Also support ED25519 ssh keys

Author: Alain Knaff

app/build.gradle

@@ -71,6 +71,8 @@ dependencies {
     //compile 'commons-net:commons-net:+'
     // https://mvnrepository.com/artifact/it.sauronsoftware/ftp4j
     implementation 'com.github.mwiede:jsch:2.27.7'
+    implementation 'org.bouncycastle:bcpkix-jdk15on:1.70'
+    implementation 'org.bouncycastle:bcprov-jdk15on:1.70'
 
     implementation 'com.google.android.material:material:1.13.0'
     implementation 'androidx.constraintlayout:constraintlayout:2.2.1'

app/lint.xml

@@ -1,5 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <lint>
+    <issue id="InvalidPackage" severity="ignore" />
+    <!-- for bouncycastle
+         https://codingtechroom.com/question/trouble-integrating-bouncycastle-jar
+    -->
+
     <issue id="LogConditional" severity="ignore" />
     <!-- to be fixed once we can do non-debug builds -->
 

app/proguard-rules.pro

@@ -19,3 +19,5 @@
 # If you keep the line number information, uncomment this to
 # hide the original source file name.
 #-renamesourcefileattribute SourceFile
+-keep class org.bouncycastle.jcajce.provider.** { *; }
+-keep class org.bouncycastle.jce.provider.** { *; }

app/src/main/java/com/island/androidsftpdocumentsprovider/MainActivity.kt

@@ -114,8 +114,23 @@ class MainActivity : ProviderActivity()
 	}
     }
 
+    val keyTypes = arrayOf("RSA",
+                           "ED25519",
+                           // "ECDSA"
+    );
+
     private fun generateKey2(view: View) {
-	Keygen.genKey(this);
+        AlertDialog.Builder(this)
+            .setTitle("Choose a key type")
+            .setSingleChoiceItems(keyTypes, 1) {
+                dialog, which -> generateKey3(keyTypes[which], view);
+                                 dialog.dismiss();
+            }
+            .show();
+    }
+
+    private fun generateKey3(algo: String, view: View) {
+	Keygen.genKey(this, algo);
 	fixButtonState();
     }
 

app/src/main/java/com/island/sftp/BouncyCastle.java

@@ -0,0 +1,27 @@
+package com.island.sftp;
+
+import java.security.Security;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+
+/**
+ * Reload sufficiently recent BouncyCastle library
+ */
+public abstract class BouncyCastle {
+
+    static {
+        // https://stackoverflow.com/questions/2584401/how-to-add-bouncy-castle-algorithm-to-android
+        // By default Android _has_ bouncy castle, but an old version. Remove
+        // that first
+        //
+        Security.removeProvider("BC");
+
+        Security.insertProviderAt(new BouncyCastleProvider(), 1);
+    }
+
+    /**
+     * Trigger method does nothing by itself, but loading the class and its
+     * BouncyCastle provider.
+     */
+    public static void trigger() {
+    }
+}

app/src/main/java/com/island/sftp/Keygen.java

@@ -4,13 +4,21 @@
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.PrintWriter;
+import java.io.OutputStreamWriter;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.security.Key;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
 import java.security.PublicKey;
+import java.security.NoSuchProviderException;
+
+import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
+import org.bouncycastle.crypto.util.OpenSSHPrivateKeyUtil;
+import org.bouncycastle.crypto.util.OpenSSHPublicKeyUtil;
+import org.bouncycastle.crypto.util.PrivateKeyFactory;
+import org.bouncycastle.crypto.util.PublicKeyFactory;
 
 /* This file is part of SFTP-SAF, an Android app to access sftp servers via Storage access framework
  Copyright (C) 2025,2026 Alain Knaff
@@ -22,8 +30,6 @@
 You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
-import java.security.interfaces.RSAPublicKey;
-import java.nio.charset.StandardCharsets;
 import java.nio.ByteOrder;
 import java.nio.ByteBuffer;
 
@@ -43,62 +49,75 @@ public class Keygen {
     public static final String PRIVATE_KEY_FILE="privateKey.pem";
     public static final String PUBLIC_KEY_FILE="publicKey.txt";
 
-    public static void genKey(Context ctx) {
+    public static void genKey(Context ctx, String algo) {
         try {
-	    // confirmation dialog if it already exists:
-	    // https://stackoverflow.com/questions/5127407/how-to-implement-a-confirmation-yes-no-dialogpreference
+            BouncyCastle.trigger();
 
-            KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
-            keyGen.initialize(2048);
+            KeyPairGenerator keyGen = KeyPairGenerator.getInstance(algo,"BC");
             KeyPair keyPair = keyGen.generateKeyPair();
-            saveKeyToFile(ctx, PRIVATE_KEY_FILE, convertToPEM(keyPair.getPrivate(), "PRIVATE"));
-            saveKeyToFile(ctx, PUBLIC_KEY_FILE, getEncodedSshPublicKey( (PublicKey) keyPair.getPublic()));
 
+            saveKeyToFile(ctx, PRIVATE_KEY_FILE,
+                          convertToPEM(keyPair.getPrivate(),
+                                       "RSA".equals(algo)));
+
+            saveKeyToFile(ctx, PUBLIC_KEY_FILE,
+                          getEncodedSshPublicKey(keyPair.getPublic()));
+        } catch (IOException e) {
+	    Log.e(TAG, "Error generating keys: " + e.getMessage());
+        } catch (NoSuchProviderException e) {
+	    Log.e(TAG, "Error generating keys: " + e.getMessage());
         } catch (NoSuchAlgorithmException e) {
 	    Log.e(TAG, "Error generating keys: " + e.getMessage());
         }
     }
 
-    private static void saveKeyToFile(Context ctx, String fileName, String key) {
+    private static void saveKeyToFile(Context ctx, String fileName, String key)
+        throws IOException
+    {
         try(PrintWriter pw = new PrintWriter(ctx.openFileOutput(fileName, 0))) {
             pw.println(key);
             System.out.println(fileName + " saved successfully.");
         } catch (IOException e) {
 	    Log.e(TAG, "Error saving key to file: " + e.getMessage());
+            throw e;
         }
     }
 
     private static String toBase64(byte[] bin) {
 	return Base64.encodeToString(bin, Base64.NO_WRAP);
     }
 
-    public static String convertToPEM(Key key, String type) {
-        byte[] encodedKey = key.getEncoded();
+    public static String convertToPEM(Key key, boolean isRsa)
+        throws IOException
+    {
+        byte[] encodedKey;
+        String type;
+        if(isRsa) {
+            encodedKey = key.getEncoded();
+            type = "";
+        } else {
+            AsymmetricKeyParameter bprv =
+                PrivateKeyFactory.createKey(key.getEncoded());
+            encodedKey = OpenSSHPrivateKeyUtil.encodePrivateKey(bprv);
+            type="OPENSSH ";
+        }
         String base64Key = toBase64(encodedKey);
-        return "-----BEGIN "+type+" KEY-----\n" + base64Key + "\n-----END "+type+" KEY-----";
+        return "-----BEGIN "+type+"PRIVATE KEY-----\n" + base64Key + "\n-----END "+type+"PRIVATE KEY-----";
     }
 
     // see https://linuxtut.com/en/ee3c7d0ba7d4610a9d21/ for
     // outputting public key
-    public static String getEncodedSshPublicKey(final PublicKey pKey) {
-        final String sig = "ssh-rsa";
-
-	RSAPublicKey publicKey = (RSAPublicKey) pKey;
-        final byte[] sigBytes = sig.getBytes(StandardCharsets.US_ASCII);
-        final byte[] eBytes = publicKey.getPublicExponent().toByteArray();
-        final byte[] nBytes = publicKey.getModulus().toByteArray();
-
-        final int size = 4 + sigBytes.length
-                + 4 + eBytes.length
-                + 4 + nBytes.length;
-
-        final byte[] publicKeyBytes = ByteBuffer.allocate(size)
-                .order(ByteOrder.BIG_ENDIAN)
-                .putInt(sigBytes.length).put(sigBytes)
-                .putInt(eBytes.length).put(eBytes)
-                .putInt(nBytes.length).put(nBytes)
-                .array();
-
+    public static String getEncodedSshPublicKey(final PublicKey pKey)
+        throws IOException
+    {
+        AsymmetricKeyParameter bpub =
+            PublicKeyFactory.createKey(pKey.getEncoded());
+        byte[] publicKeyBytes = OpenSSHPublicKeyUtil.encodePublicKey(bpub);
+        int sigLen = ByteBuffer
+            .wrap(publicKeyBytes)
+            .order(ByteOrder.BIG_ENDIAN)
+            .getInt();
+        final String sig = new String(publicKeyBytes, 4, sigLen);
         final String publicKeyBase64 = toBase64(publicKeyBytes);
 
         final String publicKeyEncoded = sig + " " + publicKeyBase64 + " user@sftpprovider";

app/src/main/java/com/island/sftp/SFTP.java

@@ -67,12 +67,13 @@ public static Uri parseUri(String name) {
 		return Uri.parse(SFTP.SCHEME+name);
 	}
 
-	public SFTP(Context ctx, Uri uri, String password, int id)
-		throws ConnectException
-	{
-		init(ctx, uri, password);
-		this.id = id;
-	}
+        public SFTP(Context ctx, Uri uri, String password, int id)
+                throws ConnectException
+        {
+                BouncyCastle.trigger();
+                init(ctx, uri, password);
+                this.id = id;
+        }
 
 	public int getId() {
 		return id;
@@ -208,7 +209,7 @@ public synchronized void close() throws IOException
 						      "Could not read "+link.getPath());
 						continue;
 					}
-				} 
+				}
 				file=new SftpFile(directory, entry.getFilename(), attrs);
 				files.add(file);
 				lastModified.put(file,file.getSftpLastModified());