(PHP ActiveX) Yubikey RSA Encrypt/Decrypt

See more RSA Examples

Note: RSA encryption uses the public key, which is freely exportable and does not need to occur on the token/smartcard.

Note: This example requires Chilkat v10.1.3 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows Note: The php_com_dotnet.dll may need to be enabled inside of php.ini.

<?php

// This example assumes you have a certificate with private key on the Yubikey token.
// When doing simple RSA encryption/decryption, we don't actually need the certificate,
// but we'll be using the private key associated with the certificate.
// 
// The sensitive/secret material that needs to be kept private is the private key.
// The certificate itself and the public key can be freely shared.
// 

// We're going to encrypt and decrypt 32-bytes of data.
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.BinData')
$bd = new COM("Chilkat.BinData");
$success = $bd->AppendEncoded('000102030405060708090A0B0C0D0E0F','hex');
$success = $bd->AppendEncoded('000102030405060708090A0B0C0D0E0F','hex');

// Let's get the desired cert.
// For this example, a self-signed certificate with a 2048-bit RSA key was generated in slot 9A.
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.Cert')
$cert = new COM("Chilkat.Cert");

// Force Chilkat to use PKCS11 over ScMinidriver (if on Windows) and Apple Keychain (if on MacOS)
$cert->UncommonOptions = 'NoScMinidriver,NoAppleKeychain';

$cert->SmartCardPin = '123456';

$success = $cert->LoadFromSmartcard('cn=chilkat_test_2048');
if ($success == 0) {
    print $cert->LastErrorText . "\n";
    exit;
}

// RSA encrypt using the public key.
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.Rsa')
$rsa = new COM("Chilkat.Rsa");

// Provide the RSA object with the certificate on the Yubkey.
$success = $rsa->SetX509Cert($cert,1);
if ($success == 0) {
    print $rsa->LastErrorText . "\n";
    exit;
}

// RSA encrypt using the public key.
$usePrivateKey = 0;
$success = $rsa->EncryptBd($bd,$usePrivateKey);
if ($success == 0) {
    print $rsa->LastErrorText . "\n";
    exit;
}

print 'RSA Encrypted Output in Hex:' . "\n";
print $bd->getEncoded('hex') . "\n";

// Now let's decrypt, using the private key on the Yubikey.
$usePrivateKey = 1;
$success = $rsa->DecryptBd($bd,$usePrivateKey);
if ($success == 0) {
    print $rsa->LastErrorText . "\n";
    exit;
}

print 'RSA Decrypted Output in Hex:' . "\n";
print $bd->getEncoded('hex') . "\n";

?>