--- schema_version: "1" id: 5854c5dc69c48906740f50f3a33c61c5c27942928815ea8aa6dfa7e7156315bb title: Configuring PGP Cryptography collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cryptography-module/latest/cryptography-module-pgp.md canonical_url: https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-pgp source_site: docs.mulesoft.com content_type: documentation content_hash: 5c3efaa61ef85ba7747ab3a0c1769303ffe45802ebc1f281928b53d6a77b24a1 description: MuleSoft Documentation Site release: "2.2" latest: true --- --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Configuring PGP Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtime engine (Mule) can encrypt entire messages or just parts of them using Pretty Good Privacy (PGP). PGP secures messages by combining data compression and encryption. The compression helps reduce the message size, which can speed up transmission within your Mule app. PGP encryption is more resource-intensive than JCE or XML encryption due to its increased complexity. There are two main PGP scenarios: - Encryption Encrypt an outgoing message in your Mule app using another party’s public key. - Decryption Decrypt an incoming message in your Mule app using your own private key. Use the Cryptography Module PGP operations to configure these scenarios. > [!NOTE] If you’re upgrading to Cryptography Module 2.1, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.x](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-upgrade). > [!NOTE] This guide covers the main PGP operations and common use cases. For a complete list of all > available parameters and their default values, refer to > [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference). ## Before You Begin You are familiar with PGP encryption, concepts of public and private keys, and asymmetric cryptography. ## FIPS Compliance Considerations > [!IMPORTANT] PGP Encrypt operations are not supported in FIPS environments, including MuleSoft > Government Cloud. > > The OpenPGP standard (RFC 4880) mandates the use of RSAES-PKCS1-v1\_5 for encrypting the session > key, which is blocked in FIPS approved mode. This limitation exists regardless of the symmetric > encryption algorithm chosen. > > Supported PGP operations in FIPS: > > - PGP Decrypt (for legacy data) > > - PGP Sign > > - PGP Validate > > For complete FIPS migration details, refer to > [cryptography-module-upgrade.adoc#scope-and-limitations-fips](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-upgrade#scope-and-limitations-fips). ## Configure PGP Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module PGP operation to the canvas flow. ![A palette menu for adding PGP encryption and decryption modules](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pgp-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Public keyring** and **Private keyring** files. You can also add asymmetric key information to be used in the sign operations: ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pgp-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration settings for PGP encrypt with algorithm and key selection](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pgp-config.png) 4. Select the algorithm to use during the operation. ## Work with Subkeys According to the RFC-4880 standard, a PGP key can contain multiple subkeys. When you’re working with these subkeys, use the fingerprint attribute within the `` XML element to specify which subkey you want to use. For instance, if you have separate subkeys for signing and encryption, and they use different algorithms, for example, DSA for signing and ElGamal for encryption, reference the correct subkey’s fingerprint for each operation. Therefore, use the ElGamal fingerprint to encrypt your messages and the DSA fingerprint to sign them. ## Encrypt Messages with Public Keys When encrypting messages with PGP, you (the sender) must encrypt the content using the receiver’s public key. Therefore, to encrypt messages in your Mule app using someone else’s public key, add their public key to your keyring. When you configure a new PGP operation in your Mule app, provide your keyring file. The encryption module then uses this file to retrieve the necessary public key for encryption. Follow these steps: 1. Use a tool like GPG Suite to import the other party’s public key. 2. With the same tool, export the public key, making sure to select binary as the output format. This creates a keyring file with a `.gpg` extension. 3. Place the `.gpg` keyring file in a location where your Mule app can access it during runtime. Example: PGP Configuration ```xml ``` - Use the **Pgp encrypt** operation to returns an ASCII-armored encrypted payload, which is suitable for sending over plain-text channels: ```xml ``` Use the `disableMDC` parameter to disable modification detection code if needed for compatibility with legacy systems. For all available parameters, refer to [cryptography-module-reference.adoc#PgpEncrypt](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference#PgpEncrypt). - Use the **Pgp encrypt binary** operation to return a binary output instead: ```xml ``` Producing a binary output is faster than using ASCII-armored. However, the output is not standard and might not be ideal to send to other systems for decryption. > [!NOTE] The `disableMDC` parameter is also available for this operation. For all available > parameters, refer to > [cryptography-module-reference.adoc#PgpEncryptBinary](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference#PgpEncryptBinary). - Use the **Pgp binary to armored** operation to send a payload with binary output to another system, and transform it to ASCII-armored: ```xml ``` This operation has a single input parameter, the message payload to transform. ## Encrypt and Sign Besides just encrypting, you can also encrypt and sign a message in one atomic operation. This returns a message in ASCII-armored format, similar to a purely encrypted one, but with an added signature inside the encrypted content. This signature acts as an integrity check, verifying the original message hasn’t been tampered with. To encrypt and sign, the private key of the signer (typically the sender) must be present in the private keyring. This process always produces an ASCII-armored output. Using the **Pgp encrypt and sign** operation: ```xml ``` ## Decrypt For PGP decryption, the message receiver must use their private key to decrypt content that was encrypted with a public key. This means the receiver needs to share their public key with anyone who will be sending them encrypted messages. Example: PGP Configuration ```xml ``` In the previous example, notice that you must provide at least three parameters to be able to use the private key ring in the decrypt operation: - Key ID (`keyId`): the internal ID that allows you to reference this key from an operation. - Key Fingerprint (`fingerprint`): The last 16 characters of your key fingerprint, which can be obtained from your external GPG tool, such as GPG Keychain. - Passphrase (`passphrase`): The passphrase of the private key. Using the **Pgp decrypt** operation ```xml ``` > [!NOTE] Use the `validateIfSignatureFound` parameter to automatically validate embedded signatures > during decryption. For all available parameters, refer to > [cryptography-module-reference.adoc#PgpDecrypt](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference#PgpDecrypt). ## Sign Sign a message using a configured private key. Example: PGP Configuration ```xml ``` Using the **Pgp sign** operation: ```xml ``` ## Validate a Signature Validate the signature of a message using the signer’s public key. Example: PGP Configuration ```xml ``` Using the **Pgp validate** operation: ```xml ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-examples) - [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference)