Encrypt and decrypt a file with PGP in C#

dotnet new console -o PgpEncrypt && cd PgpEncrypt
dotnet add package RecursiveAI.OneCrypto.OpenPgp --version 0.3.0-preview.2

using System.Text;
using RecursiveAI.OneCrypto.OpenPgp;
 
DateTimeOffset now = DateTimeOffset.UtcNow;
// The key's password: read it from your secret store
byte[] password = Encoding.UTF8.GetBytes("demo password");
 
// A test key, made on the first run: version 4 Curve25519, a key GnuPG 2.4 can read
if (!File.Exists("alice.key.asc"))
{
    PgpCertificate created = PgpKeyGenerator.Generate(new PgpKeyGenerationOptions
    {
        Now = now,
        UserIds = ["Alice <[email protected]>"],
        Profile = PgpKeyProfile.Rfc4880Curve25519,
        Password = password,
    });
    // The secret key stays private; the certificate (public key) is what you share
    File.WriteAllBytes("alice.key.asc", created.Export(armor: true));
    File.WriteAllBytes("alice.pub.asc", created.ExportPublic(armor: true));
}
PgpCertificate certificate = PgpCertificate.Parse(File.ReadAllBytes("alice.pub.asc"));
PgpCertificate secretKey = PgpCertificate.Parse(File.ReadAllBytes("alice.key.asc"));
 
File.WriteAllText("report.txt", "Q3 numbers: revenue up 4%, costs flat.\n");
 
// Encrypt the file to the certificate (anyone can do this with the public part)
using (FileStream input = File.OpenRead("report.txt"))
using (FileStream output = File.Create("report.txt.asc"))
{
    PgpWriteResult written = PgpMessageWriter.Write(input, output, new PgpWriteOptions
    {
        Now = now,
        Recipients = [certificate],
        Armor = true,
        FileName = Encoding.UTF8.GetBytes("report.txt"),
    });
    Console.WriteLine($"Encrypted report.txt.asc: {written.Format}, {written.Cipher}");
}
 
// Decrypt with the secret key: report.txt.asc, or a file named on the command line
string path = args.Length > 0 ? args[0] : "report.txt.asc";
using (FileStream input = File.OpenRead(path))
using (FileStream output = File.Create("report.decrypted.txt"))
{
    PgpReadResult read = PgpMessageReader.Read(input, output, new PgpReadOptions
    {
        Now = now,
        SecretKeys = [secretKey],
        KeyPasswords = [password],
    });
    Console.WriteLine($"Decrypted {path}: protection {read.Protection}, signatures {read.Signatures.Count}");
}
Console.Write(File.ReadAllText("report.decrypted.txt"));

Encrypted report.txt.asc: Seipd1, Aes256
Decrypted report.txt.asc: protection Mdc, signatures 0
Q3 numbers: revenue up 4%, costs flat.

export GNUPGHOME="$(mktemp -d)"
gpg --batch --pinentry-mode loopback --passphrase 'demo password' --import alice.key.asc
gpg --batch --pinentry-mode loopback --passphrase 'demo password' --decrypt report.txt.asc

gpg: keybox '/tmp/tmp.m8PlqfCuaD/pubring.kbx' created
gpg: /tmp/tmp.m8PlqfCuaD/trustdb.gpg: trustdb created
gpg: key CE3FAA9E94BC645F: public key "Alice <[email protected]>" imported
gpg: key CE3FAA9E94BC645F: secret key imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg:       secret keys read: 1
gpg:   secret keys imported: 1
gpg: encrypted with cv25519 key, ID A9C57FDDD7DF4F28, created 2026-11-02
      "Alice <[email protected]>"
Q3 numbers: revenue up 4%, costs flat.

echo 'Sent from GnuPG 2.4.8.' > from-gpg.txt
gpg --batch --trust-model always --armor --recipient [email protected] \
  --output from-gpg.txt.asc --encrypt from-gpg.txt
dotnet run -- from-gpg.txt.asc

Encrypted report.txt.asc: Seipd1, Aes256
Decrypted from-gpg.txt.asc: protection Mdc, signatures 0
Sent from GnuPG 2.4.8.

printf 'demo password' > password.txt
sqop decrypt --with-key-password=password.txt alice.key.asc < report.txt.asc
echo 'Sent from Sequoia.' | sqop encrypt alice.pub.asc > from-sqop.txt.asc
dotnet run -- from-sqop.txt.asc

Q3 numbers: revenue up 4%, costs flat.
Encrypted report.txt.asc: Seipd1, Aes256
Decrypted from-sqop.txt.asc: protection Mdc, signatures 0
Sent from Sequoia.