PgpEncryptedDataGenerator: How does open work with multiple methods?

[Liam-Rougoor]

Hi! 👋

I just started using Pgp encryption for one of our projects, and I got a bit confused about encrypting data with multiple public key methods:

In the PgpEncryptedDataGenerator.open(), it is possible to have multiple 'methods'. These methods can theoretically have different keys. It looks like the open method writes packets for each of those methods.

How/Why does that work? How can input be encrypted using different methods/keys? Or am I saying nonsense? I'm very new to this 😅

Thanks!

[Liam-Rougoor]

Update: I've been doing some more experiments. I believe that the message is encrypted for all the public keys, meaning that any matching private key can decrypt the message (so basically for multiple recipients). Am I correct?

[dghgit]

Yes, that's correct - essentially what happens is the data is encrypted once using a session key and then the session key is encrypted using each public key that has been added. This allows the holder of a private key corresponding to any of the public keys provided to recover the session key and consequently recover the data.