Decryption v2

The Decryption Node authenticates and decrypts text produced by the matching shared-key or certificate methods on the Encryption Node. Decryption succeeds only when the matching key material verifies the content's integrity, and the exact original UTF-8 text is returned. Use it when a Workflow needs to process protected content.

Revision History

0.0.0.4 - Initial release.
0.0.2.3 - Added the Password Connection property used by password-based encryption.

Connection

Use an Encryption Key Connection. Populate the credentials required by the selected Method.

Property Type Description
Key Masked Canonical Base64 for exactly 32 cryptographically random bytes. Used by Decrypt, and must match the key used for encryption.
Password Masked Secret used by password-based encryption on the Encryption Node. It is not used by the Decryption methods and is separate from any certificate import password.
Public Certificate Certificate RSA public certificate used for certificate encryption on the Encryption Node. The RSA key must be at least 2048 bits.
Private Certificate Certificate Password-protected RSA PFX containing the matching private key, used by Decrypt with Certificate. Supply its password when uploading. The RSA key must be at least 2048 bits.

Setup Notes

  • For Decrypt, populate Key with the same canonical Base64 key used by the Encryption Node's Encrypt method.
  • For Decrypt with Certificate, select the private certificate matching the public certificate used for encryption. Import the PFX using the certificate upload control and supply its password there.
  • Keep private-certificate Connections separately permissioned from public-only encryption Connections.
  • Testing the Connection requires at least one credential and validates each configured value. For example, it confirms that Key decodes to exactly 32 bytes and that a certificate contains an RSA key of at least 2048 bits. It does not check certificate chain trust, expiry, or revocation.

Methods

Select the method matching the original encryption mode.

Decrypt

Authenticates and decrypts an fgenc.1 shared-key AES-256-GCM text envelope.

Parameter Type Description
Connection Connection Encryption Key Connection containing the same Key used during encryption.
Ciphertext String Complete, unchanged envelope produced by the Encryption Node with the same Key.
Return Type Description
Plaintext String Original UTF-8 text. No trimming or normalization is applied.

Decrypt with Certificate

Authenticates and decrypts an fgcert.1 hybrid RSA-OAEP-SHA256 and AES-256-GCM certificate envelope.

Parameter Type Description
Connection Connection Encryption Key Connection containing the Private Certificate matching the encryption certificate.
Ciphertext String Complete, unchanged envelope produced by Encrypt with Certificate.
Return Type Description
Plaintext String Original UTF-8 text. No trimming or normalization is applied.

Usage Notes

  • Wrong keys or certificates, modified content, and malformed envelopes fail with the same safe error for that encryption mode. Failed authentication does not return plaintext.
  • Keep the matching historical keys or private certificates until their ciphertext is no longer needed. Replacing a key or certificate does not re-encrypt existing ciphertext.
  • Envelopes can contain up to 16 MiB of encrypted content.
  • Keep decrypted plaintext out of Workflow logs and untrusted downstream Steps.
  • See Encryption for the supported envelope formats and input limits.

Known Issues

  • Only shared-key AES-256-GCM and RSA-certificate envelopes are supported. Password-based and ChaCha20-Poly1305 envelopes are not supported.
  • The Node does not expose binary stream-decryption methods or decrypt other providers' envelope formats. Decrypted content that is not valid UTF-8 text, for example binary content encrypted with a stream method, fails with the safe decryption error.