RSA Decrypt

Category: Asymmetric & Elliptic Curve · Node Type ID: asymmetric-rsa-decrypt

Decrypts ciphertext using RSA-OAEP with private key (RFC 8017)

Overview

Decrypts an RSAES-OAEP ciphertext (PKCS#1 v2.2 / RFC 8017) using the recipient's RSA private key and the matching OAEP/MGF1 hash algorithm (SHA-256, SHA-512, or SHA-1).

Accepts the RSA private key in either binary DER format or UTF-8 encoded PEM bytes, verifies the OAEP padding structure and optional OAEP Label hash, and outputs the recovered plaintext.

When to Use

Unwrapping a symmetric session key or decrypting a message encrypted by RSA-OAEP Encrypt.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Hash Algorithm (OAEP & MGF1) `hash`	`select` Default: `SHA-256`	Always visible	Must match the Hash Algorithm (OAEP & MGF1) used during encryption (`SHA-256`, `SHA-512`, or `SHA-1`). `SHA-256`: SHA-256 (Standard) `SHA-512`: SHA-512 (High Security) `SHA-384`: SHA-384 `SHA-1`: SHA-1 (Legacy)

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (3 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Private Key`	`privateKey`	`Any` (PEM/DER)	Required	Always visible	Recipient RSA private key (accepts binary DER `Bytes` or UTF-8 PEM `Bytes`).
`Ciphertext Data`	`ciphertext`	`Bytes`	Required	Always visible	RSA-OAEP ciphertext bytes (`Uint8Array`) to decrypt.
`OAEP Label`	`label`	`Bytes`	Optional	Always visible	Optional OAEP label bytes (must match the label used during encryption; defaults to empty bytes if unconnected).

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Plaintext`	`plaintext`	`Bytes`	Always visible	Recovered plaintext byte array (`Uint8Array`).

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_FORMAT`	Invalid RSA key format	Raised when the RSA public or private key cannot be parsed as valid PEM or ASN.1 DER key material.
`RSA_DECRYPTION_FAILED`	RSA decryption failed (key or ciphertext mismatch)	Raised when RSA-OAEP decryption or padding verification fails due to a mismatched key, hash algorithm, label, or corrupted ciphertext.

Examples

Decrypting an RSA-OAEP Wrapped Key

Recover the 32-byte session key using the matching RSA private key.

Connect Private Key (DER) from RSA KeyGen to Private Key and the 256-byte Ciphertext from RSA-OAEP Encrypt to Ciphertext.
Ensure Hash Algorithm matches the encrypt node.