repository·master·Indexed 43 days ago
https://github.com/securityinnovation/pgpyA Python library for implementing Pretty Good Privacy (PGP) conforming to the OpenPGP specification per RFC 4880. It provides tools for managing PGPKey, PGPMessage, and PGPSignature objects, supporting asymmetric encryption (RSA, ECDH), symmetric encryption with passphrases, digital signatures, and ASCII-armored export.
PGPy has not been formally tested on Windows. While it is expected to work, users should report any issues via the GitHub issue tracker.
Users may experience limited functionality if a more capable version of OpenSSL is not installed. For guidance on setting up OpenSSL, refer to the cryptography library's documentation on building for macOS.
PGPy is working towards full compliance with OpenPGP standards. The current implementation focus is on RFC 4880 (the latest complete OpenPGP Message Format specification), which supersedes RFC 1991 and RFC 2440.
Key areas of compliance include:
Note that some features, such as KBX storage, HKP key server interaction, and certain ElGamal/Twofish operations, may not yet be implemented.
The following classes are part of pgpy.types. They are typically returned by library operations and are not intended to be instantiated directly by the user:
SignatureVerification: Result of a signature verification operation.Fingerprint: Represents a PGP key fingerprint.PGPy implements extensions for Elliptic Curve Cryptography as defined in RFC 6637. This includes support for:
To install the PGPy library, use the standard Python package manager pip.
Requirements:
cryptography, pyasn1, and six (will be installed automatically via pip).$ pip install PGPypgpy.PGPKey.from_blob(keyblob) to parse ASCII or binary data.pgpy.PGPKey.from_file('path/to/key.asc').empty_key.parse(keyblob) on an instantiated PGPKey object.If managing multiple keys, use pgpy.PGPKeyring. You can initialize it with a list of file paths or use the .load() method to load keys from a list of files. The .load() method returns a set of fingerprints for all keys and subkeys loaded during that operation.
import pgpy
import glob
import os
# Load from files into a keyring
kr = pgpy.PGPKeyring()
loaded_fingerprints = kr.load(glob.glob(os.path.expanduser('~/.gnupg/*ring.gpg')))
# Load a single key from a file
key, _ = pgpy.PGPKey.from_file('path/to/key.asc')
# Load a single key from a blob
key, _ = pgpy.PGPKey.from_blob(keyblob)Building PGPy on Linux requires a C compiler, Python headers, OpenSSL headers, and libffi to support the underlying cryptography library. Depending on your distribution, install the following:
Debian/Ubuntu
$ sudo apt install build-essential libssl-dev libffi-dev python-devNote: You may need python3-dev if using Python 3.
Alpine Linux
$ apk add build-base libressl-dev libffi-dev python-devFedora/RHEL derivatives
$ sudo yum install gcc libffi-devel python-devel openssl-develPGPy can be installed via package managers on certain Linux distributions:
apt to install python3-pgpy (available in Debian Testing).gentoo branch on GitHub.$ sudo apt install python3-pgpyTo protect a private key with a passphrase, use key.protect(passphrase, symmetric_algorithm, hash_algorithm). After this, key.is_protected will be True.
To use a protected key, use the key.unlock(passphrase) context manager. This is the recommended way to handle secret material as it automatically removes the unprotected key material from the object once the block is exited. If the passphrase is incorrect, it raises a PGPDecryptionError.
import pgpy
from pgpy.constants import SymmetricKeyAlgorithm, HashAlgorithm
# Protecting a key
key.protect("C0rrectPassphr@se", SymmetricKeyAlgorithm.AES256, HashAlgorithm.SHA256)
# Unlocking a key using a context manager
with key.unlock("C0rrectPassphr@se"):
# key.is_unlocked is True inside this block
# Perform cryptographic operations here
pass
# key.is_unlocked is False once the block exitsOnce the system prerequisites are met, you can install PGPy from PyPI using pip.
$ pip install PGPyIf a key was created without the correct usage flags (e.g., EncryptStorage, EncryptCommunications), PGPy will raise a PGPError when attempting to use it for encryption.
If you are certain you need to bypass this check, set the private attribute _require_usage_flags to False on the PGPKey instance before performing the operation.
from pgpy import PGPKey, PGPMessage
key, _ = PGPKey.from_file('path/to/key_without_usage_flags.asc')
# Disable the check
key._require_usage_flags = False
message = PGPMessage.new('secret message')
encrypted_phrase = key.encrypt(message)Messages can be exported in OpenPGP compliant formats.
In Python 3, use bytes() for binary output and str() for ASCII-armored output. If the message is a cleartext message, the ASCII-armored output will properly canonicalize and dash-escape the message text.
# Python 3 usage
# Export to binary format
msgbytes = bytes(message)
# Export to ASCII-armored format
msgstr = str(message)