but can be enabled using this method.- Parameters:
enable
- boolean- Returns:
- this
- See Also:
-
isEnableKeyParameterValidation
public boolean isEnableKeyParameterValidation()Return true, if countermeasures against the KOpenPGP attacks are enabled, false otherwise.- Returns:
- true if countermeasures are enabled, false otherwise.
-