'eyaml decrypt' requires public key

[znorris]

Attempting to run:

eyaml decrypt --pkcs7-private-key=/home/bob/eyaml_keys/private_key.pkcs7.pem -f common.yaml

results in an innapropriate error:

[hiera-eyaml-core] No such file or directory - ./keys/public_key.pkcs7.pem

I'm considering this error to be innappropriate as I've specified the path to the private key and eyaml should no longer be looking in the default directory of ./keys
However, if I include a path to the public key and run:

eyaml decrypt --pkcs7-private-key=/home/usereyaml_keys/private_key.pkcs7.pem --pkcs7-public-key=/home/user/eyaml_keys/public_key.pkcs7.pem -f common.yaml

The file will be decrypted. This is also an error to me as the public key should not be necessary to decrypt.

[elyscape]

This is due to the way OpenSSL is designed, unfortunately. From the documentation for PKCS7_decrypt(3):

Although the recipients certificate is not needed to decrypt the data it is needed to locate the appropriate (of possible several) recipients in the PKCS#7 structure.

It might be possible to work around this by generating a new public certificate at decryption if one isn't available, but that's adding a lot of complication (not to mention latency; generating certificates is slow) for minimal gain.

[gtmtech]

Yes, when I implemented this, I noted that the public key and the private key are necessary to decrypt, and only the public key is necessary to encrypt. If you know otherwise, please let me know and will investigate

[znorris]

elyscape, Yes I see what you mean now. Thanks for the reference. Perhaps it's not worth generating again but I like the idea if the private key is found and the public isn't.
EDIT: I'll mark this as closed as it's not so much a bug as a concious decision not to re-generate that public key when it's mission.

[antoinedeschenes]

There must be a way to work this out, I'm able to decrypt hiera-eyaml encrypted keys with the openssl cli, just by adding BEGIN PKCS7, END PKCS7 headers to the message:

openssl smime -decrypt -in ~/encrypted-data -inform pem -inkey ~/private.pkcs7.pem