Using Pretty Good Privacy (PGP) in Integration Workflows

OneTrust integrations can leverage Pretty Good Encryption (PGP) keys to secure SFTP actions for uploading files in workflows, as well as decrypt them when downloading from a system. PGP keys can use either the Encryption or Decryption connector type when configuring integration credentials to empowers users for either purpose.

To configure PGP encryption keys for credentials

  1. On the Integrations menu, select Credentials.
    The Credentials screen appears.
  2. Click the Add credentials button.
    The Create Credential screen appears.
  3. Select your desired system from the selection field.
    Note:

    While PGP credentials are typically used for files shares, any system can be selected.

    If your desired system is not available in the selection, choose Custom Connector to progress with a custom configuration.

  4. Click the Next button.
    On the Enter Credential Details screen appears.
  5. Complete the fields and then click the Save button.


    Field
    Description
    Credential Name

    Enter a name for the credential.

    Description

    Enter a description for the credential.

    Application Type

    Select Encryption.

    Encryption Type

    Select PGP.

    Algorithm

    CAST5 and AES-256 are supported.

    Public Key

    Enter a public key to verify the signature when encrypting a file.

    Note:

    You will need to generate this Public Key from a PGP generator tool, such as Kleopatra. It will produce a key pair: a public key to encrypt the Key User ID and a private key to decrypt the data. For more on this, see To support integration workflows with PGP encryption.

    Key User ID

    Enter your Key User ID.

    Note:

    This is available when creating the key pair. It is usually a combination of a name and email. In this use case, we are using Integration <test@email.com>. This will vary depending on the PGP tool used.

    Private Key

    Enter an optional private key.

    Private Key Passphrase

    Enter a passphrase for the private key.

To support integration workflows with PGP encryption

In this use case, the workflow is calling to an external server to upload a file via SFTP.

  1. Navigate to the action's Settings tab.
  2. Click to Enable PGP Encryption.


  3. Select the PGP key you created as part of the Encryption type credentials.
    Note:

    Ensure the action itself is configured with the necessary SFTP Account Credentials.

  4. Enable the setting options you want to support the action.


    Field
    Description
    Add .gpg File Extension

    Uploaded file(s) will have a .gpg extension appended but also include the original extension (e.g., sample.csv > sample.csv.gpg).

    This setting is on by default when you enable PGP encryption.

    Digitally Sign File

    Uploaded file(s) will be digitally signed (requires credentials with a private key).

    Enable ASCII Armor

    Convert the binary encrypted file(s) to a printable character representation. This will allow the file to be read in a text editor.

  5. Click the Finish button, then save the workflow.
  6. Once the workflow is triggered, OneTrust will encrypt the file, then upload to the targeted server. You can download and open to file to verify its data is encrypted. To decrypt this data, use the private key in your PGP tool, then use the file as necessary.

To configure PGP decryption keys for credentials

  1. On the Integrations menu, select Credentials. screen appears.
    The Credentials screen appears.
  2. Click the Add New button.
    The Add Credential screen appears.
  3. Select your desired system from the selection field.
  4. Click the Next button.
    The Enter Credential Details screen appears.
  5. Complete the fields, then click the Save button.


    Field
    Description
    Credential Name

    Enter a name for the credential.

    Description

    Enter a description for the credential.

    Application Type

    Select Decryption.

    Decryption Type

    Select PGP.

    Private Key

    Enter the Private Key.

    Private Key Passphrase

    Optional: enter the Private Key Passphrase.

    Public Key

    Optional: enter a Public Key if you want to be able to verify signatures when decrypting files.

To support integration workflows with PGP decryption

In this use case, the workflow is calling to an external server to decrypt a file via SFTP when it is downloaded.

  1. Navigate to the action's Settings tab.
  2. Click to Enable PGP Decryption.


  3. Select the PGP key you created as part of the Decryption credential.
    Note:

    Ensure the action itself is configured with the necessary SFTP Account Credentials.

  4. Enable the setting options you want to support the action.


    Field

    Setting Options

    Verify Signature

    No: the signature will not be checked.

    Only if present: this will produce an error if the signature is not valid.

    Require Valid Signature: the workflow will produce an error if the file does not have a signature or has an invalid signature. The error message will state which occurred.
  5. Click the Finish button, then save the workflow.
  6. Once the workflow is triggered, OneTrust will decrypt downloaded files via this SFTP server action. You will be able to download and decrypt files with or without .gpg extension.

Supported Encryption Standards & Values

OneTrust uses the OpenPGP protocol using a combination of RSA public key cryptography and the CAST-128 symmetric encryption, the SHA-256 hash algorithm, and ZIP compression.