encryptRsaOaepOrThrow

Encrypt a small message with an RSA-OAEP public key.

The key must have been generated or imported with { kind: 'rsa', scheme: 'oaep' }. RSA-OAEP encrypts at most modulus bytes − 2 × hash bytes − 2 per call (190 bytes for a 2048-bit key with SHA-256) — encrypt a symmetric key, not bulk data.

function encryptRsaOaepOrThrow(
	publicKey: CryptoKey,
	plaintext: Uint8Array,
	_: unknown,
): Promise<Uint8Array>

Parameters

• publicKey: CryptoKey — RSA-OAEP public CryptoKey with encrypt usage
• plaintext: Uint8Array — Message bytes, at most the OAEP capacity of the key
• _: unknown

Throws

• Error — If the key is not an RSA-OAEP public encryption key, or the plaintext exceeds the key's OAEP capacity

See also

• decryptRsaOaepOrThrow for the inverse operation
• encryptRsaOaep for the Result-returning variant

Examples

const keys = await generateKeyPair({ kind: 'rsa', scheme: 'oaep' });
const ciphertext = await encryptRsaOaepOrThrow(
	keys.publicKey,
	new TextEncoder().encode('session key'),
);