RSA Cipher — Serbekun

back

~/serbekun/cipher $ rsa --interactive

key pair

public key (base64 x.509)

private key (base64 pkcs#8)

Keys are generated on the server and returned once — nothing is stored. Save the private key now: without it nothing encrypted for this public key can be read back.

Encrypts with the public key. A 2048-bit key with OAEP-SHA256 padding holds at most 190 bytes — for anything bigger use the hybrid tab.

plaintext input

ciphertext (base64)

Decrypts with the private key.

ciphertext input (base64)

plaintext

Signs with the private key using SHA256withRSA. The message is hashed first, so there is no size limit. A signature proves authorship — it does not hide the message.

message to sign

signature (base64)

Checks a signature against the message with the public key.

signed message

signature (base64)

For data of any size: a fresh AES-256-GCM key encrypts the payload and the public key wraps only that key. The result is an envelope holding both — keep them together, either half alone is useless.

plaintext input

envelope (json)

Unwraps the AES key with the private key, then decrypts the payload. Paste the envelope produced by the hybrid encrypt tab, or load it from a file.

envelope (json)

plaintext