(Node.js) Yubikey RSA Encrypt/Decrypt

See more RSA Examples

Note: RSA encryption uses the public key, which is freely exportable and does not need to occur on the token/smartcard.

Note: This example requires Chilkat v10.1.3 or greater.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOS

var os = require('os');
if (os.platform() == 'win32') {  
  var chilkat = require('@chilkat/ck-node23-win64'); 
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node23-linux-arm');
    } else if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node23-linux-arm64');
    } else {
        var chilkat = require('@chilkat/ck-node23-linux-x64');
    }
} else if (os.platform() == 'darwin') {
  var chilkat = require('@chilkat/ck-node23-mac-universal');
}

function chilkatExample() {

    // This example assumes you have a certificate with private key on the Yubikey token.
    // When doing simple RSA encryption/decryption, we don't actually need the certificate,
    // but we'll be using the private key associated with the certificate.
    // 
    // The sensitive/secret material that needs to be kept private is the private key.
    // The certificate itself and the public key can be freely shared.
    // 

    // We're going to encrypt and decrypt 32-bytes of data.
    var bd = new chilkat.BinData();
    var success = bd.AppendEncoded("000102030405060708090A0B0C0D0E0F","hex");
    success = bd.AppendEncoded("000102030405060708090A0B0C0D0E0F","hex");

    // Let's get the desired cert.
    // For this example, a self-signed certificate with a 2048-bit RSA key was generated in slot 9A.
    var cert = new chilkat.Cert();

    // Force Chilkat to use PKCS11 over ScMinidriver (if on Windows) and Apple Keychain (if on MacOS)
    cert.UncommonOptions = "NoScMinidriver,NoAppleKeychain";

    cert.SmartCardPin = "123456";

    success = cert.LoadFromSmartcard("cn=chilkat_test_2048");
    if (success == false) {
        console.log(cert.LastErrorText);
        return;
    }

    // RSA encrypt using the public key.
    var rsa = new chilkat.Rsa();

    // Provide the RSA object with the certificate on the Yubkey.
    success = rsa.SetX509Cert(cert,true);
    if (success == false) {
        console.log(rsa.LastErrorText);
        return;
    }

    // RSA encrypt using the public key.
    var usePrivateKey = false;
    success = rsa.EncryptBd(bd,usePrivateKey);
    if (success == false) {
        console.log(rsa.LastErrorText);
        return;
    }

    console.log("RSA Encrypted Output in Hex:");
    console.log(bd.GetEncoded("hex"));

    // Now let's decrypt, using the private key on the Yubikey.
    usePrivateKey = true;
    success = rsa.DecryptBd(bd,usePrivateKey);
    if (success == false) {
        console.log(rsa.LastErrorText);
        return;
    }

    console.log("RSA Decrypted Output in Hex:");
    console.log(bd.GetEncoded("hex"));

}

chilkatExample();