--- schema_version: "1" id: 86c700f8d8d069bb0b41b051e9325485d1881b59f68e03ab5c17d18c2e26fc61 title: Configuring PGP Cryptography collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cryptography-module/2.0/cryptography-module-pgp.md canonical_url: https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-pgp source_site: docs.mulesoft.com content_type: documentation content_hash: ef3dfa2c26642a749f9b8def5261b7a3fa0231296958e994a4fcd96d121fed7c description: MuleSoft Documentation Site release: "2.0" latest: false --- --- product: Cryptography Module version: 2.0 --- # Configuring PGP Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtine engine (Mule) can encrypt entire messages or just parts of them using Pretty Good Privacy (PGP). PGP secures messages by combining data compression and encryption. The compression helps reduce the message size, which can speed up transmission within your Mule app. PGP encryption is more resource-intensive than JCE or XML encryption due to its increased complexity. There are two main PGP scenarios: - Encryption Encrypt an outgoing message in your Mule app using another party’s public key. - Decryption Decrypt an incoming message in your Mule app using your own private key. Use the Cryptography Module PGP operations to configure these scenarios. > [!NOTE] If you’re upgrading to Cryptography Module 2.0, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-upgrade). ## Before You Begin You are familiar with PGP encryption, concepts of public and private keys, and asymmetric cryptography. ## Configure PGP Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module PGP operation to the canvas flow. ![A palette menu for adding PGP encryption and decryption modules](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pgp-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Public keyring** and **Private keyring** files. You can also add asymmetric key information to be used in the sign operations: ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pgp-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration settings for PGP encrypt with algorithm and key selection](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pgp-config.png) 4. Select the algorithm to use during the operation. ## Work with Subkeys According to the RFC-4880 standard, a PGP key can contain multiple subkeys. When you’re working with these subkeys, use the fingerprint attribute within the `` XML element to specify which subkey you want to use. For instance, if you have separate subkeys for signing and encryption, and they use different algorithms, for example, DSA for signing and ElGamal for encryption, reference the correct subkey’s fingerprint for each operation. Therefore, use the ElGamal fingerprint to encrypt your messages and the DSA fingerprint to sign them. ## Encrypt Messages with Public Keys When encrypting messages with PGP, you (the sender) must encrypt the content using the receiver’s public key. Therefore, to encrypt messages in your Mule app using someone else’s public key, add their public key to your keyring. When you configure a new PGP operation in your Mule app, provide your keyring file. The encryption module then uses this file to retrieve the necessary public key for encryption. Follow these steps: 1. Use a tool like GPG Suite to import the other party’s public key. 2. With the same tool, export the public key, making sure to select binary as the output format. This creates a keyring file with a `.gpg` extension. 3. Place the `.gpg` keyring file in a location where your Mule app can access it during runtime. Example: PGP Configuration ```xml ``` - Use the **Pgp encrypt** operation to returns an ASCII-armored encrypted payload, which is suitable for sending over plain-text channels: ```xml ``` - Use the **Pgp encrypt binary** operation to return a binary output instead: ```xml ``` Producing a binary output is faster than using ASCII-armored. However, the output is not standard and might not be ideal to send to other systems for decryption. - Use the **Pgp binary to armored** operation to send a payload with binary output to another system, and transform it to ASCII-armored: ```xml ``` This operation has a single input parameter, the message payload to transform. ## Encrypt and Sign Besides just encrypting, you can also encrypt and sign a message in one atomic operation. This returns a message in ASCII-armored format, similar to a purely encrypted one, but with an added signature inside the encrypted content. This signature acts as an integrity check, verifying the original message hasn’t been tampered with. To encrypt and sign, the private key of the signer (typically the sender) must be present in the public keyring. This process always produces an ASCII-armored output. Using the **Pgp encrypt and sign** operation: ```xml ``` ## Decrypt For PGP decryption, the message receiver must use their private key to decrypt content that was encrypted with a public key. This means the receiver needs to share their public key with anyone who will be sending them encrypted messages. Example: PGP Configuration ```xml ``` In the previous example, notice that you must provide at least three parameters to be able to use the private key ring in the decrypt operation: - Key ID (`keyId`): the internal ID that allows you to reference this key from an operation. - Key Fingerprint (`fingerprint`): The last 16 characters of your key fingerprint, which can be obtained from your external GPG tool, such as GPG Keychain. - Passphrase (`passphrase`): The passphrase of the private key. Using the **Pgp decrypt** operation ```xml ``` ## Sign Sign a message using a configured private key. Example: PGP Configuration ```xml ``` Using the **Pgp sign** operation: ```xml ``` ## Validate a Signature Validate the signature of a message using the signer’s public key. Example: PGP Configuration ```xml ``` Using the **Pgp validate** operation: ```xml ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-examples) - [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference)