Decrypt RSA based encryption using Apache NiFi

Question

I am using a python script that uses pycrypto to encrypt files using RSA. I have used encrypt(data, 2048) function during encryption.

Now, I am trying to decrypt that encrypted file using the decrypt processor in Apache NiFi and I am not sure which KDF and Encryption Algorithm to select.

I do not see anything termed RSA in the Configure Processor window of Apache NiFi.

Answer 1

Currently, the EncryptContent processor does not support arbitrary RSA decryption. I would suggest you file a Jira requesting this enhancement (don't be scared by the graph showing a discrepancy between opened & closed; we're currently at the phase of the lifecycle where a release went out recently and now all the feedback is generating new tickets for the next release).

For immediate solutions, I have a few suggestions:

• You can use GPG to encrypt and decrypt the data, and NiFi provides first-class support for GPG decryption. The GPG key uses an underlying DSA/RSA key alongside AES encryption for the data, so this would be effectively the same process (asymmetric encryption).
• You can use the ExecuteScript processor to run a small script which performs the decryption. The processor supports Ruby, Groovy, Lua, Javascript, and Python*. Unfortunately the limitation on Python is that Jython doesn't support native libraries (such as pycrypto). One possible solution is to use JyNI which allows Jython to load CPython libraries, but I have not evaluated it in this context. If you are comfortable with Groovy & BouncyCastle or Ruby & OpenSSL, you can write the decrypt script in either of those languages with only a few lines of code.
• If you really want to use the Python code you already have, you can invoke it on the command-line via ExecuteProcess or ExecuteStreamCommand.

One outstanding question -- how are you using RSA to encrypt the files? RSA with a 2048 bit key length can only encrypt 245 bytes. If you are encrypting files, it is more likely you would want to use a hybrid cryptosystem, where you encrypt the arbitrary data with a randomly-generated AES key and then encrypt just that AES key with RSA. This will be much faster as well. This is the model used by SSL, S/MIME, OpenPGP, etc.