Add kms algorithms > encrypt-decrypt:RSA-4096 | secure-import:PKCS#1

sirajuddin · October 13, 2026, 2:26pm

Would like to see Infisical being parity >99.99% in algorithm support with Industry Adopted Algorithms

E2E tested PRs adding Algorithmic Coverage :

github.com/Infisical/infisical

feat(kms): add asymmetric key encryption RSA-4096 for encrypt-decrypt usage (#7940)

main ← Shaik-Sirajuddin:encrypt-decrypt/raes-oeap

opened 02:20AM - 02 Sep 26 UTC

Shaik-Sirajuddin

+531 -41

## Context Encrypt_decrypt type key usage can only be used with symmetric key…s today. Post change, asymmetric key encryption RSA_4096 is available for encrypt_decrypt RSAES_OEAP_SHA256 as encryption algorithm. ## Approach * Uitlizes RSAES_OEAP_SHA256 as default encryptionAlgorithm. * Available options are [RSAES_OEAP_SHA256, RSAES_OEAP_SHA1]. * Rotataions are explicity disabled for Encrypt type KMS key with RSA_4096, being an asymmetric type key. * RSAES_OEAP_SHA256 follows signing described in PKCS #1 v2.2 / RFC 8017. ## Screenshots ![Created Key](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-key.png) ![Form Create Key](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-key-form.png) ![encrypt with asymmetric key](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-encrypt-data.png) ![decrypt with rsa](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-decrypted-data.png) ## Steps to verify the change - Start docker containers - run test suite backend/e2e-test/routes/v1/kms.spec.ts - or use v1/ api endpoints to verify api accepts , RSA_4096 for kms encrypt operations ## Type * [ ] Fix * [x] Feature * [ ] Improvement * [ ] Breaking * [ ] Docs * [ ] Chore ## Checklist * [x] Title follows the [[conventional commit](https://www.conventionalcommits.org/en/v1.0.0/#summary)](https://www.conventionalcommits.org/en/v1.0.0/#summary) format: `type(scope): short description` (scope is optional, e.g., `fix: prevent crash on sync` or `fix(api): handle null response`). * [x] Tested locally * [ ] Updated docs (if needed) * [ ] Updated CLAUDE.md files (if needed) * [x] Read the [[contributing guide](https://infisical.com/docs/contributing/getting-started/overview)](https://infisical.com/docs/contributing/getting-started/overview) * [x] Updated frontend * [x] Inlcuded Test cases # Note for maintainers Pr has been handwritten , including all of backend , use of AI was restricted to parts of verifications , some of frontend changes

github.com/Infisical/infisical

feat(kms): import key-material via secure wire format through PKCS #1 v2.2 , PKCS #11 v2.40 (#7941)

main ← Shaik-Sirajuddin:key-material-imports-main

opened 02:38AM - 02 Sep 26 UTC

Shaik-Sirajuddin

+3340 -220

## Context Encrypt with PKCS#1 for secrets in transit during import. Imple…ments protocol to harden import operation safety. Importing follow the standards of PKCS11, PKSC1 for encrypting privatekeys in transit. RSA,ECC_NIST_P521 those with longer privatekeys support RSAES_OEAP_SHA* algorithms for wrapping of import operations. Symmetric,Assymetric,HMAC key types are supported. * Included FIPS PUB 186-4, validations of imported RSA keypair exponent's * Storing with incremental verisioning to support on demand rotation for advancing to the external imported keypair * table_schema , migrations are introduced * tests conducted to validate introduced algorithms , permissions * refractored frontend to include 'GenerateParamsForExport' method and new state condictional logics ## Backward compatability As the new importable key type introduces a key without keymaterial to exist, * Included backward comptable api response for 'version' , 'encryptionAlgorithm' fields , ## Usecase Introduces security for secrets not be exposed in payload , a common scenario when infisical is behind an L7 proxy that can view http payload # Screenshots ![create importable key](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-41-14.png) ![get import params form](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-41-57.png) ![pending import key type row](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-42-56.png) ![key versions](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-43-37.png) ## Coverage Additional required changes * Doc coverage * Language SDK Update to include new api methods ## Steps to verify the change ## Type * [ ] Fix * [x] Feature * [ ] Improvement * [ ] Breaking * [ ] Docs * [ ] Chore ## Checklist * [x] Title follows the [[conventional commit](https://www.conventionalcommits.org/en/v1.0.0/#summary)](https://www.conventionalcommits.org/en/v1.0.0/#summary) format: `type(scope): short description` (scope is optional, e.g., `fix: prevent crash on sync` or `fix(api): handle null response`). * [x] Tested locally * [ ] Updated docs (if needed) * [ ] Updated CLAUDE.md files (if needed) * [x] Read the [[contributing guide](https://infisical.com/docs/contributing/getting-started/overview)](https://infisical.com/docs/contributing/getting-started/overview) ## Note for maintainers Pr has been handwritten , including all of backend , use of AI was restricted to parts of verifications , some of frontend changes

Note : Written by Hand ( Limited Use of AI )

Topic		Replies	Views
Mark secrets as sensitive/private Feature Requests	1	26	September 21, 2026
Benchmark of Infisical KMS Port In Go KMS	1	53	September 10, 2026
Secret sync to cloudflare Feature Requests	1	32	September 4, 2026
Webhook DELETE endpoint returns encrypted columns (PR #8643) Contributing	0	6	October 15, 2026
Gating Automated Private Key Disclosure Feature Requests	0	5	October 15, 2026

Add kms algorithms > encrypt-decrypt:RSA-4096 | secure-import:PKCS#1

Related topics