# Add kms algorithms \> encrypt-decrypt:RSA-4096 | secure-import:PKCS#1 **URL:** \ **Category:** Contributing\ **Created:** [October 13, 2026, 2:26pm UTC](https://community.infisical.com/t/add-kms-algorithms-encrypt-decrypt-rsa-4096-secure-import-pkcs-1/77 "2026-10-13T14:26:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sirajuddin](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/sirajuddin/32/65_2.png) [@sirajuddin](https://community.infisical.com/u/sirajuddin)\ **Post date:** [October 13, 2026, 2:26pm UTC](https://community.infisical.com/t/add-kms-algorithms-encrypt-decrypt-rsa-4096-secure-import-pkcs-1/77/1 "2026-10-13T14:26:39Z")
Would like to see Infisical being parity \>99.99% in algorithm support with Industry Adopted Algorithms E2E tested PRs adding Algorithmic Coverage : > > > \## Context > > Encrypt\_decrypt type key usage can only be used with symmetric key…s today. > > Post change, asymmetric key encryption RSA\_4096 is available for encrypt\_decrypt RSAES\_OEAP\_SHA256 as encryption algorithm. > \## Approach > > \* Uitlizes RSAES\_OEAP\_SHA256 as default encryptionAlgorithm. > > \* Available options are \[RSAES\_OEAP\_SHA256, RSAES\_OEAP\_SHA1\]. > > \* Rotataions are explicity disabled for Encrypt type KMS key with RSA\_4096, being an asymmetric type key. > > \* RSAES\_OEAP\_SHA256 follows signing described in PKCS #1 v2.2 / RFC 8017. > > \## Screenshots > !\[Created Key\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-key.png) > !\[Form Create Key\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-key-form.png) > !\[encrypt with asymmetric key\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-encrypt-data.png) > !\[decrypt with rsa\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-kms-screenshots/docs/images/platform/kms/infisical-kms/rsa-encryption/kms-rsa-4096-decrypted-data.png) > > \## Steps to verify the change > \- Start docker containers > \- run test suite backend/e2e-test/routes/v1/kms.spec.ts > \- or use v1/ api endpoints to verify api accepts , RSA\_4096 for kms encrypt operations > > \## Type > > \* \[\] Fix > \* \[x\] Feature > \* \[\] Improvement > \* \[\] Breaking > \* \[\] Docs > \* \[\] Chore > > \## Checklist > > \* \[x\] Title follows the \[\[conventional commit\](https://www.conventionalcommits.org/en/v1.0.0/#summary)\](https://www.conventionalcommits.org/en/v1.0.0/#summary) format: \`type(scope): short description\` (scope is optional, e.g., \`fix: prevent crash on sync\` or \`fix(api): handle null response\`). > \* \[x\] Tested locally > \* \[\] Updated docs (if needed) > \* \[\] Updated CLAUDE.md files (if needed) > \* \[x\] Read the \[\[contributing guide\](https://infisical.com/docs/contributing/getting-started/overview)\](https://infisical.com/docs/contributing/getting-started/overview) > > > \* \[x\] Updated frontend > > \* \[x\] Inlcuded Test cases > > \# Note for maintainers > Pr has been handwritten , including all of backend , use of AI was restricted to parts of verifications , some of frontend changes > > > \## Context > > Encrypt with PKCS#1 for secrets in transit during import. > > Imple…ments protocol to harden import operation safety. > > Importing follow the standards of PKCS11, PKSC1 for encrypting privatekeys in transit. > > RSA,ECC\_NIST\_P521 those with longer privatekeys support RSAES\_OEAP\_SHA\* algorithms for wrapping of import operations. > > Symmetric,Assymetric,HMAC key types are supported. > > \* Included FIPS PUB 186-4, validations of imported RSA keypair exponent's > \* Storing with incremental verisioning to support on demand rotation for advancing to the external imported keypair > \* table\_schema , migrations are introduced > \* tests conducted to validate introduced algorithms , permissions > \* refractored frontend to include 'GenerateParamsForExport' method and new state condictional logics > > \## Backward compatability > > As the new importable key type introduces a key without keymaterial to exist, > > \* Included backward comptable api response for 'version' , 'encryptionAlgorithm' fields , > > \## Usecase > > Introduces security for secrets not be exposed in payload , a common scenario when infisical is behind an L7 proxy > that can view http payload > > > \# Screenshots > !\[create importable key\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-41-14.png) > !\[get import params form\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-41-57.png) > !\[pending import key type row\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-42-56.png) > !\[key versions\](https://raw.githubusercontent.com/Shaik-Sirajuddin/infisical/docs-key-material-screenshots/backend/Screenshot%20from%202026-08-29%2010-43-37.png) > > \## Coverage > > Additional required changes > > \* Doc coverage > \* Language SDK Update to include new api methods > > \## Steps to verify the change > > \## Type > > \* \[\] Fix > \* \[x\] Feature > \* \[\] Improvement > \* \[\] Breaking > \* \[\] Docs > \* \[\] Chore > > \## Checklist > > \* \[x\] Title follows the \[\[conventional commit\](https://www.conventionalcommits.org/en/v1.0.0/#summary)\](https://www.conventionalcommits.org/en/v1.0.0/#summary) format: \`type(scope): short description\` (scope is optional, e.g., \`fix: prevent crash on sync\` or \`fix(api): handle null response\`). > \* \[x\] Tested locally > \* \[\] Updated docs (if needed) > \* \[\] Updated CLAUDE.md files (if needed) > \* \[x\] Read the \[\[contributing guide\](https://infisical.com/docs/contributing/getting-started/overview)\](https://infisical.com/docs/contributing/getting-started/overview) > > \## Note for maintainers > > Pr has been handwritten , including all of backend , use of AI was restricted to parts of verifications , some of frontend changes Note : Written by Hand ( Limited Use of AI ) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex048/uploads/infisical1/original/1X/3ac9d912f6a14971a3bd62c2644eef18c87b9488.png) [@system](https://community.infisical.com/u/system)\ **Post date:** [October 13, 2026, 2:29pm UTC](https://community.infisical.com/t/add-kms-algorithms-encrypt-decrypt-rsa-4096-secure-import-pkcs-1/77/2 "2026-10-13T14:29:28Z")
---
**Author:** ![system](https://canada1.discourse-cdn.com/flex048/uploads/infisical1/original/1X/3ac9d912f6a14971a3bd62c2644eef18c87b9488.png) [@system](https://community.infisical.com/u/system)\ **Post date:** [October 14, 2026, 2:54pm UTC](https://community.infisical.com/t/add-kms-algorithms-encrypt-decrypt-rsa-4096-secure-import-pkcs-1/77/3 "2026-10-14T14:54:04Z")