Represents the error type of the module.


Error

NONE

string

OAEPwithMD5andMGF1

OAEPWithSHA1AndMGF1

The `OAEPWithSHA256AndMGF1` padding mode.


OAEPWithSHA256AndMGF1

The `OAEPwithSHA384andMGF1` padding mode.


OAEPwithSHA384andMGF1

The `OAEPwithSHA512andMGF1` padding mode.


OAEPwithSHA512andMGF1

PKCS1

PKCS5

## Overview

This module provides common cryptographic mechanisms based on different algorithms.

The Ballerina `crypto` module facilitates APIs to do operations like hashing, HMAC generation, checksum generation, encryption, decryption, signing data digitally, verifying digitally signed data, etc., with different cryptographic algorithms.

### Hashes

The `crypto` module supports generating hashes with 5 different hash algorithms MD5, SHA1, SHA256, SHA384, and SHA512. Also, it supports generating the CRC32B checksum.

### HMAC

The `crypto` module supports generating HMAC with 5 different hash algorithms: MD5, SHA1, SHA256, SHA384, and SHA512.

### Decode Private/Public Key

The `crypto` module supports decoding the RSA private key from a `.p12` file and a key file in the `PEM` format. Also, it supports decoding a public key from a `.p12` file and a certificate file in the `X509` format. Additionally, this supports building an RSA public key with the modulus and exponent parameters.

### Encrypt and Decrypt

The `crypto` module supports both symmetric key encryption/decryption and asymmetric key encryption/decryption. The RSA algorithm can be used for symmetric-key encryption/decryption with the use of private and public keys. The AES algorithm can be used for asymmetric-key encryption/decryption with the use of a shared key.

### Sign and Verify

The `crypto` module supports signing data using the RSA private key and verification of the signature using the RSA public key. This supports MD5, SHA1, SHA256, SHA384, and SHA512 digesting algorithms as well.


Builds the RSA public key from the given modulus and exponent parameters.
```ballerina
string modulus = "luZFdW1ynitztkWLC6xKegbRWxky...";
string exponent = "AQAB";
crypto:PublicKey publicKey = check crypto:buildRsaPublicKey(modulus, exponent);
```



buildRsaPublicKey

Modulus value ('n' parameter) for the RSA public key


modulus

Exponent value ('e' paramenter) for the RSA public key


exponent

Reference to the public key or else a `crypto:Error` if the modulus or exponent is invalid


PublicKey

Returns the Hex-encoded CRC32B value for the given data.
```ballerina
string stringData = "Hello Ballerina";
byte[] data = stringData.toBytes();
string checksum = crypto:crc32b(data);
```



crc32b

input

byte

Decodes the RSA private key from the given private key and private key password.
```ballerina
string keyFile = "/path/to/private.key";
crypto:PrivateKey privateKey = check crypto:decodeRsaPrivateKeyFromKeyFile(keyFile, "keyPassword");
```



decodeRsaPrivateKeyFromKeyFile

keyFile

Password of the key file if it is encrypted


keyPassword

Reference to the private key or else a `crypto:Error` if the private key was unreadable


PrivateKey

Decodes the RSA private key from the given PKCS#12 archive file.
```ballerina
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodeRsaPrivateKeyFromKeyStore(keyStore, "keyAlias", "keyPassword");
```



decodeRsaPrivateKeyFromKeyStore

keyStore

KeyStore

keyAlias

Decodes the RSA public key from the given public certificate file.
```ballerina
string certFile = "/path/to/public.cert";
crypto:PublicKey publicKey = check crypto:decodeRsaPublicKeyFromCertFile(certFile);
```



decodeRsaPublicKeyFromCertFile

certFile

Reference to the public key or else a `crypto:Error` if the public key was unreadable


Decodes the RSA public key from the given PKCS#12 archive file.
```ballerina
crypto:TrustStore trustStore = {
    path: "/path/tp/truststore.p12",
    password: "truststorePassword"
};
crypto:PublicKey publicKey = check crypto:decodeRsaPublicKeyFromTrustStore(trustStore, "keyAlias");
```



decodeRsaPublicKeyFromTrustStore

trustStore

TrustStore

Returns the AES-CBC-decrypted value for the given AES-CBC-encrypted data.
```ballerina
string dataString = "Hello Ballerina!";
byte[] data = dataString.toBytes();
byte[16] key = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    key[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[16] initialVector = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    initialVector[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[] cipherText = check crypto:encryptAesCbc(data, key, initialVector);
byte[] plainText = check crypto:decryptAesCbc(cipherText, key, initialVector);
```



decryptAesCbc

padding

AesPadding

Decrypted data or else a `crypto:Error` if the key is invalid


Returns the AES-ECB-decrypted value for the given AES-ECB-encrypted data.
```ballerina
string dataString = "Hello Ballerina!";
byte[] data = dataString.toBytes();
byte[16] key = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    key[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[] cipherText = check crypto:encryptAesEcb(data, key);
byte[] plainText = check crypto:decryptAesEcb(cipherText, key);
```



decryptAesEcb

Returns the AES-GCM-decrypted value for the given AES-GCM-encrypted data.
```ballerina
string dataString = "Hello Ballerina!";
byte[] data = dataString.toBytes();
byte[16] key = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    key[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[16] initialVector = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    initialVector[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[] cipherText = check crypto:encryptAesGcm(data, key, initialVector);
byte[] plainText = check crypto:decryptAesGcm(cipherText, key, initialVector);
```



decryptAesGcm

tagSize

Returns the RSA-decrypted value for the given RSA-encrypted data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PublicKey publicKey = check crypto:decodePublicKey(keyStore, "keyAlias");
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] cipherText = check crypto:encryptRsaEcb(data, publicKey);
byte[] plainText = check crypto:decryptRsaEcb(cipherText, privateKey);
```



decryptRsaEcb

Private or public key used for encryption


RsaPadding

Returns the AES-CBC-encrypted value for the given data.
```ballerina
string dataString = "Hello Ballerina!";
byte[] data = dataString.toBytes();
byte[16] key = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    key[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[16] initialVector = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    initialVector[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[] cipherText = check crypto:encryptAesCbc(data, key, initialVector);
```



encryptAesCbc

Encrypted data or else a `crypto:Error` if the key is invalid


Returns the AES-ECB-encrypted value for the given data.
```ballerina
string dataString = "Hello Ballerina!";
byte[] data = dataString.toBytes();
byte[16] key = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    key[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[] cipherText = check crypto:encryptAesEcb(data, key);
```



encryptAesEcb

Returns the AES-GCM-encrypted value for the given data.
```ballerina
string dataString = "Hello Ballerina!";
byte[] data = dataString.toBytes();
byte[16] key = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    key[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[16] initialVector = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
foreach int i in 0...15 {
    initialVector[i] = <byte>(check random:createIntInRange(0, 255);
}
byte[] cipherText = check crypto:encryptAesGcm(data, key, initialVector);
```



encryptAesGcm

Returns the RSA-encrypted value for the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PublicKey publicKey = check crypto:decodePublicKey(keyStore, "keyAlias");
byte[] cipherText = check crypto:encryptRsaEcb(data, publicKey);
```



encryptRsaEcb

Returns the MD5 hash of the given data.
```ballerina
string dataString = "Hello Ballerina";
byte[] data = dataString.toBytes();
byte[] hash = crypto:hashMd5(data);
```



hashMd5

salt

Returns the SHA-1 hash of the given data.
```ballerina
string dataString = "Hello Ballerina";
byte[] data = dataString.toBytes();
byte[] hash = crypto:hashSha1(data);
```



hashSha1

Returns the SHA-256 hash of the given data.
```ballerina
string dataString = "Hello Ballerina";
byte[] data = dataString.toBytes();
byte[] hash = crypto:hashSha256(data);
```



hashSha256

Returns the SHA-384 hash of the given data.
```ballerina
string dataString = "Hello Ballerina";
byte[] data = dataString.toBytes();
byte[] hash = crypto:hashSha384(data);
```



hashSha384

Returns the SHA-512 hash of the given data.
```ballerina
string dataString = "Hello Ballerina";
byte[] data = dataString.toBytes();
byte[] hash = crypto:hashSha512(data);
```



hashSha512

Returns the HMAC using the MD5 hash function of the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
string secret = "some-secret";
byte[] key = secret.toBytes();
byte[] hmac = crypto:hmacMd5(data, key);
```



hmacMd5

The HMAC output or a `crypto:Error` if an error occurred


Returns the HMAC using the SHA-1 hash function of the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
string secret = "some-secret";
byte[] key = secret.toBytes();
byte[] hmac = crypto:hmacSha1(data, key);
```



hmacSha1

Returns the HMAC using the SHA-256 hash function of the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
string secret = "some-secret";
byte[] key = secret.toBytes();
byte[] hmac = crypto:hmacSha256(data, key);
```



hmacSha256

Returns the HMAC using the SHA-384 hash function of the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
string secret = "some-secret";
byte[] key = secret.toBytes();
byte[] hmac = crypto:hmacSha384(data, key);
```



hmacSha384

Returns the HMAC using the SHA-512 hash function of the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
string secret = "some-secret";
byte[] key = secret.toBytes();
byte[] hmac = crypto:hmacSha512(data, key);
```



hmacSha512

Returns the RSA-MD5 based signature value for the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaMd5(data, privateKey);
```



signRsaMd5

privateKey

The generated signature or else a `crypto:Error` if the private key is invalid


Returns the RSA-SHA1 based signature value for the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaSha1(data, privateKey);
```



signRsaSha1

Returns the RSA-SHA256 based signature value for the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaSha256(data, privateKey);
```



signRsaSha256

Returns the RSA-SHA384 based signature value for the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaSha384(data, privateKey);
```



signRsaSha384

Returns the RSA-SHA512 based signature value for the given data.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaSha512(data, privateKey);
```



signRsaSha512

Verifies the RSA-MD5 based signature.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword")
byte[] signature = check crypto:signRsaMd5(data, privateKey);
crypto:PublicKey publicKey = check crypto:decodePublicKey(keyStore, "keyAlias");
boolean validity = check crypto:verifyRsaMd5Signature(data, signature, publicKey);
```



verifyRsaMd5Signature

data

signature

publicKey

Validity of the signature or else a `crypto:Error` if the public key is invalid


boolean

Verifies the RSA-SHA1 based signature.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaMd5(data, privateKey);
crypto:PublicKey publicKey = check crypto:decodePublicKey(keyStore, "keyAlias");
boolean validity = check crypto:verifyRsaSha1Signature(data, signature, publicKey);
```



verifyRsaSha1Signature

Verifies the RSA-SHA256 based signature.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaMd5(data, privateKey);
crypto:PublicKey publicKey = check crypto:decodePublicKey(keyStore, "keyAlias");
boolean validity = check crypto:verifyRsaSha256Signature(data, signature, publicKey);
```



verifyRsaSha256Signature

Verifies the RSA-SHA384 based signature.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaMd5(data, privateKey);
crypto:PublicKey publicKey = check crypto:decodePublicKey(keyStore, "keyAlias");
boolean validity = check crypto:verifyRsaSha384Signature(data, signature, publicKey);
```



verifyRsaSha384Signature

Verifies the RSA-SHA512 based signature.
```ballerina
string input = "Hello Ballerina";
byte[] data = input.toBytes();
crypto:KeyStore keyStore = {
    path: "/path/to/keyStore.p12",
    password: "keyStorePassword"
};
crypto:PrivateKey privateKey = check crypto:decodePrivateKey(keyStore, "keyAlias", "keyPassword");
byte[] signature = check crypto:signRsaMd5(data, privateKey);
crypto:PublicKey publicKey = check crypto:decodePublicKey(keyStore, "keyAlias");
boolean validity = check crypto:verifyRsaSha512Signature(data, signature, publicKey);
```



verifyRsaSha512Signature

Represents the X509 public key certificate information.



version0

serial

issuer

subject

Not before validity period of certificate


notBefore

Not after validity period of certificate


notAfter

signingAlgorithm

Certificate

Represents the KeyStore-related configurations.



path

password

Represents the private key used in cryptographic operations.



algorithm

KeyAlgorithm

Represents the public key used in cryptographic operations.



certificate

Represents the truststore-related configurations.



This module provides common cryptographic mechanisms based on different algorithms.


Represents the padding algorithms supported by AES encryption and decryption.


Represents the supported key algorithms.


Represents the padding algorithms supported with RSA encryption and decryption.


Errors