Unable to Unwrap AES Key Using RSA Private Key with KMF API

[OmkarC]

Hi Community,

I am trying to unwrap an AES key that was wrapped using an RSA public key, and I want to unwrap it in ServiceNow using the corresponding RSA private key via the KMF (Key Management Framework) API.

I attempted the following approach using KMFCryptoOperation, but I keep running into different errors (depending on the configuration), and I’m not able to successfully retrieve the unwrapped AES key.

var unwrapOp = new sn_kmf_ns.KMFCryptoOperation(
    cryptoModuleName,
    "ASYMMETRIC_UNWRAPPING"
)
    .withAlgorithm("RSA")
    .withInputFormat("BASE64")
    .withOutputFormat("BASE64");

var unwrappedKeyBase64 = unwrapOp.doOperation(encryptedData);

I want to unwrap (decrypt) the AES key using the KMF API and then need to use this AES key for decrypting the actual encrypted data. But I’m unsure if ASYMMETRIC_UNWRAPPING is the correct operation for this use case

Has anyone successfully implemented RSA-based key unwrapping in ServiceNow using the KMF API?
Any guidance, working examples, or best practices would be greatly appreciated.

Thanks in advance for your help!

Regards,
Omkar

[Tanushree Maiti]

Hi @OmkarC 

Try the sample code available in SN doc:

https://www.servicenow.com/docs/r/zurich/api-reference/server-api-reference/KMFCryptoOperationBothAP...

[OmkarC]

Hi  @Tanushree Maiti ,

First of all, thank you for sharing the documentation link. However, I could not find the exact sample code for the ASYMMETRIC_UNWRAPPING operation that I was looking for.

Could you please share sample code if you have any or any other documentation link?

Regards,
Omkar

[Tanushree Maiti]

Hi @OmkarC 

Could you check these resources:

KMFCryptoOperation - Scoped, Global 

KB1745905 How to replace usage of GlideEncrypter in Legacy Workflow/Orchestration   ( here example with Symmetric wrapping, you can replace it using assymmetric)

[stevemac]

@OmkarC 

Having issues in this space as well.  I have not got it working, but with the sn_kmf_ns.KMFCryptoOperation and the input formats - is BASE64 valid?  I thought the options are:

• FORMATTED: Formatted to the Key Management Framework (KMF) specifications.
• KMFBASE64: Base64 encoded.
• KMF_GLIDE_ENCRYPTER_FORMATTED: Support decryptions of both KMF encrypted values and GlideEncrypter encrypted values.
• KMFNONE: No encoding.

in my case - I am encoding to base64 in PowerShell and the encoding is not compatible with KMFBASE64