openpgpjs VS Bouncy Castle

not a great example, in the FOSS side of things GnuPG is being constantly worked on as is openpgp.js

https://openpgpjs.org/

A number of Chrome (and I think also Firefox) extensions include their own local copy of OoenPGP.js for use with various webmail services, including GMail.

WKD (and HKP) depends upon HTTPS without cert pinning, FWIU: https://wiki.gnupg.org/WKD

  How does an email client use WKD?

I know this might not be the appropriate sub, but does anyone know if there are any good learning resources on this? I am struggling to implement an OpenPGP application using Java, and the documentation is no help. I have had great luck with https://openpgpjs.org/ (a very well documented resource), but I don't understand how to accomplish generating keys, storing them in armored files, and using the stored keys for signing and encryption with BouncyCastle. Any pointers would be greatly appreciated.

I used openpgpjs to do all the encryption and decryption. It works perfectly in the browser and nodejs, but not in react native :(

What's your opinion of OpenPGPJs? Do you think JavaScript is just too insecure for it to be safe?

a) We use an open source cryptographic library, OpenPGPjs, which is built by the good folks over at Protonmail, and the library itself is frequently audited. Here's one. And everything you see and use on Cryptee is built on top of this.

Note that there may be incompatibilities until NIST has published the final revisions. Some specifications are on Round 3 kyber, others are on FIPS 203.

This one will interoperate with Bouncy Castle as we both use FIPS 203 draft, but won't interoperate with OQS that is still on the Round 3 submission.

See also: https://github.com/bcgit/bc-java/issues/1578

The readme mentions a dependency on Bouncy Castle - note that BC already contains several Java-based PQC signature schemes, see https://doc.primekey.com/bouncycastle/interoperability#Inter... and https://github.com/bcgit/bc-java

The best official resources are probably the example classes in the bouncycastle repository. They give you a rough idea for how to use the API, although they are a bit minimal unfortunately. You can probably apply a lot of domain knowledge (what algorithms are good/bad) from openpgpjs too, although you'd have to find out how the respective method calls are called on the BC side.

Why? Bouncy Castle has all you need.

Cryptography? Use Java Cryptography Extensions and Java Secure Socket Extensions with Bouncy Castle

Recently there was a constant time enhancement in bouncy castle that added a comparison using indexOf instead of charAt. Fairly easy to overlook, although glaring in hindsight, if there are no negative tests covering the functionality.