PGPony Android 4.0.0

PGPony 4.0.0 — The OpenKeychain Succession

The biggest release yet: post-quantum encryption and an OpenPGP provider API that lets other Android apps use PGPony as their crypto engine.

🔮 Post-quantum encryption (ML-KEM-768 + X25519)

Generate, encrypt to, and decrypt with quantum-resistant composite keys, in both wire formats in use today:

• IETF format (algorithm 35, v6 keys) — implements draft-ietf-openpgp-pqc, verified byte-for-byte against the draft's official test vectors
• LibrePGP / GnuPG format (algorithm 8, v5 keys) — interoperates with GnuPG 2.5+: messages encrypt and decrypt in both directions, and public keys import cleanly (ky768_cv25519)

Includes passphrase-protected composite keys (Argon2id + AEAD for v6, CFB for v5) and full cross-platform parity with PGPony for iOS — messages, public keys, and secret keys all transfer both ways.

Known limitations (ecosystem, not PGPony): GnuPG cannot yet import post-quantum private keys from any app (it stores them in a proprietary internal format), and current Sequoia (sq) preview builds implement a different draft revision and cannot read IETF-format keys yet — they fail on the draft's own sample key. Classical keys are unaffected.

🔌 OpenPGP API provider

PGPony now implements the org.openintents.openpgp.IOpenPgpService2 API — the same interface OpenKeychain provided — so it works as the crypto backend for Thunderbird for Android, K-9 Mail, and Password Store:

• Encrypt, decrypt, sign, and verify on behalf of connected apps, including streaming support for large attachments
• Hardware-key (NFC smartcard) signing and decryption inside provider operations
• Security first: no default-allow — every client app is authorized on first use with a signature-pinned allow-list, revocable in Settings → Connected apps

🗝️ Keyring & privacy

• Encrypted keyring backup and restore — one file for your whole keyring, plus import of OpenKeychain .sec.pgp backups
• Default signing key — pin a signer so it's preselected on every Sign + Encrypt
• Orbot / Tor integration — route keyserver and WKD traffic through SOCKS with one tap
• Autocrypt support for peer key discovery

Under the hood

• Bouncy Castle 1.85; hand-rolled composite packet codecs validated against GnuPG 2.5.21, the draft-ietf-openpgp-pqc vectors, and PGPony iOS
• ~300 unit tests, including offline PQC interop fixtures and gated cross-tool harnesses
• versionCode 400 · versionName 4.0.0 · Android 8.0+ (API 26)

No migration needed — existing keys, contacts, and settings carry over unchanged.

PGPony Android 3.1.0

PGPony 3.1.0 brings full PGP/MIME support, a card PIN cache, and complete support for offline-primary hardware key layouts — reaching feature parity with PGPony iOS 7.1.

PGP/MIME messages with attachments

• Decrypting a PGP/MIME message (from Thunderbird and other mail clients) now shows the message body with its attachments as individual items — open, save, or share each one, or share them all at once.
• New Bundle mode on the Encrypt screen: write a message, attach photos and files, and encrypt everything into a single output — save or share as a standards-compliant .eml (RFC 3156) or as a plain .asc.
• Share multiple files into PGPony at once to start an encrypted bundle.
• Opening or sharing in a .eml routes to the right place automatically.

Hardware keys

• Remember card PIN (Settings → Security, off by default): keeps your user PIN in memory for a chosen duration (1 min – 1 hour) so it isn't retyped for every NFC tap. Never written to disk; cleared by a wrong PIN, closing the app, the timer, or the new Clear button — with a live countdown in Settings.
• Offline-primary layouts fully supported. Cards carrying only subkeys (primary key kept offline) now link to the correct keyring entry on import instead of creating a duplicate, produce signatures with the correct signing-subkey issuer (verified against GnuPG), and work across every encrypt, decrypt, and sign flow.

Interoperability

• Messages encrypted by modern GnuPG using AEAD/OCB ("tag 20") are now accepted — previously rejected with a false "no integrity protection" error despite being fully authenticated.
• Password-based encryption already interoperates with gpg -c in both directions.

Encrypt screen

• Redesigned mode row: Text, Sign, File, Bundle — with password encryption available as an "Encrypt with" choice inside Text and File modes (matching iOS).
• Send as Email: send encrypted output straight to your mail app — inline in the body (PGP-aware clients decrypt automatically), as a .asc attachment, or both (Settings → Email).
• Sign by default option: start new messages with signing enabled using your default key.
• Encrypt inputs are cleared automatically after you close a

PGPony 3.0.4

Fixed a crash when creating an inline (clear-signed) signature on Android 12 and earlier. Inline signing now works across all supported Android versions.
Refreshed the app icon.

PGPony 3.0.3

Store listing release. Adds the F-Droid listing assets (app icon, screenshots, and description) so they appear on the F-Droid page. No functional changes to the app.

PGPony is an OpenPGP app that runs entirely on device: encrypt, decrypt, sign, verify, manage your keyring, and use a hardware security key over NFC. The full app source is public under Apache-2.0, and the FOSS build ships with no Google services.

Changes in 3.0.3

• Added fastlane store metadata (icon, screenshots, description) for the F-Droid listing
• No changes to app functionality

Verify

• APK SHA-256: 0683a0b9942b4ee65c3b4f677eb01bb7b95021db472e6a2f52575c8a7578471a
• Signing certificate SHA-256: 446bf9e621222a40c66cd2476e1a97105ccb2a9b16a01a91c1c7eb90765b50dc

Privacy

No accounts, no ads, no analytics, no tracking. The FOSS build contains no Google services and runs fully on de-Googled devices.

Source: https://github.com/norsehorse-dev/PGPonyAndroid
Crypto core: https://github.com/norsehorse-dev/PGPonyCore-Kotlin

PGPony 3.0.2

Maintenance release for reproducible builds. Disables the Android Gradle Plugin VCS-info file that was embedded in the APK, so the release can be built byte-for-byte from source.

PGPony is an OpenPGP app that runs entirely on device: encrypt, decrypt, sign, verify, manage your keyring, and use a hardware security key over NFC. The full app source is public under Apache-2.0, and the FOSS build ships with no Google services.

Changes in 3.0.2

• Stopped embedding META-INF/version-control-info.textproto in the APK so F-Droid can reproduce the build from source

Features

• On-card key generation for hardware security keys (Ed25519 and X25519) over NFC
• Full smartcard support on YubiKey 5 NFC and Token2: decrypt, sign, encrypt-and-sign, user and admin PIN management, factory reset, for both RSA and 25519 keys
• RFC 9580 (OpenPGP v6) key generation with Argon2id passphrase protection
• Read-only Password Store (pass) support, including entries protected by a hardware key
• Open-source cryptographic core, published separately as PGPonyCore-Kotlin
• Biometric lock and secure-screen protection
• Key discovery through WKD and the keys.openpgp.org verifying keyserver

Install

The FOSS APK is attached to this release, signed with the project release key. F-Droid and IzzyOnDroid listings are on the way.

Verify

• APK SHA-256: 2e17b509189dc1b2cfe3cebaa0c0f154fd7f7b0d1ea54a85ef4e3e7e5c657353
• Signing certificate SHA-256: 446bf9e621222a40c66cd2476e1a97105ccb2a9b16a01a91c1c7eb90765b50dc

Privacy

No accounts, no ads, no analytics, no tracking. The FOSS build contains no Google services and runs fully on de-Googled devices.

Source: https://github.com/norsehorse-dev/PGPonyAndroid
Crypto core: https://github.com/norsehorse-dev/PGPonyCore-Kotlin

PGPony 3.0.1

Maintenance release. Fixes a duplicate launcher-icon resource that prevented a clean build from source.

PGPony is an OpenPGP app that runs entirely on device: encrypt, decrypt, sign, verify, manage your keyring, and use a hardware security key over NFC. The full app source is public under Apache-2.0, and the FOSS build ships with no Google services.

Changes in 3.0.1

• Removed duplicate PNG launcher icons that collided with the WebP versions and broke a from-source build

Features

• On-card key generation for hardware security keys (Ed25519 and X25519) over NFC
• Full smartcard support on YubiKey 5 NFC and Token2: decrypt, sign, encrypt-and-sign, user and admin PIN management, factory reset, for both RSA and 25519 keys
• RFC 9580 (OpenPGP v6) key generation with Argon2id passphrase protection
• Read-only Password Store (pass) support, including entries protected by a hardware key
• Open-source cryptographic core, published separately as PGPonyCore-Kotlin
• Biometric lock and secure-screen protection
• Key discovery through WKD and the keys.openpgp.org verifying keyserver

Install

The FOSS APK is attached to this release, signed with the project release key. F-Droid and IzzyOnDroid listings are on the way.

Verify

• APK SHA-256: 095c0d8c2fd3e4920a5da26b4c7c1c73c473cd2ce80f73184daea37b7bfc7012
• Signing certificate SHA-256: 446bf9e621222a40c66cd2476e1a97105ccb2a9b16a01a91c1c7eb90765b50dc

Privacy

No accounts, no ads, no analytics, no tracking. The FOSS build contains no Google services and runs fully on de-Googled devices.

Source: https://github.com/norsehorse-dev/PGPonyAndroid
Crypto core: https://github.com/norsehorse-dev/PGPonyCore-Kotlin