Private/Crypto/Unprotect-PukAesKeyWithCertificate.ps1
|
function Unprotect-PukAesKeyWithCertificate { [CmdletBinding()] [OutputType([byte[]])] param( [Parameter(Mandatory)] [byte[]]$WrappedKey, [Parameter(Mandatory)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) $privateKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($Certificate) if (-not $privateKey) { throw "Certificate '$($Certificate.Thumbprint)' does not have an accessible RSA private key for AES key unwrapping." } return $privateKey.Decrypt($WrappedKey, [System.Security.Cryptography.RSAEncryptionPadding]::OaepSHA256) } |