Private/Crypto/Protect-PukAesKeyWithCertificate.ps1
|
function Protect-PukAesKeyWithCertificate { [CmdletBinding()] [OutputType([byte[]])] param( [Parameter(Mandatory)] [byte[]]$Key, [Parameter(Mandatory)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) $publicKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($Certificate) if (-not $publicKey) { throw "Certificate '$($Certificate.Thumbprint)' does not have an RSA public key usable for AES key wrapping." } return $publicKey.Encrypt($Key, [System.Security.Cryptography.RSAEncryptionPadding]::OaepSHA256) } |