Lianja

Yubikey RSA Encrypt/Decrypt

See more RSA Examples

Demonstrates how to do RSA decryption using a private key stored on a Yubikey (or other USB token or smartcard).

Note: RSA encryption uses the public key, which is freely exportable and does not need to occur on the token/smartcard.

Lianja

llSuccess = .F.

// This example assumes you have a certificate with private key on the Yubikey token.
// When doing simple RSA encryption/decryption, we don't actually need the certificate,
// but we'll be using the private key associated with the certificate.
// 
// The sensitive/secret material that needs to be kept private is the private key.
// The certificate itself and the public key can be freely shared.
// 

// We're going to encrypt and decrypt 32-bytes of data.
loBd = createobject("CkBinData")
llSuccess = loBd.AppendEncoded("000102030405060708090A0B0C0D0E0F","hex")
llSuccess = loBd.AppendEncoded("000102030405060708090A0B0C0D0E0F","hex")

// Let's get the desired cert.
// For this example, a self-signed certificate with a 2048-bit RSA key was generated in slot 9A.
loCert = createobject("CkCert")

// Force Chilkat to use PKCS11 over ScMinidriver (if on Windows) and Apple Keychain (if on MacOS)
loCert.UncommonOptions = "NoScMinidriver,NoAppleKeychain"

loCert.SmartCardPin = "123456"

llSuccess = loCert.LoadFromSmartcard("cn=chilkat_test_2048")
if (llSuccess = .F.) then
    ? loCert.LastErrorText
    release loBd
    release loCert
    return
endif

// RSA encrypt using the public key.
loRsa = createobject("CkRsa")

// Provide the RSA object with the certificate on the Yubkey.
llSuccess = loRsa.SetX509Cert(loCert,.T.)
if (llSuccess = .F.) then
    ? loRsa.LastErrorText
    release loBd
    release loCert
    release loRsa
    return
endif

// RSA encrypt using the public key.
llUsePrivateKey = .F.
llSuccess = loRsa.EncryptBd(loBd,llUsePrivateKey)
if (llSuccess = .F.) then
    ? loRsa.LastErrorText
    release loBd
    release loCert
    release loRsa
    return
endif

? "RSA Encrypted Output in Hex:"
? loBd.GetEncoded("hex")

// Now let's decrypt, using the private key on the Yubikey.
llUsePrivateKey = .T.
llSuccess = loRsa.DecryptBd(loBd,llUsePrivateKey)
if (llSuccess = .F.) then
    ? loRsa.LastErrorText
    release loBd
    release loCert
    release loRsa
    return
endif

? "RSA Decrypted Output in Hex:"
? loBd.GetEncoded("hex")


release loBd
release loCert
release loRsa