> For the complete documentation index, see [llms.txt](https://docs.digibee.com/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.digibee.com/documentation/connectors-and-triggers/connectors/security/rsa-cryptography.md).

# RSA Cryptography

The **RSA Cryptography** connector encrypts and decrypts based on the RSA algorithm.

## **Parameters**

Configure the connector using the parameters below. Fields that support [Double Braces expressions](/documentation/connectors-and-triggers/double-braces/overview.md) are marked in the **Supports DB** column.

{% tabs %}
{% tab title="General" %}

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="112">Parameter</th><th width="231">Description</th><th width="83">Data type</th><th width="81">Supports DB</th><th width="100">Default value</th><th width="135">Visible when</th></tr></thead><tbody><tr><td><strong>Use Dynamic Account</strong></td><td>If enabled, the connector uses the account dynamically via the <a href="/pages/0kxlZ011XP4A2T43v9kh"><strong>Store Account</strong></a> connector; otherwise, it uses the account statically as configured in <a href="/spaces/jvO5S91EQURCEhbZOuuZ/pages/fS1QLzAg8rGSSJFwtrvy"><strong>Accounts</strong></a> on the Platform.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td>—</td></tr><tr><td><strong>Scoped</strong></td><td>If enabled, isolates the stored account from other sub-processes. Not supported for accounts used in headers or body. To learn more, read the <a href="/spaces/jvO5S91EQURCEhbZOuuZ/pages/cbkYqH3fxzeL7zOKNawz">Dynamic Accounts documentation</a>.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td><strong>Use Dynamic Account</strong> is enabled</td></tr><tr><td><strong>Account Name</strong></td><td>Name of the account defined in the <a href="/pages/0kxlZ011XP4A2T43v9kh"><strong>Store Account</strong></a> connector.</td><td>String</td><td>✅</td><td>N/A</td><td><strong>Use Dynamic Account</strong> is enabled</td></tr><tr><td><strong>Account</strong></td><td>Account to be used by the connector. Encrypt and wrap operations require a <strong>Public Key</strong> account; decrypt and unwrap operations require a <strong>Private Key</strong> account. Encrypt operations also support providing the key directly in the message body. Account configuration is done in <a href="/spaces/jvO5S91EQURCEhbZOuuZ/pages/fS1QLzAg8rGSSJFwtrvy"><strong>Accounts</strong></a> on the Platform.</td><td>String</td><td>❌</td><td>N/A</td><td><strong>Use Dynamic Account</strong> is disabled</td></tr><tr><td><strong>Crypto Operation</strong></td><td>Defines the type of operation to be performed: <strong>Encrypt Fields</strong>, <strong>Decrypt Fields</strong>, <strong>Encrypt Payload</strong>, <strong>Decrypt Payload</strong>, <strong>Unwrap Key</strong>, or <strong>Wrap Key</strong>.</td><td>String</td><td>❌</td><td><code>Encrypt Fields</code></td><td>—</td></tr><tr><td><strong>Fields To Encrypt/Decrypt</strong></td><td>Fields to be encrypted or decrypted, specified using dotted notation (e.g., <code>body.field1</code>, <code>body.field2</code>, <code>body</code>).</td><td>String</td><td>❌</td><td><code>a.test</code></td><td><strong>Crypto Operation</strong> is <strong>Encrypt Fields</strong> or <strong>Decrypt Fields</strong></td></tr><tr><td><strong>Payload To Encrypt/Decrypt</strong></td><td>Payload to be encrypted or decrypted, specified using dotted notation.</td><td>String</td><td>❌</td><td>N/A</td><td><strong>Crypto Operation</strong> is <strong>Encrypt Payload</strong> or <strong>Decrypt Payload</strong></td></tr><tr><td><strong>Secret Key</strong></td><td>Secret key to be wrapped or unwrapped, specified using dotted notation.</td><td>String</td><td>❌</td><td>N/A</td><td><strong>Crypto Operation</strong> is <strong>Wrap Key</strong> or <strong>Unwrap Key</strong></td></tr><tr><td><strong>Operation Mode</strong></td><td>Operation mode to be used for the cryptographic operation.</td><td>String</td><td>❌</td><td><code>ECB</code></td><td><strong>Crypto Operation</strong> is <strong>Encrypt Fields</strong>, <strong>Decrypt Fields</strong>, <strong>Encrypt Payload</strong>, or <strong>Decrypt Payload</strong></td></tr><tr><td><strong>Padding</strong></td><td>Padding scheme used in block cipher operations to fill blocks with padding bytes (e.g., AES 128-bit uses 16 padding bytes).</td><td>String</td><td>❌</td><td><code>OAEPWithSHA-512AndMGF1Padding</code></td><td>—</td></tr><tr><td><strong>Charset</strong></td><td>Character encoding of the provided key when the key type is string.</td><td>String</td><td>❌</td><td><code>UTF-8</code></td><td>—</td></tr><tr><td><strong>Encrypted Message As Hexa</strong></td><td>If enabled, returns the secret key response in hexadecimal format; otherwise, it is returned in Base64 format.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td>—</td></tr><tr><td><strong>Fail On Error</strong></td><td>If enabled, interrupts pipeline execution when an error occurs. Otherwise, execution proceeds and the result returns <code>false</code> for the <code>"success"</code> property.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td>—</td></tr></tbody></table>

{% endtab %}

{% tab title="Documentation" %}

| Parameter         | Description                                                                             | Type   | Supports DB | Default |
| ----------------- | --------------------------------------------------------------------------------------- | ------ | ----------- | ------- |
| **Documentation** | Optional field to describe the connector configuration and any relevant business rules. | String | ❌           | N/A     |
| {% endtab %}      |                                                                                         |        |             |         |
| {% endtabs %}     |                                                                                         |        |             |         |

## **Parameters additional information**

### **Wrap and Unwrap Key**

Wrap and unwrap operations differ slightly from standard encrypt and decrypt operations. When you **wrap a key**, you not only encrypt it but also add integrity protection to ensure the key has not been tampered with. Similarly, when you **unwrap a key**, you decrypt it while simultaneously validating its integrity.

In the RSA Cryptography connector, these operations are designed to securely encapsulate a session (or secret) key for transfer through other Digibee connectors, ensuring both confidentiality and integrity.

Since these are experimental features, only one specific configuration is currently supported.

#### **For the Wrap Key Crypto Operation**

In the **Account** field, select a public key from an RSA 2048-bit key pair.

In the **Secret Key** field, specify a 256-bit AES key from the input payload. Use dotted notation to reference the corresponding key field.

Values are encrypted in hexadecimal format.

The RSA wrapping operation is performed with the following parameters:

* **Operation Mode**: ECB
* **Padding Scheme**: OAEPWithSHA-256AndMGF1Padding

#### **For the Unwrap Key Crypto Operation**

In the **Account** field, select a private key from an RSA 2048-bit key pair.

In the **Secret Key** field, specify a 256-bit AES key from the input payload. Use dotted notation to reference the corresponding key field.

Values are encrypted in hexadecimal format.

The RSA unwrapping operation is performed with the following parameters:

* **Operation Mode**: ECB
* **Padding Scheme**: OAEPWithSHA-256AndMGF1Padding

## **Messages flow**

### **Operation: Encrypt Fields**

#### **Input**

```json
{
    "operation": "encrypt_fields",
    "operationMode": "ECB",
    "padding": "OAEPWithSHA1AndMGF1Padding",
    "encryptedFields": "data,data1",
    "failOnError": true,
    "key": "PoeK/VBTcUyRHFkmWYjckbhsRLnZur6S83lKZ78V51EL3KlDNnPJZkdz+m7joRfOxFuEqU=" // Provide the Key parameter if the Account is not configured
}
```

#### **Payload**

```json
{
    "data": someData,
    "data1": someData1
}
```

#### **Output**

```json
{
    "data": "RXZlbiBpZiBwZXJmZWN0IGNyeXB0b2dyYXBoaWMgcm91dGluZXMgYXJlIH=",
    "data1": "RXZlbiBpZifd441mZWN0IGNyeXB0b2dyYXBoaWMgcm91dGluZXMgYXJlIH="
}
```

### **Operation: Decrypt Fields**

#### **Input**

```json
{
    "operation": "decrypt_fields",
    "operationMode": "ECB",
    "padding": "OAEPWithSHA1AndMGF1Padding",
    "encryptedFields": "data,data1",
    "failOnError": true
}
```

#### **Payload**

```json
{
    "data": "RXZlbiBpZiBwZXJmZWN0IGNyeXB0b2dyYXBoaWMgcm91dGluZXMgYXJlIH=",
    "data1": "RXZlbiBpZifd441mZWN0IGNyeXB0b2dyYXBoaWMgcm91dGluZXMgYXJlIH="
}
```

#### **Output**

```json
{
    "data": someData,
    "data1": someData1
}
```

### **Operation: Wrap Key**

#### **Payload**

```json
{
  "encryptedData": {
    "key": "D379C385D6234349046ABCFD42160E5B461E852A63F53B8FDA3B6ED044332E34"
  }
}
```

#### **Output**

```json
{
  "encryptedData": {
    "key": "1e9fbbe9f77020cd05318d71ae242c68ab62981cc40b0e88c42ad89bb24807e46c6589edbb81bc7271c3824d60c2fa754651325eb2510a7cd82125f4ca9356b0b48d2dea8e8348f68173eabecb096a4c41a4a852ec2fb7cd9b0381d080e9d1e09a0bb614d3bbf550e52fe4583a5fdd47623e13256c69ee434b6c44d2e90de89804f0e0ff1c83f25adeef9ae89e657b79d8270511b9be5ce56a8955b2c8c5356c9639e6556c12c208a58e2d30e554a51d3a45317de54ab7380482f2d9f6d70c0223594b39c1c2f6f1d28301cb128167946082085c6dbf89825b6fc41929380305d4a5009d85c97d3d08f9672e66e71188b02eb23dffcb40271f1bb7b4d2f4fd5b"
  }
}
```

### **Operation: Unwrap Key**

#### **Payload**

```json
{
  "encryptedData": {
    "key": "1e9fbbe9f77020cd05318d71ae242c68ab62981cc40b0e88c42ad89bb24807e46c6589edbb81bc7271c3824d60c2fa754651325eb2510a7cd82125f4ca9356b0b48d2dea8e8348f68173eabecb096a4c41a4a852ec2fb7cd9b0381d080e9d1e09a0bb614d3bbf550e52fe4583a5fdd47623e13256c69ee434b6c44d2e90de89804f0e0ff1c83f25adeef9ae89e657b79d8270511b9be5ce56a8955b2c8c5356c9639e6556c12c208a58e2d30e554a51d3a45317de54ab7380482f2d9f6d70c0223594b39c1c2f6f1d28301cb128167946082085c6dbf89825b6fc41929380305d4a5009d85c97d3d08f9672e66e71188b02eb23dffcb40271f1bb7b4d2f4fd5b"
  }
}
```

#### **Output**

```json
{
  "encryptedData": {
    "key": "D379C385D6234349046ABCFD42160E5B461E852A63F53B8FDA3B6ED044332E34"
  }
}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.digibee.com/documentation/connectors-and-triggers/connectors/security/rsa-cryptography.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.