Xbase++ Requires Chilkat v10.1.3+

Yubikey RSA Encrypt/Decrypt

See more RSA Examples

Demonstrates how to do RSA decryption using a private key stored on a Yubikey (or other USB token or smartcard).

Note: RSA encryption uses the public key, which is freely exportable and does not need to occur on the token/smartcard.

Xbase++

LOCAL nSuccess
LOCAL oBd
LOCAL oCert
LOCAL oRsa
LOCAL nUsePrivateKey

nSuccess := 0

//  This example assumes you have a certificate with private key on the Yubikey token.
//  When doing simple RSA encryption/decryption, we don't actually need the certificate,
//  but we'll be using the private key associated with the certificate.
//  
//  The sensitive/secret material that needs to be kept private is the private key.
//  The certificate itself and the public key can be freely shared.
//  

//  We're going to encrypt and decrypt 32-bytes of data.
oBd := CreateObject("Chilkat.BinData")
nSuccess := oBd:AppendEncoded("000102030405060708090A0B0C0D0E0F", "hex")
nSuccess := oBd:AppendEncoded("000102030405060708090A0B0C0D0E0F", "hex")

//  Let's get the desired cert.
//  For this example, a self-signed certificate with a 2048-bit RSA key was generated in slot 9A.
oCert := CreateObject("Chilkat.Cert")

//  Force Chilkat to use PKCS11 over ScMinidriver (if on Windows) and Apple Keychain (if on MacOS)
oCert:UncommonOptions := "NoScMinidriver,NoAppleKeychain"

oCert:SmartCardPin := "123456"

nSuccess := oCert:LoadFromSmartcard("cn=chilkat_test_2048")
IF (nSuccess == 0)
    ? oCert:LastErrorText
    oBd:destroy()
    oCert:destroy()
    RETURN
ENDIF

//  RSA encrypt using the public key.
oRsa := CreateObject("Chilkat.Rsa")

//  Provide the RSA object with the certificate on the Yubkey.
nSuccess := oRsa:SetX509Cert(oCert, 1)
IF (nSuccess == 0)
    ? oRsa:LastErrorText
    oBd:destroy()
    oCert:destroy()
    oRsa:destroy()
    RETURN
ENDIF

//  RSA encrypt using the public key.
nUsePrivateKey := 0
nSuccess := oRsa:EncryptBd(oBd, nUsePrivateKey)
IF (nSuccess == 0)
    ? oRsa:LastErrorText
    oBd:destroy()
    oCert:destroy()
    oRsa:destroy()
    RETURN
ENDIF

? "RSA Encrypted Output in Hex:"
? oBd:GetEncoded("hex")

//  Now let's decrypt, using the private key on the Yubikey.
nUsePrivateKey := 1
nSuccess := oRsa:DecryptBd(oBd, nUsePrivateKey)
IF (nSuccess == 0)
    ? oRsa:LastErrorText
    oBd:destroy()
    oCert:destroy()
    oRsa:destroy()
    RETURN
ENDIF

? "RSA Decrypted Output in Hex:"
? oBd:GetEncoded("hex")

oBd:destroy()
oCert:destroy()
oRsa:destroy()