Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove public key requirement to decrypt #378

Merged
merged 3 commits into from
May 10, 2024
Merged

Remove public key requirement to decrypt #378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
760fd05
Remove public key requirement to decrypt
cmd-ntrf May 6, 2024
2f60a4a
Copy recipient info issuer in x509 when decrypting
cmd-ntrf May 9, 2024
d5f0fb8
Update README - decryption section
cmd-ntrf May 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,9 +143,9 @@ Use the -l parameter to pass in a label for the encrypted value,

### Decryption

To decrypt something, you need the public_key and the private_key.
To decrypt something, you need the private_key.

To test decryption you can also use the eyaml tool if you have both keys
To test decryption you can use the eyaml tool

$ eyaml decrypt -f filename # Decrypt a file
$ eyaml decrypt -s 'ENC[PKCS7,.....]' # Decrypt a string
Expand Down
9 changes: 6 additions & 3 deletions lib/hiera/backend/eyaml/encryptors/pkcs7.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,10 +51,13 @@ def self.decrypt(ciphertext)
private_key_pem = load_private_key_pem
private_key_rsa = OpenSSL::PKey::RSA.new(private_key_pem)

public_key_pem = load_public_key_pem
public_key_x509 = OpenSSL::X509::Certificate.new(public_key_pem)

pkcs7 = OpenSSL::PKCS7.new(ciphertext)

public_key_x509 = OpenSSL::X509::Certificate.new
public_key_x509.serial = pkcs7.recipients[0].serial
public_key_x509.issuer = pkcs7.recipients[0].issuer
public_key_x509.public_key = private_key_rsa.public_key

pkcs7.decrypt(private_key_rsa, public_key_x509)
end

Expand Down