_{Official ZPE/YASS documentation}Cryptography module

Module description

This module provides legacy file and string encryption together with hashing, message authentication, secure random values, authenticated AES-GCM encryption, and X.509 certificate inspection.

Modern cryptography functions were added in ZPE 1.14.11. Existing legacy encryption functions remain available for compatibility.

Availability: ZPE 1.14.5 is the first version to support the Cryptography module.

Module functions

The following is a list of all functions available in this module.

• aes_decrypt [1.14.5+]

  Returns an decrypted AES message.

• aes_encrypt [1.14.5+]

  Returns an AES encrypted message.

• aes_gcm_decrypt [1.14.5+]

  Decrypts and authenticates a Base64 AES-GCM ciphertext produced by aes_gcm_encrypt(). Tampered or incorrectly keyed data is rejected.

• aes_gcm_encrypt [1.14.5+]

  Encrypts a message with authenticated AES-GCM. The generated nonce, ciphertext, and authentication tag are returned as a Base64 string.

• certificate_fingerprint [1.14.5+]

  Returns a hexadecimal fingerprint of a PEM or Base64 X.509 certificate using an algorithm such as SHA-256 or SHA-512. The existing x509_pem_fingerprint function remains available for file-based use.

• certificate_info [1.14.5+]

  Reads an X.509 certificate from PEM or Base64 data and returns its subject, issuer, validity dates, algorithms, serial number, and SHA-256 fingerprint.

• constant_time_equals [1.14.5+]

  Compares two strings in constant time to reduce timing-leak risks when checking secrets.

• file_decrypt [1.14.5+]

  Decrypts a file, <em>filepath</em>, that was encrypted using ZPE-based encryption and saves it to <em>new_path</em>.

• file_encrypt [1.14.5+]

  Encrypts a file, <em>filepath</em> using ZPE-based encryption and saves it at <em>new_path</em>. -1 means that the file doesn't exist, 0 means there was a non-specified error and 1 means success.

• hash [1.14.5+]

  Returns a hexadecimal message digest using the requested Java message-digest algorithm, such as SHA-256, SHA-512, SHA3-256, or SHA3-512.

• hmac [1.14.5+]

  Returns a hexadecimal HMAC for a message and key using an algorithm such as HmacSHA256 or HmacSHA512.

• secure_random [1.14.5+]

  Returns cryptographically secure random bytes encoded as Base64. The requested length must be between 0 and 1048576 bytes.