Decryption v2
Authenticated decryption restores encrypted content only when the matching key material can verify its integrity.
The Decryption Node restores exact UTF-8 text produced by the matching shared-key or certificate methods on the Encryption Node. Use it when a Workflow needs to process protected content.
Revision History
0.0.0.4 - Initial release.
Connection
Use an Encryption Key Connection. Populate the credentials required by the selected Method.
| Property | Type | Description |
|---|---|---|
Key |
Masked | Canonical Base64 for exactly 32 cryptographically random bytes; used by AES-256-GCM and ChaCha20-Poly1305. |
Password |
Masked | Password used by password-based encryption. This is separate from any certificate import password. |
Public Certificate |
Certificate | RSA public certificate used for certificate encryption. The RSA key must be at least 2048 bits. |
Private Certificate |
Certificate | Matching RSA certificate with its private key, used for certificate decryption. The RSA key must be at least 2048 bits. |
Setup Notes
- For
Decrypt, populate Key with the same canonical Base64 key used by Encrypt. - For
Decrypt with Certificate, select the private certificate matching the public certificate used for encryption. Import the PFX using the certificate upload control and supply its password there. - Keep private-certificate Connections separately permissioned from public-only encryption Connections.
Methods
Select the method matching the original encryption mode.
Decrypt
Authenticates and decrypts an fgenc.1 text envelope.
| Parameter | Type | Description |
|---|---|---|
Connection |
Connection | Encryption Key Connection containing the matching Key. |
Ciphertext |
String | Complete, unchanged envelope produced by the matching text encryption method. |
| Return | Type | Description |
|---|---|---|
Plaintext |
String | Original UTF-8 text. No trimming or normalization is applied. |
Decrypt with Certificate
Authenticates and decrypts an fgcert.1 text envelope.
| Parameter | Type | Description |
|---|---|---|
Connection |
Connection | Encryption Key Connection containing the matching Private Certificate. |
Ciphertext |
String | Complete, unchanged envelope produced by the matching text encryption method. |
| Return | Type | Description |
|---|---|---|
Plaintext |
String | Original UTF-8 text. No trimming or normalization is applied. |
Usage Notes
- Wrong keys or certificates, modified content, and malformed envelopes fail with the same safe error for that encryption mode. Failed authentication does not return plaintext.
- Keep the matching historical keys or private certificates until their ciphertext is no longer needed.
- See Encryption for the supported envelope formats and input limits.
Known Issues
- Only shared-key AES-256-GCM and RSA-certificate text envelopes are supported. Password-based and ChaCha20-Poly1305 envelopes are not supported.
- The Node does not expose binary stream-decryption methods or decrypt other providers' envelope formats.