Help/Feature Request: how to decode pkcs7 encoded string (hiera eyaml)

[schlitzered]

hi,

i am trying to read hiera yaml files that contain encrypted values.

the tool that is used to create these files is written in ruby (https://github.com/voxpupuli/hiera-eyaml) and seems to be using a openssl binding under the hood.

the relevant encoding/decoding part seems to start here: https://github.com/voxpupuli/hiera-eyaml/blob/master/lib/hiera/backend/eyaml/encryptors/pkcs7.rb#L37

reading the yaml files is not the issues, but i am not sure how i would decrypt the encrypted string.

is there a way to do this using this library?

here is an dummy private & public key, and example data, that has been encrypted using this keypair

private.key

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEArXpD1evqOMDrFcocsbGfe3rxVTRswhEqs0jjewA3ZnuHeE5C
kIzgT/JdflnKZyYzlJ0VQhcvXfVKxjsgPccpWEvm8JXIiMHm/m3IG0ZkaSPnimKf
UEuN9HqJUBH8jYN6lyj460DBVDYRWRi31GdoOilduchqHnqMsnHyD6e6qri27S0L
MnfuEimlUj7zGjCJZU1Xf3056fk2HKnwsO3Kk2D0lTGrCaAYAhmcDsVd9MNbH8I7
QRvo42s0WEKqLpXtefMEOs5fn76VifqshISb/PSOUA2251REQhPMGaz4XHgyopH1
a6yo+DQZlpedWLqZqfjO8FrESlxBigMaEGUF8wIDAQABAoIBABgVedZ4pq9TZS/E
vAAVa1E+y8NrAFBfBsEWNPKuIILbUn7qyoX78OZYfQ9eEuIIJTAUMM/YnSxbshJc
QgkhncVS4FB1Uv5dgR7Aif/zYVxRbkNBluGUY7RV0Ltri9bvsnTK7OfoOQ7iZL0s
V9UmuAsfFBKHVug9Vkwt0o/G1vz9Zel059l2R/UENmEnXD0XF5rDxj0aR7deBSoh
31jws+MrIWzmScBTqdBeop+WMIprj3TA/RrTcMI22tbGqMHt+lpqQp+k94vakHBg
/dPH1NgkvgKis69n3cYHGpAanYFiaWPPVND+EsS90+jOKwopFWN4BD+g+0m233+D
NP5PFW0CgYEAuEpHucpvZLT4KwPvC2VTl8mBcJVRuSC4GMCX4cWConHfdZrZ5coN
ahLoyJlv/knk3tWmXF5xUwHmm9JL9W2a/nzmN8fdT69dQyxIHAkEoxLOEyBQjp86
v1Q+PVxQmQHjmAQckua8FSILkCGhP2hMwRFruRwp/MK5xVsIPD7sb6cCgYEA8Prp
cgjNOiMoLntWffiM2QVz1aumbChu+e52t5ptHforph1sTk/lAL04wr0vcS3pee5m
RH3WgRHTPF9f4R9iuJ4g2ETdliCEw/gABLTocI1BVUpAZ7ZdffREUHtY+pxvsfro
q63eDmsf1qji2DYQP6T2RHmgcQTEbQHQqVt24NUCgYEAtawUNSVI1sBH/S+tkVBc
Lb/pqHCq1ZNZqJ0DnP+2HimfnjH/KDYdLzpg3I/WBZoW001O6LP5h1jSWz3ev51D
NCkwUkDm/MzlZXjbxTdmqNO67sPmZhK2OTL1AExm788a7BrxiCeJtlOPjpB4gydw
sstXpG4NPi1AMTviTHHDZvUCgYEAlo0rq4K0NM4iHGgR8UGHPU6av7MtlgTs0Fia
8roX0dKp0m4va/2eJIgTHhbzvNHiO7slSUUU7i4kumMbk5n4Iz8nZfYgOdq3F3ep
C0e6sBaP6qko86KLZlVlGKL3RBrX7WnEUv2c7YUfrwx0LIAaRqjY8o7KHdHMpg2s
PyJVcsECgYBlAf9AuDewvpO/zcf8eG+Gn7cW4PtPwStHxg1jQMoTaMfQCTvxIY7N
cpGIO8Bl0MmZQYc0viOeDn7BNR/TC3uL8fEJ89UyR+RqJjJHUC9J8CMeDqW91N96
sB9GTxjsQkWxOTtiLMbz3wyF+zD+WrK67LsFk7FOw//rL4UuaKKIZg==
-----END RSA PRIVATE KEY-----

public.key

-----BEGIN CERTIFICATE-----
MIIC2TCCAcGgAwIBAgIBATANBgkqhkiG9w0BAQsFADAAMCAXDTI0MDMyNjE2MjYw
OFoYDzIwNzQwMzE0MTYyNjA4WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEArXpD1evqOMDrFcocsbGfe3rxVTRswhEqs0jjewA3ZnuHeE5CkIzgT/Jd
flnKZyYzlJ0VQhcvXfVKxjsgPccpWEvm8JXIiMHm/m3IG0ZkaSPnimKfUEuN9HqJ
UBH8jYN6lyj460DBVDYRWRi31GdoOilduchqHnqMsnHyD6e6qri27S0LMnfuEiml
Uj7zGjCJZU1Xf3056fk2HKnwsO3Kk2D0lTGrCaAYAhmcDsVd9MNbH8I7QRvo42s0
WEKqLpXtefMEOs5fn76VifqshISb/PSOUA2251REQhPMGaz4XHgyopH1a6yo+DQZ
lpedWLqZqfjO8FrESlxBigMaEGUF8wIDAQABo1wwWjAPBgNVHRMBAf8EBTADAQH/
MB0GA1UdDgQWBBSFO32sY4w2X9NimDTUQMv3xxB+szAoBgNVHSMEITAfgBSFO32s
Y4w2X9NimDTUQMv3xxB+s6EEpAIwAIIBATANBgkqhkiG9w0BAQsFAAOCAQEAHXNu
eqPxJOCqjIeQuVK+gpURXx8uElIZjq/Kat8vzgFUVwYqgeoxdnFEMHGECNxsH/Y6
kyKbh64gU4/dKoDCUq51OprivPs899LQycpDn1W+YPZ+mucZdTychwi2hozIAm1J
xun8tWGGPcsZBDS4C5aoUskBoxJWWAgCdGX/s/p7GiZVHzKWKxN5WB6KtEiP/8tL
xC2sryiwiif37quWN8Av5Tz0Js+lTgp16b3qzAMloqMxKAyAibHNxMobHedocPpR
ouOoZbRYQozyl/KBa3U18JkPEYb0ea7Sz48WIBzy1XeZl//bj1oeQg/XyTgmh/5c
baLgI3ywAN08/4nTug==
-----END CERTIFICATE-----

exampledata.yaml

# decrypted value: TestTestTest
encrypted_key: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAhyinFVRAAJsrnv8mGT+UzwZ/+Z4PjihpYgmRVvsBcCLr90bcnU2FbPCJtTXa5pzpnhF1L9lLTjxfpCOG8B6liudVSnIdtcY5Cx3bg5DMDYeBlmtEaXd3+7K/Y23usmTG3/RPMwglVuAa8Qzt7D1lUSf1PB7ohxNbbyx+rjzP/FU3uCNHaeHQKU1Dt8BkyqDb6WAoapwTBwtgUJpEOHpx6wElcZ4q6j0hewqiduTwmdymCGVRu6bt+irClWve5FC7nUAjqb/tmDtJF1lS93t96OeRKUZTwSY4br+aTlbiBIgv+Q1TgyF3KqEl6AaLB2zWFiOEoCL1CJAVeC6cSrqQgTA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCF3brRQ0HxiYVsiz91R/gugBD6nNi0PqyaBtDfGvWwzMFH]

[reaperhulk]

We don't currently support PKCS7 encryption/decryption, which is what is being used here.

[schlitzered]

thanks, any chance that PKCS7 can be supported? it seems like no python crypto library currently supports this out of the box:-/

[reaperhulk]

It’s not impossible but no one has stepped up to design the API or do the implementation work.