Lua Requires Chilkat v10.1.2+

RSA Decrypt using Private Key on Smartcard or USB Token via Apple Keychain

See more Apple Keychain Examples

RSA decryption using a certificate's private key located on a hardware token or smartcard via the Apple Keychain. Lua

local chilkat = require("chilkat")

-- Beforehand, we generated a 256-bit AES key, RSA encrypted, and saved to a file as in this example:
-- Generate a Random 256-bit AES Key and RSA Encrypt

-- The RSA public key used to encrypt in the above example was obtained from the Apple Keychain
-- like this:
-- Export a Public Key from USB Token or Smartcard using the Apple Keychain

-- This example will load the encrypted data and will RSA decrypt using the
-- private key of a certificate on a USB token (or smart card) via the Keychain.
-- You can list the Keychain certificates on hardware tokens using the following example:
-- Apple Keychain - List Certs on Smartcards and USB Tokens

-- Get the RSA encrypted data to be decrypted.
local bd = chilkat.BinData.new()
-- In all Chilkat methods expecting a path, you can pass either absolute or relative paths.
local success = bd:load_file("rsaEncrypted/myAes.key")
if not success then
    print("Failed to load the encrypted AES key.")
    return
end

-- Load the certificate having the private key from the Apple Keychain
-- On MacOS and iOS, the LoadByCommonName function will search the Apple Keychain for the matching certificate.
local cert = chilkat.Cert.new()

-- To potentially prevent the PIN dialog from being displayed,
-- we'll need to provide the USB token (or smart card) PIN
-- Note: It might not be possible to prevent the PIN dialog from being displayed
--
cert.smart_card_pin = "123456"

success = cert:load_by_common_name("Test 2048 bit RSA")
if not success then
    print(cert.last_error_text)
    return
end

local rsa = chilkat.Rsa.new()

-- Specify we wish to use the certificate's private key for decryption.
success = rsa:set_x509_cert(cert, true)
if not success then
    print(rsa.last_error_text)
    return
end

-- RSA Decrypt
rsa.verbose_logging = true
success = rsa:decrypt_bd(bd, true)
if not success then
    print(rsa.last_error_text)
    return
end

-- The contents of bd are now decrypted.
print("Num bytes after decryption: " .. bd.num_bytes)

-- Some additional notes:
--
-- If using a Yubikey token, the certificate must be installed in the Key Management slot.
-- The Digital Signature slot is for RSA keys to be used for signing,
-- and the Key Management slot is for RSA keys to be used for decrypting.
-- 

-- If you try to use the RSA key from the Digital Signature slot, you'll get an error such as this:

-- The operation couldn't be completed.
-- (OSStatus error -50 - algid:encrypt:RSA:PKCS1: algorithm not supported by the key
-- <SecKeyRef:('com.apple.pivtoken:AF7172EB60DDCBF1D28459AE24398E11') 0x600001ecca90>)