Lua Requires Chilkat v10.1.3+

Yubikey RSA Encrypt/Decrypt

See more RSA Examples

Demonstrates how to do RSA decryption using a private key stored on a Yubikey (or other USB token or smartcard).

Note: RSA encryption uses the public key, which is freely exportable and does not need to occur on the token/smartcard.

Lua

local chilkat = require("chilkat")

-- This example assumes you have a certificate with private key on the Yubikey token.
-- When doing simple RSA encryption/decryption, we don't actually need the certificate,
-- but we'll be using the private key associated with the certificate.
--
-- The sensitive/secret material that needs to be kept private is the private key.
-- The certificate itself and the public key can be freely shared.
--

-- We're going to encrypt and decrypt 32-bytes of data.
local bd = chilkat.BinData.new()
local success = bd:append_encoded("000102030405060708090A0B0C0D0E0F", "hex")
success = bd:append_encoded("000102030405060708090A0B0C0D0E0F", "hex")

-- Let's get the desired cert.
-- For this example, a self-signed certificate with a 2048-bit RSA key was generated in slot 9A.
local cert = chilkat.Cert.new()

-- Force Chilkat to use PKCS11 over ScMinidriver (if on Windows) and Apple Keychain (if on MacOS)
cert.uncommon_options = "NoScMinidriver,NoAppleKeychain"

cert.smart_card_pin = "123456"

success = cert:load_from_smartcard("cn=chilkat_test_2048")
if not success then
    print(cert.last_error_text)
    return
end

-- RSA encrypt using the public key.
local rsa = chilkat.Rsa.new()

-- Provide the RSA object with the certificate on the Yubkey.
success = rsa:set_x509_cert(cert, true)
if not success then
    print(rsa.last_error_text)
    return
end

-- RSA encrypt using the public key.
local usePrivateKey = false
success = rsa:encrypt_bd(bd, usePrivateKey)
if not success then
    print(rsa.last_error_text)
    return
end

print("RSA Encrypted Output in Hex:")
print(bd:get_encoded("hex"))

-- Now let's decrypt, using the private key on the Yubikey.
usePrivateKey = true
success = rsa:decrypt_bd(bd, usePrivateKey)
if not success then
    print(rsa.last_error_text)
    return
end

print("RSA Decrypted Output in Hex:")
print(bd:get_encoded("hex"))