[Update 11 Feature] Add support for PGP encryption/decryption with streams

ballerina/Ballerina.toml

@@ -1,42 +1,42 @@
 [package]
 org = "ballerina"
 name = "crypto"
-version = "2.7.2"
+version = "2.8.0"
 authors = ["Ballerina"]
 keywords = ["security", "hash", "hmac", "sign", "encrypt", "decrypt", "private key", "public key"]
 repository = "https://github.com/ballerina-platform/module-ballerina-crypto"
 icon = "icon.png"
 license = ["Apache-2.0"]
 distribution = "2201.9.0"
 
-[platform.java17]
+[platform.java21]
 graalvmCompatible = true
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "io.ballerina.stdlib"
 artifactId = "crypto-native"
-version = "2.7.2"
-path = "../native/build/libs/crypto-native-2.7.2.jar"
+version = "2.8.0"
+path = "../native/build/libs/crypto-native-2.8.0-SNAPSHOT.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcpkix-jdk18on"
 version = "1.78"
 path = "./lib/bcpkix-jdk18on-1.78.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcprov-jdk18on"
 version = "1.78"
 path = "./lib/bcprov-jdk18on-1.78.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcutil-jdk18on"
 version = "1.78"
 path = "./lib/bcutil-jdk18on-1.78.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcpg-jdk18on"
 version = "1.78"

ballerina/Dependencies.toml

@@ -5,13 +5,14 @@
 
 [ballerina]
 dependencies-toml-version = "2"
-distribution-version = "2201.9.0"
+distribution-version = "2201.10.0-20240926-231800-8a5a4343"
 
 [[package]]
 org = "ballerina"
 name = "crypto"
-version = "2.7.2"
+version = "2.8.0"
 dependencies = [
+	{org = "ballerina", name = "io"},
 	{org = "ballerina", name = "jballerina.java"},
 	{org = "ballerina", name = "lang.array"},
 	{org = "ballerina", name = "test"},
@@ -21,6 +22,19 @@ modules = [
 	{org = "ballerina", packageName = "crypto", moduleName = "crypto"}
 ]
 
+[[package]]
+org = "ballerina"
+name = "io"
+version = "1.6.2"
+scope = "testOnly"
+dependencies = [
+	{org = "ballerina", name = "jballerina.java"},
+	{org = "ballerina", name = "lang.value"}
+]
+modules = [
+	{org = "ballerina", packageName = "io", moduleName = "io"}
+]
+
 [[package]]
 org = "ballerina"
 name = "jballerina.java"
@@ -67,6 +81,15 @@ name = "lang.object"
 version = "0.0.0"
 scope = "testOnly"
 
+[[package]]
+org = "ballerina"
+name = "lang.value"
+version = "0.0.0"
+scope = "testOnly"
+dependencies = [
+	{org = "ballerina", name = "jballerina.java"}
+]
+
 [[package]]
 org = "ballerina"
 name = "test"
@@ -84,7 +107,7 @@ modules = [
 [[package]]
 org = "ballerina"
 name = "time"
-version = "2.4.0"
+version = "2.5.1"
 dependencies = [
 	{org = "ballerina", name = "jballerina.java"}
 ]

ballerina/encrypt_decrypt.bal

@@ -111,7 +111,7 @@ public isolated function encryptAesCbc(byte[] input, byte[] key, byte[] iv, AesP
 # + padding - The padding algorithm
 # + return - Encrypted data or else a `crypto:Error` if the key is invalid
 public isolated function encryptAesEcb(byte[] input, byte[] key, AesPadding padding = PKCS5)
-                                       returns byte[]|Error = @java:Method {
+                                        returns byte[]|Error = @java:Method {
     name: "encryptAesEcb",
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Encrypt"
 } external;
@@ -189,7 +189,7 @@ public isolated function decryptRsaEcb(byte[] input, PrivateKey|PublicKey key, R
 # + padding - The padding algorithm
 # + return - Decrypted data or else a `crypto:Error` if the key is invalid
 public isolated function decryptAesCbc(byte[] input, byte[] key, byte[] iv, AesPadding padding = PKCS5)
-                                       returns byte[]|Error = @java:Method {
+                                        returns byte[]|Error = @java:Method {
     name: "decryptAesCbc",
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Decrypt"
 } external;
@@ -255,26 +255,56 @@ public isolated function decryptAesGcm(byte[] input, byte[] key, byte[] iv, AesP
 # + options - PGP encryption options
 # + return - Encrypted data or else a `crypto:Error` if the key is invalid
 public isolated function encryptPgp(byte[] plainText, string publicKeyPath, *Options options)
-                                       returns byte[]|Error = @java:Method {
+                                        returns byte[]|Error = @java:Method {
     name: "encryptPgp",
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Encrypt"
 } external;
 
+# Returns the PGP-encrypted stream of the content given in the input stream.
+# ```ballerina
+# stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream("input.txt");
+# stream<byte[], crypto:Error?>|crypto:Error encryptedStream = crypto:encryptStreamAsPgp(inputStream, "public_key.asc");
+# ```
+#
+# + inputStream - The content to be encrypted as a stream
+# + privateKeyPath - Path to the private key
+# + return - Encrypted stream or else a `crypto:Error` if the key is invalid
+public isolated function encryptStreamAsPgp(stream<byte[], error?> inputStream, string publicKeyPath,
+        *Options options) returns stream<byte[], Error?>|Error = @java:Method {
+    'class: "io.ballerina.stdlib.crypto.nativeimpl.Encrypt"
+} external;
+
 # Returns the PGP-decrypted value of the given PGP-encrypted data.
 # ```ballerina
 # byte[] message = "Hello Ballerina!".toBytes();
 # byte[] cipherText = check crypto:encryptPgp(message, "public_key.asc");
-# 
+#
 # byte[] passphrase = check io:fileReadBytes("pass_phrase.txt");
 # byte[] decryptedMessage = check crypto:decryptPgp(cipherText, "private_key.asc", passphrase);
 # ```
 #
 # + cipherText - The encrypted content to be decrypted
-# + privateKeyPath - Path to the private key
+# + privateKey -
 # + passphrase - passphrase of the private key
 # + return - Decrypted data or else a `crypto:Error` if the key or passphrase is invalid
 public isolated function decryptPgp(byte[] cipherText, string privateKeyPath, byte[] passphrase)
                                        returns byte[]|Error = @java:Method {
     name: "decryptPgp",
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Decrypt"
 } external;
+
+# Returns the PGP-decrypted stream of the content given in the input stream.
+# ```ballerina
+# byte[] passphrase = check io:fileReadBytes("pass_phrase.txt");
+# stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream("pgb_encrypted.txt");
+# stream<byte[], crypto:Error?>|crypto:Error decryptedStream = crypto:decryptStreamFromPgp(inputStream, "private_key.asc", passphrase);
+# ```
+#
+# + inputStream - The encrypted content as a stream
+# + privateKeyPath - Path to the private key
+# + passphrase - passphrase of the private key
+# + return - Decrypted stream or else a `crypto:Error` if the key or passphrase is invalid
+public isolated function decryptStreamFromPgp(stream<byte[], error?> inputStream, string privateKeyPath,
+        byte[] passphrase) returns stream<byte[], Error?>|Error = @java:Method {
+    'class: "io.ballerina.stdlib.crypto.nativeimpl.Decrypt"
+} external;

ballerina/private_public_key.bal

@@ -176,7 +176,7 @@ public isolated function decodeRsaPrivateKeyFromKeyFile(string keyFile, string?
 # crypto:PrivateKey privateKey = check crypto:decodeRsaPrivateKeyFromContent(keyFileContent, "keyPassword");
 # ```
 #
-# + keyFile - Private key content as a byte array
+# + content - Private key content as a byte array
 # + keyPassword - Password of the private key if it is encrypted
 # + return - Reference to the private key or else a `crypto:Error` if the private key was unreadable
 public isolated function decodeRsaPrivateKeyFromContent(byte[] content, string? keyPassword = ()) returns PrivateKey|Error = @java:Method {
@@ -311,7 +311,7 @@ public isolated function decodeRsaPublicKeyFromCertFile(string certFile) returns
 # crypto:PublicKey publicKey = check crypto:decodeRsaPublicKeyFromContent(certContent);
 # ```
 #
-# + certFile - The certificate content as a byte array
+# + content - The certificate content as a byte array
 # + return - Reference to the public key or else a `crypto:Error` if the public key was unreadable
 public isolated function decodeRsaPublicKeyFromContent(byte[] content) returns PublicKey|Error = @java:Method {
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Decode"

ballerina/stream_iterators.bal

@@ -0,0 +1,81 @@
+// Copyright (c) 2024 WSO2 LLC. (https://www.wso2.com).
+//
+// WSO2 LLC. licenses this file to you under the Apache License,
+// Version 2.0 (the "License"); you may not use this file except
+// in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import ballerina/jballerina.java;
+
+class DecryptedStreamIterator {
+    boolean isClosed = false;
+
+    public isolated function next() returns record {|byte[] value;|}|Error? {
+        byte[]|Error? bytes = self.readDecryptedStream();
+        if bytes is byte[] {
+            return {value: bytes};
+        } else {
+            return bytes;
+        }
+    }
+
+    public isolated function close() returns Error? {
+        if !self.isClosed {
+            var closeResult = self.closeDecryptedStream();
+            if closeResult is () {
+                self.isClosed = true;
+            }
+            return closeResult;
+        }
+        return;
+    }
+
+    isolated function readDecryptedStream() returns byte[]|Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+
+    isolated function closeDecryptedStream() returns Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+}
+
+class EncryptedStreamIterator {
+    boolean isClosed = false;
+
+    public isolated function next() returns record {|byte[] value;|}|Error? {
+        byte[]|Error? bytes = self.readEncryptedStream();
+        if bytes is byte[] {
+            return {value: bytes};
+        } else {
+            return bytes;
+        }
+    }
+
+    public isolated function close() returns Error? {
+        if !self.isClosed {
+            var closeResult = self.closeEncryptedStream();
+            if closeResult is () {
+                self.isClosed = true;
+            }
+            return closeResult;
+        }
+        return;
+    }
+
+    isolated function readEncryptedStream() returns byte[]|Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+
+    isolated function closeEncryptedStream() returns Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+}

ballerina/tests/encrypt_decrypt_pgp_test.bal

@@ -14,6 +14,7 @@
 // specific language governing permissions and limitations
 // under the License.
 
+import ballerina/io;
 import ballerina/test;
 
 @test:Config {}
@@ -41,7 +42,7 @@ isolated function testNegativeEncryptAndDecryptWithPgpInvalidPrivateKey() return
     byte[] cipherText = check encryptPgp(message, PGP_PUBLIC_KEY_PATH);
     byte[]|Error plainText = decryptPgp(cipherText, PGP_INVALID_PRIVATE_KEY_PATH, passphrase);
     if plainText is Error {
-        test:assertEquals(plainText.message(), "Error occurred while PGP decrypt: Could Not Extract private key");
+        test:assertEquals(plainText.message(), "Error occurred while PGP decrypt: Could not Extract private key");
     } else {
         test:assertFail("Should return a crypto Error");
     }
@@ -55,8 +56,85 @@ isolated function testNegativeEncryptAndDecryptWithPgpInvalidPassphrase() return
     byte[]|Error plainText = decryptPgp(cipherText, PGP_PRIVATE_KEY_PATH, passphrase);
     if plainText is Error {
         test:assertEquals(plainText.message(),
-        "Error occurred while PGP decrypt: checksum mismatch at in checksum of 20 bytes");
+                "Error occurred while PGP decrypt: checksum mismatch at in checksum of 20 bytes");
     } else {
         test:assertFail("Should return a crypto Error");
     }
 }
+
+@test:Config {
+    serialExecution: true
+}
+isolated function testEncryptAndDecryptStreamWithPgp() returns error? {
+    byte[] passphrase = "qCr3bv@5mj5n4eY".toBytes();
+    stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream(SAMPLE_TEXT);
+    stream<byte[], error?> encryptedStream = check encryptStreamAsPgp(inputStream, PGP_PUBLIC_KEY_PATH);
+    stream<byte[], error?> decryptedStream = check decryptStreamFromPgp(encryptedStream, PGP_PRIVATE_KEY_PATH, passphrase);
+
+    byte[] expected = check io:fileReadBytes(SAMPLE_TEXT);
+    byte[] actual = [];
+    check from byte[] bytes in decryptedStream
+        do {
+            actual.push(...bytes);
+        };
+    test:assertEquals(actual, expected);
+}
+
+@test:Config {
+    serialExecution: true
+}
+isolated function testEncryptAndDecryptStreamWithPgpWithOptions() returns error? {
+    byte[] passphrase = "qCr3bv@5mj5n4eY".toBytes();
+    stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream(SAMPLE_TEXT);
+    stream<byte[], error?> encryptedStream = check encryptStreamAsPgp(inputStream, PGP_PUBLIC_KEY_PATH, symmetricKeyAlgorithm = AES_128, armor = false);
+    stream<byte[], error?> decryptedStream = check decryptStreamFromPgp(encryptedStream, PGP_PRIVATE_KEY_PATH, passphrase);
+
+    byte[] expected = check io:fileReadBytes(SAMPLE_TEXT);
+    byte[] actual = [];
+    check from byte[] bytes in decryptedStream
+        do {
+            actual.push(...bytes);
+        };
+    test:assertEquals(actual, expected);
+}
+
+@test:Config {
+    serialExecution: true
+}
+isolated function testNegativeEncryptAndDecryptStreamWithPgpInvalidPrivateKey() returns error? {
+    byte[] passphrase = "p7S5@T2MRFD9TQb".toBytes();
+    stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream(SAMPLE_TEXT);
+    stream<byte[], error?> encryptedStream = check encryptStreamAsPgp(inputStream, PGP_PUBLIC_KEY_PATH, symmetricKeyAlgorithm = AES_128, armor = false);
+    stream<byte[], error?>|Error result = decryptStreamFromPgp(encryptedStream, PGP_INVALID_PRIVATE_KEY_PATH, passphrase);
+    if result is Error {
+        check encryptedStream.close();
+        check inputStream.close();
+        test:assertEquals(result.message(), "Error occurred while PGP decrypt: Could not Extract private key");
+    } else {
+        check encryptedStream.close();
+        check inputStream.close();
+        check result.close();
+        test:assertFail("Should return a crypto Error");
+    }
+}
+
+@test:Config {
+    serialExecution: true
+}
+isolated function testNegativeEncryptAndDecryptStreamWithPgpInvalidPassphrase() returns error? {
+    byte[] passphrase = "p7S5@T2MRFD9TQb".toBytes();
+    stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream(SAMPLE_TEXT);
+    stream<byte[], error?> encryptedStream = check encryptStreamAsPgp(inputStream, PGP_PUBLIC_KEY_PATH, symmetricKeyAlgorithm = AES_128, armor = false);
+    stream<byte[], error?>|Error result = decryptStreamFromPgp(encryptedStream, PGP_PRIVATE_KEY_PATH, passphrase);
+    if result is Error {
+        check encryptedStream.close();
+        check inputStream.close();
+        test:assertEquals(result.message(),
+                "Error occurred while PGP decrypt: checksum mismatch at in checksum of 20 bytes");
+    } else {
+        check encryptedStream.close();
+        check inputStream.close();
+        check result.close();
+        test:assertFail("Should return a crypto Error");
+    }
+}