Problem encrypting a string with a public certificate

[StewartRyanSony]

Hello,

I've run into a problem trying to encrypt a short string (password) using a public certificate. The code I have works just fine in PowerShell 5.1 but throws errors when using PowerShell 7

Encrypt a string with the following Code

Function Encrypt-Asymmetric {
    [CmdletBinding()]
    [OutputType([System.String])]
    param(
        [Parameter(Position=0, Mandatory=$true)][ValidateNotNullOrEmpty()][System.String]
        $ClearText,
        [Parameter(Position=1, Mandatory=$true)][ValidateNotNullOrEmpty()][ValidateScript({Test-Path $_ -PathType Leaf})][System.String]
        $PublicCertFilePath
    )
    # Encrypts a string with a public key
    $PublicCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($PublicCertFilePath)
    $ByteArray = [System.Text.Encoding]::UTF8.GetBytes($ClearText)
    $EncryptedByteArray = $PublicCert.PublicKey.Key.Encrypt($ByteArray,$true)
    $EncryptedBase64String = [Convert]::ToBase64String($EncryptedByteArray)
    
    Return $EncryptedBase64String 
    }
    $ClearText = "ExampleP@ssw0rd"
    $PublicCertFilePath = "C:\certs\ExampleCert.crt"
    $EncryptedString = Encrypt-Asymmetric $ClearText $PublicCertFilePath
    

Expected behavior

The Variable $EncryptedString should contain a string representing the encrypted version of the clear text string provided

Scripts> $EncryptedString = Encrypt-Asymmetric $ClearText $PublicCertFilePath
Scripts> $EncryptedString
NkBujkyO1oEy/vV9QsHpCbpsixA9SBVTOfTi98c8fHDuqZ+HpY3wVtMm3CAH8izN0zbpVTu0EZkuo3kH/AMn3ymZ5ZkAeoAbobCIsZ9fKhxERsNU+rVroYDZ5mR6WX4ywPca621zWrdT8t/2L1DXrspKDU6skNqcffPw4escwmSsiengcbkbWIkZ+NlfbJPuPu0F6GUhYJZJLmmKRZkxJKYYga4qb3AROpxy3IyMp2v67ZR0GnpRsd1+46FKjoRi89yd3MKRlvLxl/XkHQ546/uF6mEUBKJ4bbnGdaiEvAvXjQLKiT3GXUdfAaANzYaxU5XUAX7cjVWcdFChByrV8g==
Scripts>

Actual behavior

I receive the following errors

Scripts> $EncryptedString = Encrypt-Asymmetric $ClearText $PublicCertFilePath
MethodException:
Line |
  13 |      $EncryptedByteArray = $PublicCert.PublicKey.Key.Encrypt($ByteArra …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot convert argument "padding", with value: "True", for "Encrypt" to type "System.Security.Cryptography.RSAEncryptionPadding": "Cannot convert value "True" to type "System.Security.Cryptography.RSAEncryptionPadding". Error: "Invalid cast from 'System.Boolean' to 'System.Security.Cryptography.RSAEncryptionPadding'.""
MethodInvocationException:
Line |
  14 |      $EncryptedBase64String = [Convert]::ToBase64String($EncryptedByte …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "ToBase64String" with "1" argument(s): "Value cannot be null. (Parameter 'inArray')"

Environment data

Name Value

---

PSVersion 7.0.0
PSEdition Core
GitCommitId 7.0.0
OS Microsoft Windows 10.0.17763
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

[iSazonov]

Run $PublicCert.PublicKey.Key.Encrypt and see available overloads.

[StewartRyanSony]

In PowerShell 5.1 I get the following

Scripts> $PublicCert.PublicKey.key.Encrypt

OverloadDefinitions
-------------------
byte[] Encrypt(byte[] rgb, bool fOAEP)
byte[] Encrypt(byte[] data, System.Security.Cryptography.RSAEncryptionPadding padding)

In PowerShell 7 I get

Scripts> $PublicCert.PublicKey.key.Encrypt

OverloadDefinitions
-------------------
byte[] Encrypt(byte[] data, System.Security.Cryptography.RSAEncryptionPadding padding)

Why should there be a difference in the overloads between the versions? Isn't this part of .net?

[vexx32]

Yeah, if there's an overload missing, it's almost certainly because it had to be removed during the transition to .NET Core and hasn't been added back yet / was deemed not worth the effort. You might need to check in with the .NET folks in the dotnet/runtime repo and see what they reckon. 🙂

[StewartRyanSony]

@iSazonov, @vexx32,

Thanks for the hints. So yes indeed , it seems that byte[] Encrypt(byte[] rgb, bool fOAEP) is not a valid overload in this version of .net core even though Microsoft's documentation says it's still available in all versions of .net.

There are virtually no examples of PowerShell code out there where anyone uses the byte[] Encrypt(byte[] data, System.Security.Cryptography.RSAEncryptionPadding padding) overload, so this really forced me to learn how all this stuff works and not just go off of code posted on the internet.

If anyone stumbles across this thread looking up the same error here's an example of what it should look like. Replace line 13 in my script above with this:

$EncryptedBytes = $Cert.PublicKey.Key.Encrypt($EncodedString, [System.Security.Cryptography.RSAEncryptionPadding]::OaepSHA256)

Thanks,
Ryan