import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
/**
 * Return a copy of the passed in secret key ring, with the private keys (where present) associated with the master key and sub keys
 * are encrypted using a new password and the passed in algorithm.
 *
 * @param ring the PGPSecretKeyRing to be copied.
 * @param oldKeyDecryptor the current decryptor based on the current password for key.
 * @param newKeyEncryptor a new encryptor based on a new password for encrypting the secret key material.
 * @return the updated key ring.
 */
public static PGPSecretKeyRing copyWithNewPassword(
    PGPSecretKeyRing       ring,
    PBESecretKeyDecryptor  oldKeyDecryptor,
    PBESecretKeyEncryptor  newKeyEncryptor)
    throws PGPException
{
    List newKeys = new ArrayList(ring.keys.size());

    for (Iterator keys = ring.getSecretKeys(); keys.hasNext();)
    {
        PGPSecretKey key = (PGPSecretKey)keys.next();

        if (key.isPrivateKeyEmpty())
        {
            newKeys.add(key);
        }
        else
        {
            newKeys.add(PGPSecretKey.copyWithNewPassword(key, oldKeyDecryptor, newKeyEncryptor));
        }
    }

    return new PGPSecretKeyRing(newKeys, ring.extraPubKeys);
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
/**
 * Create a new key ring generator.
 *
 * @param certificationLevel
 * @param masterKey
 * @param id
 * @param checksumCalculator
 * @param hashedPcks
 * @param unhashedPcks
 * @param keySignerBuilder
 * @param keyEncryptor
 * @throws PGPException
 */
public PGPKeyRingGenerator(
    int                            certificationLevel,
    PGPKeyPair                     masterKey,
    String                         id,
    PGPDigestCalculator checksumCalculator,
    PGPSignatureSubpacketVector    hashedPcks,
    PGPSignatureSubpacketVector    unhashedPcks,
    PGPContentSignerBuilder        keySignerBuilder,
    PBESecretKeyEncryptor          keyEncryptor)
    throws PGPException
{
    this.masterKey = masterKey;
    this.keyEncryptor = keyEncryptor;
    this.checksumCalculator = checksumCalculator;
    this.keySignerBuilder = keySignerBuilder;
    this.hashedPcks = hashedPcks;
    this.unhashedPcks = unhashedPcks;

    keys.add(new PGPSecretKey(certificationLevel, masterKey, id, checksumCalculator, hashedPcks, unhashedPcks, keySignerBuilder, keyEncryptor));
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
/**
 * @deprecated use method taking PGPKeyPair
 */
public PGPSecretKey(
    int                         certificationLevel,
    int                         algorithm,
    PublicKey                   pubKey,
    PrivateKey                  privKey,
    Date                        time,
    String                      id,
    PGPDigestCalculator         checksumCalculator,
    PGPSignatureSubpacketVector hashedPcks,
    PGPSignatureSubpacketVector unhashedPcks,
    PGPContentSignerBuilder     certificationSignerBuilder,
    PBESecretKeyEncryptor       keyEncryptor)
    throws PGPException
{
    this(certificationLevel, new PGPKeyPair(algorithm, pubKey, privKey, time), id, checksumCalculator, hashedPcks, unhashedPcks, certificationSignerBuilder, keyEncryptor);
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
public static PGPSecretKeyRing copySecretKeyRingWithNewPassword(byte[] privateKeyData,
        char[] oldPassphrase, char[] newPassphrase) throws PGPException, IOException, KonException {

    // load the secret key ring
    PGPSecretKeyRing secRing = new PGPSecretKeyRing(privateKeyData, FP_CALC);

    PGPDigestCalculatorProvider calcProv = new JcaPGPDigestCalculatorProviderBuilder().build();
    PBESecretKeyDecryptor decryptor = new JcePBESecretKeyDecryptorBuilder(calcProv)
        .setProvider(PGPUtils.PROVIDER)
        .build(oldPassphrase);

    PGPDigestCalculator calc = new JcaPGPDigestCalculatorProviderBuilder().build().get(HashAlgorithmTags.SHA256);
    PBESecretKeyEncryptor encryptor = new JcePBESecretKeyEncryptorBuilder(PGPEncryptedData.AES_256, calc)
        .setProvider(PROVIDER).build(newPassphrase);

    try {
        return PGPSecretKeyRing.copyWithNewPassword(secRing, decryptor, encryptor);
    } catch (PGPException ex) {
        // treat this special, cause most like the decryption password was wrong
        throw new KonException(KonException.Error.CHANGE_PASS_COPY, ex);
    }
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
PGPSecretKey(
    PGPPrivateKey   privKey,
    PGPPublicKey    pubKey,
    PGPDigestCalculator checksumCalculator,
    PBESecretKeyEncryptor keyEncryptor)
    throws PGPException
{
    this(privKey, pubKey, checksumCalculator, false, keyEncryptor);
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
public SecretKey generateKeyPair(final String id, final char[] pass) throws CryptoException {
  try {

    // This object generates individual key-pairs.
    final RSAKeyPairGenerator kpg = new RSAKeyPairGenerator();
    kpg.init(new RSAKeyGenerationParameters(BigInteger.valueOf(0x10001), new SecureRandom(), 2048, 12));

    // First create the master (signing) key with the generator.
    final PGPKeyPair keyPair = new BcPGPKeyPair(PGPPublicKey.RSA_GENERAL, kpg.generateKeyPair(), new Date());

    // Add a self-signature on the id
    final PGPSignatureSubpacketGenerator signhashgen = new PGPSignatureSubpacketGenerator();
    signhashgen.setKeyFlags(true, KeyFlags.CERTIFY_OTHER | KeyFlags.SIGN_DATA | KeyFlags.ENCRYPT_COMMS | KeyFlags.ENCRYPT_STORAGE);
    signhashgen.setPreferredCompressionAlgorithms(false, new int[] { CompressionAlgorithmTags.ZIP });
    signhashgen.setPreferredHashAlgorithms(false, new int[] { HashAlgorithmTags.SHA1 });
    signhashgen.setPreferredSymmetricAlgorithms(false, new int[] { SymmetricKeyAlgorithmTags.AES_256 });
    signhashgen.setFeature(false, Features.FEATURE_MODIFICATION_DETECTION);

    // Create a signature on the encryption subkey.
    final PGPSignatureSubpacketGenerator enchashgen = new PGPSignatureSubpacketGenerator();
    enchashgen.setKeyFlags(false, KeyFlags.ENCRYPT_COMMS | KeyFlags.ENCRYPT_STORAGE);

    // Objects used to encrypt the secret key.

    // Finally, create the keyring itself. The constructor
    // takes parameters that allow it to generate the self
    // signature.
    final PGPDigestCalculator sha1Calc = new BcPGPDigestCalculatorProvider().get(HashAlgorithmTags.SHA1);
    final PBESecretKeyEncryptor secretKeyEncryptor = new BcPBESecretKeyEncryptorBuilder(PGPEncryptedData.AES_128, sha1Calc).build(pass);
    final BcPGPContentSignerBuilder contentSigner = new BcPGPContentSignerBuilder(keyPair.getPublicKey().getAlgorithm(), HashAlgorithmTags.SHA1);
    final PGPKeyRingGenerator keyRingGen = new PGPKeyRingGenerator(PGPSignature.POSITIVE_CERTIFICATION, keyPair, id, sha1Calc,
        signhashgen.generate(), null, contentSigner, secretKeyEncryptor);

    // return new SimpleKeyPair(new BcPGPPublicKey(publicKeyRing.getPublicKey()),
    return new BcPGPSecretKey(keyRingGen.generateSecretKeyRing().getSecretKey());
  }
  catch (final Exception e) {
    throw new CryptoException(e);
  }
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
/**
 * Re-encrypts the key set with a new passphrase and returns it in locked
 * form.
 *
 * @param oldPassphrase the old passphrase
 * @param newPassphrase the new passphrase
 * @return {@code this}, re-encrypted with {@code newPassphrase}
 * @throws CryptographicException if {@code oldPassphrase} is incorrect
 */
public KeySet relock(char[] oldPassphrase, char[] newPassphrase, SecureRandom random) throws CryptographicException {
    try {
        final PBESecretKeyDecryptor decryptor =
                new JcePBESecretKeyDecryptorBuilder()
                        .build(oldPassphrase);
        final PBESecretKeyEncryptor encryptor =
                new JcePBESecretKeyEncryptorBuilder(SymmetricAlgorithm.DEFAULT.value())
                        .setSecureRandom(random)
                        .build(newPassphrase);
        final PGPSecretKey masterSecretKey = PGPSecretKey.copyWithNewPassword(
                getUnlockedMasterKey().getSecretKey(),
                decryptor,
                encryptor
        );
        final PGPSecretKey subSecretKey = PGPSecretKey.copyWithNewPassword(
                getUnlockedSubKey().getSecretKey(),
                decryptor,
                encryptor
        );

        final MasterKey newMasterKey = new MasterKey(masterSecretKey);
        final SubKey newSubKey = new SubKey(subSecretKey, newMasterKey);

        return new KeySet(newMasterKey, newSubKey);
    } catch (PGPException e) {
        throw new CryptographicException(e);
    }
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
public final static PGPKeyRingGenerator generateKeyRingGenerator(String id, char[] pass, int s2kcount,
		KeyGenPane.BackgroundTask bgt) throws Exception
{
	// This object generates individual key-pairs.
	RSAKeyPairGenerator kpg = new RSAKeyPairGenerator();

	// Boilerplate RSA parameters, no need to change anything
	// except for the RSA key-size (2048). You can use whatever key-size
	// makes sense for you -- 4096, etc.
	kpg.init(new RSAKeyGenerationParameters(BigInteger.valueOf(0x10001), new SecureRandom(), 2048, 12));
	bgt.setProgressPub(10);
	// First create the master (signing) key with the generator.
	PGPKeyPair rsakp_sign = new BcPGPKeyPair(PGPPublicKey.RSA_SIGN, kpg.generateKeyPair(), new Date());
	// Then an encryption subkey.
	PGPKeyPair rsakp_enc = new BcPGPKeyPair(PGPPublicKey.RSA_ENCRYPT, kpg.generateKeyPair(), new Date());
	bgt.setProgressPub(50);
	// Add a self-signature on the id
	PGPSignatureSubpacketGenerator signhashgen = new PGPSignatureSubpacketGenerator();
	bgt.setProgressPub(55);
	// Add signed metadata on the signature.
	// 1) Declare its purpose
	signhashgen.setKeyFlags(false, KeyFlags.SIGN_DATA | KeyFlags.CERTIFY_OTHER);
	bgt.setProgressPub(60);
	// 2) Set preferences for secondary crypto algorithms to use when
	// sending messages to this key.
	signhashgen.setPreferredSymmetricAlgorithms(false, new int[] { SymmetricKeyAlgorithmTags.AES_256,
			SymmetricKeyAlgorithmTags.AES_192, SymmetricKeyAlgorithmTags.AES_128 });
	signhashgen.setPreferredHashAlgorithms(false, new int[] { HashAlgorithmTags.SHA256, HashAlgorithmTags.SHA1,
			HashAlgorithmTags.SHA384, HashAlgorithmTags.SHA512, HashAlgorithmTags.SHA224, });
	// 3) Request senders add additional checksums to the message (useful
	// when verifying unsigned messages.)
	signhashgen.setFeature(false, Features.FEATURE_MODIFICATION_DETECTION);

	// Create a signature on the encryption subkey.
	PGPSignatureSubpacketGenerator enchashgen = new PGPSignatureSubpacketGenerator();
	// Add metadata to declare its purpose
	enchashgen.setKeyFlags(false, KeyFlags.ENCRYPT_COMMS | KeyFlags.ENCRYPT_STORAGE);

	// Objects used to encrypt the secret key.
	PGPDigestCalculator sha1Calc = new BcPGPDigestCalculatorProvider().get(HashAlgorithmTags.SHA1);
	PGPDigestCalculator sha256Calc = new BcPGPDigestCalculatorProvider().get(HashAlgorithmTags.SHA256);
	bgt.setProgressPub(70);
	// bcpg 1.48 exposes this API that includes s2kcount. Earlier versions
	// use a default of 0x60.
	PBESecretKeyEncryptor pske = (new BcPBESecretKeyEncryptorBuilder(PGPEncryptedData.AES_256, sha256Calc,
			s2kcount)).build(pass);

	// Finally, create the keyring itself. The constructor takes parameters
	// that allow it to generate the self signature.
	PGPKeyRingGenerator keyRingGen = new PGPKeyRingGenerator(PGPSignature.POSITIVE_CERTIFICATION, rsakp_sign, id,
			sha1Calc, signhashgen.generate(), null,
			new BcPGPContentSignerBuilder(rsakp_sign.getPublicKey().getAlgorithm(), HashAlgorithmTags.SHA1), pske);
	bgt.setProgressPub(80);
	// Add our encryption subkey, together with its signature.
	keyRingGen.addSubKey(rsakp_enc, enchashgen.generate(), null);
	bgt.setProgressPub(90);
	return keyRingGen;
}
 

import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor; //导入依赖的package包/类
static PGPKeyRingGenerator generateKeyRingGenerator(String userId, int numBits, char[] passphrase) throws Exception  {
  RSAKeyPairGenerator keyPairGenerator = new RSAKeyPairGenerator();

  keyPairGenerator.init(
    new RSAKeyGenerationParameters(
      BigInteger.valueOf(0x10001),
      new SecureRandom(),
      numBits,
      12
    )
  );

  PGPKeyPair rsaKeyPairSign = new BcPGPKeyPair(
    PGPPublicKey.RSA_SIGN,
    keyPairGenerator.generateKeyPair(),
    new Date()
  );

  PGPKeyPair rsaKeyPairEncrypt = new BcPGPKeyPair(
    PGPPublicKey.RSA_ENCRYPT,
    keyPairGenerator.generateKeyPair(),
    new Date()
  );

  PGPSignatureSubpacketGenerator signHashGenerator = new PGPSignatureSubpacketGenerator();

  signHashGenerator.setKeyFlags(false, KeyFlags.SIGN_DATA | KeyFlags.CERTIFY_OTHER);

  signHashGenerator.setPreferredSymmetricAlgorithms(
    false,
    new int[] {
      SymmetricKeyAlgorithmTags.AES_256,
      SymmetricKeyAlgorithmTags.AES_192,
      SymmetricKeyAlgorithmTags.AES_128
    }
  );

  signHashGenerator.setPreferredHashAlgorithms(
    false,
    new int[] {
      HashAlgorithmTags.SHA512,
      HashAlgorithmTags.SHA384,
      HashAlgorithmTags.SHA256,
      HashAlgorithmTags.SHA1,    // Not recommended
      HashAlgorithmTags.SHA224,  // Not recommended
    }
  );

  signHashGenerator.setFeature(false, Features.FEATURE_MODIFICATION_DETECTION);

  PGPSignatureSubpacketGenerator encryptHashGenerator = new PGPSignatureSubpacketGenerator();

  encryptHashGenerator.setKeyFlags(false, KeyFlags.ENCRYPT_COMMS | KeyFlags.ENCRYPT_STORAGE);

  PGPDigestCalculator sha1DigestCalculator = new BcPGPDigestCalculatorProvider().get(HashAlgorithmTags.SHA1);
  PGPDigestCalculator sha512DigestCalculator = new BcPGPDigestCalculatorProvider().get(HashAlgorithmTags.SHA512);

  PBESecretKeyEncryptor secretKeyEncryptor = (
    new BcPBESecretKeyEncryptorBuilder(PGPEncryptedData.AES_256, sha512DigestCalculator)
  )
    .build(passphrase);

  PGPKeyRingGenerator keyRingGen = new PGPKeyRingGenerator(
    PGPSignature.NO_CERTIFICATION,
    rsaKeyPairSign,
    userId,
    sha1DigestCalculator,
    signHashGenerator.generate(),
    null,
    new BcPGPContentSignerBuilder(rsaKeyPairSign.getPublicKey().getAlgorithm(), HashAlgorithmTags.SHA512),
    secretKeyEncryptor
  );

  keyRingGen.addSubKey(rsaKeyPairEncrypt, encryptHashGenerator.generate(), null);

  return keyRingGen;
}