RSA Encrypt

Category: Asymmetric & Elliptic Curve · Node Type ID: asymmetric-rsa-encrypt

Encrypts message using RSA-OAEP with recipient public key (RFC 8017)

Overview

Encrypts a short message or session key using RSAES-OAEP (Optimal Asymmetric Encryption Padding, PKCS#1 v2.2 / RFC 8017) with the recipient's RSA public key and the selected OAEP/MGF1 hash algorithm (SHA-256, SHA-512, or SHA-1).

The Public Key port accepts either binary DER bytes or UTF-8 encoded PEM text bytes seamlessly. Because RSA-OAEP adds randomized padding of $2 \times hLen + 2$ bytes, the maximum plaintext length for a $k$-byte RSA modulus is $k - 2 \times hLen - 2$ bytes (for example, up to $256 - 66 = 190$ bytes with a 2048-bit key and SHA-256).

When to Use

Wrapping a symmetric session key (such as a 32-byte AES key) or encrypting a short secret payload for a recipient's RSA public key.
Pairing with RSA-OAEP Decrypt in hybrid encryption workflows.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Hash Algorithm (OAEP & MGF1) `hash`	`select` Default: `SHA-256`	Always visible	Cryptographic hash function used for both the OAEP label hash and MGF1 mask generation (`SHA-256`, `SHA-512`, or `SHA-1`). `SHA-256`: SHA-256 (Standard) `SHA-512`: SHA-512 (High Security) `SHA-384`: SHA-384 `SHA-1`: SHA-1 (Legacy)

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (3 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Public Key`	`publicKey`	`Any` (PEM/DER)	Required	Always visible	Recipient RSA public key (accepts binary DER `Bytes` or UTF-8 PEM `Bytes`).
`Plaintext Data`	`plaintext`	`Bytes`	Required	Always visible	Plaintext message or session key bytes (`Uint8Array`) to encrypt.
`OAEP Label`	`label`	`Bytes`	Optional	Always visible	Optional OAEP label parameter (`Uint8Array`; defaults to empty bytes if unconnected).

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Ciphertext`	`ciphertext`	`Bytes`	Always visible	Encrypted RSA-OAEP ciphertext (`Uint8Array`, byte length equal to the RSA modulus size $k$).

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_FORMAT`	Invalid RSA key format	Raised when the RSA public or private key cannot be parsed as valid PEM or ASN.1 DER key material.
`OAEP_MESSAGE_TOO_LONG`	Message is too long for OAEP	Raised when the input message exceeds the maximum RSA-OAEP payload capacity ($k - 2 \times hLen - 2$ bytes) for the target modulus size.

Examples

Wrapping a 32-Byte AES Session Key with RSA-OAEP

Encrypt a random 32-byte symmetric key using a 2048-bit RSA public key.

Connect Public Key (DER) from RSA KeyGen to Public Key.
Connect a 32-byte Random Generator to Plaintext; Ciphertext outputs the 256-byte wrapped key.