Concept: PGP Filenames

As a security measure, when a plaintext file is encrypted with PGP, the encrypted file can be given a filename that's unrelated to the original, giving no hint of its contents. However, the original filename isn't discarded. It's embedded in the encrypted file for later retrieval by the recipient's decrypting system. Example: you encrypt a file named myPlaintext.txt. The resulting file is called myEncryption.pgp. Part of its encrypted content is the original filename. When your recipient decrypts it, their system names the resulting file myPlaintext.txt.

The Workday Delivery and Retrieval Services follow the typical PGP file-naming practice when possible.

The Workday Delivery Service embeds the plaintext filename in the outgoing PGP file so it can be recovered during decryption.

When the Workday Retrieval Service decrypts an incoming PGP file attached to an integration event, it uses the embedded plaintext filename to name the decrypted file.

Sometimes, however, an incoming PGP file has no embedded plaintext filename. If so, the Workday Retrieval Service bases the name of the decrypted file on the name of the PGP file:

If the PGP filename ends with .pgp, the Retrieval Service removes that suffix from the decrypted filename. Example: the PGP file myFile.csv.pgp is decrypted as myFile.csv, the PGP file myFile.pgp is decrypted as myFile.
If the PGP filename ends with .xlsx, the Retrieval Service leaves it unchanged. Example: the PGP file myFile.xslx is decyrpted as myFile.xslx.
In all other cases, the Retrieval Service adds the suffix .plaintext. Example: the PGP file myFile.doc is decrypted as myFile.plaintext.

When you use Studio's

pgp-encrypt

step to encrypt a message, you can specify the plaintext filename using the

Decrypted Filename

step property. Studio then embeds that filename in the encrypted file for subsequent retrieval in the normal manner.

Likewise, Studio's

pgp-decrypt

step uses any embedded plaintext filename to name the decrypted file. You can use the

Decrypted Filename

step property to provide a filename for situations where none is embedded.

Problems can arise when a remote party encrypting a file unintentionally sets the embedded plaintext filename to some value other than that required by a recipient system. Because the PGP filename is entirely unrelated to the plaintext filename, there is no way to deduce the latter. The recipient has no options in this scenario.

Example: a Retrieval Service is configured to retrieve and decrypt a file. When run, it collects a PGP encrypted file named ExternalStudents.pgp, but a file named _CONSOLE is attached to the integration event for processing by an integration. In this case, the remote system has set _CONSOLE as the embedded plaintext filename. The result is the file is identified to Workday integrations as _CONSOLE.

The only way to prevent such problems is to ensure that senders of PGP files understand how to correctly embed the required plaintext filename.