PGP in .NET with GnuPG and Bouncy Castle

# gpg --full-gen-key
gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
  (14) Existing key from card
Your selection? 1

RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: The Plastic Neuron
Email address: brainwiped@gmail.com
Comment: Blog Example Key
You selected this USER-ID:
    "The Plastic Neuron (Blog Example Key) <brainwiped@gmail.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o

    ┌──────────────────────────────────────────────────────┐
    │ Please enter the passphrase to                       │
    │ protect your new key                                 │
    │                                                      │
    │ Passphrase: ________________________________________ │
    │                                                      │
    │       <OK>                              <Cancel>     │
    └──────────────────────────────────────────────────────┘

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

gpg: key 3B5B7E567A83D4F6 marked as ultimately trusted
gpg: revocation certificate stored as '/root/.gnupg/openpgp-revocs.d/D751039CF43E0D022585F2F63B5B7E567A83D4F6.rev'
public and secret key created and signed.

pub   rsa4096 2025-11-12 [SC]
      D751039CF43E0D022585F2F63B5B7E567A83D4F6
uid           The Plastic Neuron (Blog Example Key) <brainwiped@gmail.com>
sub   rsa4096 2025-11-12 [E]

# gpg --list-keys
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
/root/.gnupg/pubring.kbx
------------------------
pub   rsa4096 2025-11-12 [SC]
      D751039CF43E0D022585F2F63B5B7E567A83D4F6
uid           [ultimate] The Plastic Neuron (Blog Example Key) <brainwiped@gmail.com>
sub   rsa4096 2025-11-12 [E]

gpg --delete-secret-key D751039CF43E0D022585F2F63B5B7E567A83D4F6
gpg --delete-key D751039CF43E0D022585F2F63B5B7E567A83D4F6

# gpg --output blog-example-pub-ascii.gpg --armor --export D751039CF43E0D022585F2F63B5B7E567A83D4F6

# gpg --output blog-example-private-ascii.gpg --armor --export-secret-keys D751039CF43E0D022585F2F63B5B7E567A83D4F6

using Org.BouncyCastle.Bcpg.OpenPgp;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Encodings;
using Org.BouncyCastle.Crypto.Engines;
using System.IO;
using System.Text;

namespace Lang.Encryption;

// THIS CODE IS NOT PRODUCTION READY, PUT IN ERROR HANDLING AND LOGGING!
public class PgpEncryption()
{
	public string Encrypt(string input, string publicKey)
	{
		var inputBytes = Encoding.UTF8.GetBytes(input);
		var cipher = new Pkcs1Encoding(new RsaEngine());
		cipher.Init(true, LoadPgpPublicKey(publicKey));
		int blockSize = cipher.GetInputBlockSize();
		var output = new List<byte>();
		for (int chunkPosition = 0; chunkPosition < inputBytes.Length; chunkPosition += blockSize)
		{
			var chunkSize = blockSize;
			if (chunkPosition + blockSize > inputBytes.Length)
			{
				chunkSize = inputBytes.Length - chunkPosition;
			}
			output.AddRange(cipher.ProcessBlock(inputBytes, chunkPosition, chunkSize));
		}
		
		return Convert.ToBase64String(output.ToArray());
	}

	public string Decrypt(string encrypted, string privateKey, string passKey)
	{
		var encryptedBytes = Convert.FromBase64String(encrypted);
		var cipher = new Pkcs1Encoding(new RsaEngine());
		cipher.Init(false, LoadPgpPrivateKey(privateKey, passKey));
		int blockSize = cipher.GetInputBlockSize();
		var decryptedBytes = new List<byte>();
		for (int chunkPosition = 0; chunkPosition < encryptedBytes.Length; chunkPosition += blockSize)
		{
			var chunkSize = blockSize;
			if (chunkPosition + blockSize > encryptedBytes.Length)
			{
				chunkSize = encryptedBytes.Length - chunkPosition;
			}

			decryptedBytes.AddRange(cipher.ProcessBlock(encryptedBytes, chunkPosition, chunkSize));
		}
		return Encoding.UTF8.GetString(decryptedBytes.ToArray());
	}

	private static ICipherParameters LoadPgpPublicKey(string armoredKeyString)
	{
		using var decoderStream = PgpUtilities.GetDecoderStream(new MemoryStream(Encoding.ASCII.GetBytes(armoredKeyString)));
		var pgpPubRingBundle = new PgpPublicKeyRingBundle(decoderStream);

		foreach (var keyRing in pgpPubRingBundle.GetKeyRings())
		{
			foreach (var key in keyRing.GetPublicKeys())
			{
				if (key.IsEncryptionKey)
				{
					return key.GetKey();
				}
			}
		}
		
		throw new ArgumentException("No encryption key found in the provided PGP public key block.");
	}

	private static ICipherParameters LoadPgpPrivateKey(string armoredKeyString, string passphrase)
	{
		using var keyStream = new MemoryStream(Encoding.ASCII.GetBytes(armoredKeyString));
		using var decoderStream = PgpUtilities.GetDecoderStream(keyStream);

		var pgpSecRingBundle = new PgpSecretKeyRingBundle(decoderStream);

		foreach (var keyRing in pgpSecRingBundle.GetKeyRings())
		{
			foreach (var secretKey in keyRing.GetSecretKeys())
			{
				var privateKey = secretKey.ExtractPrivateKey(passphrase.ToCharArray());
				if (privateKey != null)
				{
					return privateKey.Key;
				}
			}
		}

		throw new ArgumentException("No private key could be found in the provided PGP block.");
	}
}