Encrypting PIN

import crypto from 'node:crypto';

function encryptPin(pin: string, rsaPublicKeyDerHex: string): string {
  if (!/^\d{4,9}$/.test(pin)) {
    throw new Error('PIN must be numeric and 4 to 9 digits long.');
  }

  const pinBlockStart = `1${pin.length}${pin}`;
  const padding = 'F'.repeat(16 - pinBlockStart.length);
  const pinBlock = pinBlockStart + padding;

  const publicKey = crypto.createPublicKey({
    key: Buffer.from(rsaPublicKeyDerHex, 'hex'),
    format: 'der',
    type: 'pkcs1',
  });

  const encrypted = crypto.publicEncrypt(
    {
      key: publicKey,
      padding: crypto.constants.RSA_PKCS1_PADDING,
    },
    Buffer.from(pinBlock, 'hex')
  );

  return encrypted.toString('hex').toUpperCase();
}

from Crypto.Cipher import PKCS1_v1_5
from Crypto.PublicKey import RSA

def encrypt_pin(pin: str, rsa_public_key_der_hex: str) -> str:
    if not pin.isdigit() or len(pin) < 4 or len(pin) > 9:
        raise ValueError("PIN must be numeric and 4 to 9 digits long.")

    pin_block_start = f"1{len(pin)}{pin}"
    pin_block = pin_block_start + ("F" * (16 - len(pin_block_start)))

    public_key = RSA.import_key(bytes.fromhex(rsa_public_key_der_hex))
    cipher = PKCS1_v1_5.new(public_key)
    encrypted = cipher.encrypt(bytes.fromhex(pin_block))

    return encrypted.hex().upper()

using System;
using System.Security.Cryptography;

public static class PinEncryption
{
    public static string EncryptPin(string pin, string rsaPublicKeyDerHex)
    {
        if (!System.Text.RegularExpressions.Regex.IsMatch(pin, @"^\d{4,9}$"))
        {
            throw new ArgumentException("PIN must be numeric and 4 to 9 digits long.");
        }

        var pinBlockStart = $"1{pin.Length}{pin}";
        var pinBlock = pinBlockStart + new string('F', 16 - pinBlockStart.Length);

        byte[] pinBlockBytes = Convert.FromHexString(pinBlock);
        byte[] publicKeyDer = Convert.FromHexString(rsaPublicKeyDerHex);

        using RSA rsa = RSA.Create();
        try
        {
            rsa.ImportSubjectPublicKeyInfo(publicKeyDer, out _);
        }
        catch (CryptographicException)
        {
            rsa.ImportRSAPublicKey(publicKeyDer, out _);
        }

        byte[] encrypted = rsa.Encrypt(pinBlockBytes, RSAEncryptionPadding.Pkcs1);

        return Convert.ToHexString(encrypted);
    }
}

import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.spec.RSAPublicKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.math.BigInteger;
import javax.crypto.Cipher;

public class PinEncryption {
    public static String encryptPin(String pin, String rsaPublicKeyDerHex) throws Exception {
        if (!pin.matches("\\d{4,9}")) {
            throw new IllegalArgumentException("PIN must be numeric and 4 to 9 digits long.");
        }

        String pinBlockStart = "1" + pin.length() + pin;
        String pinBlock = pinBlockStart + "F".repeat(16 - pinBlockStart.length());

        byte[] pinBlockBytes = hexToBytes(pinBlock);
        byte[] publicKeyDer = hexToBytes(rsaPublicKeyDerHex);

        PublicKey publicKey = loadPublicKey(publicKeyDer);

        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
        cipher.init(Cipher.ENCRYPT_MODE, publicKey);

        return bytesToHex(cipher.doFinal(pinBlockBytes));
    }

    private static PublicKey loadPublicKey(byte[] publicKeyDer) throws Exception {
        try {
            return KeyFactory.getInstance("RSA")
                .generatePublic(new X509EncodedKeySpec(publicKeyDer));
        } catch (Exception ignored) {
            RsaParts parts = readPkcs1PublicKey(publicKeyDer);
            return KeyFactory.getInstance("RSA")
                .generatePublic(new RSAPublicKeySpec(parts.modulus, parts.exponent));
        }
    }

    private static RsaParts readPkcs1PublicKey(byte[] der) {
        DerReader reader = new DerReader(der);
        reader.expect(0x30);
        reader.readLength();
        BigInteger modulus = reader.readInteger();
        BigInteger exponent = reader.readInteger();
        return new RsaParts(modulus, exponent);
    }

    private static byte[] hexToBytes(String hex) {
        byte[] out = new byte[hex.length() / 2];
        for (int i = 0; i < hex.length(); i += 2) {
            out[i / 2] = (byte) Integer.parseInt(hex.substring(i, i + 2), 16);
        }
        return out;
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder hex = new StringBuilder(bytes.length * 2);
        for (byte b : bytes) {
            hex.append(String.format("%02X", b));
        }
        return hex.toString();
    }

    private static class RsaParts {
        final BigInteger modulus;
        final BigInteger exponent;

        RsaParts(BigInteger modulus, BigInteger exponent) {
            this.modulus = modulus;
            this.exponent = exponent;
        }
    }

    private static class DerReader {
        private final byte[] data;
        private int pos = 0;

        DerReader(byte[] data) {
            this.data = data;
        }

        void expect(int expectedTag) {
            int tag = data[pos++] & 0xff;
            if (tag != expectedTag) {
                throw new IllegalArgumentException("Invalid DER public key.");
            }
        }

        int readLength() {
            int length = data[pos++] & 0xff;
            if ((length & 0x80) == 0) {
                return length;
            }
            int count = length & 0x7f;
            length = 0;
            for (int i = 0; i < count; i++) {
                length = (length << 8) | (data[pos++] & 0xff);
            }
            return length;
        }

        BigInteger readInteger() {
            expect(0x02);
            int length = readLength();
            byte[] value = java.util.Arrays.copyOfRange(data, pos, pos + length);
            pos += length;
            return new BigInteger(1, value);
        }
    }
}

<?php

function derHexToPem(string $derHex): string
{
    $base64 = base64_encode(hex2bin($derHex));
    return "-----BEGIN RSA PUBLIC KEY-----\n"
        . chunk_split($base64, 64, "\n")
        . "-----END RSA PUBLIC KEY-----\n";
}

function encryptPin(string $pin, string $rsaPublicKeyDerHex): string
{
    if (!preg_match('/^\d{4,9}$/', $pin)) {
        throw new InvalidArgumentException('PIN must be numeric and 4 to 9 digits long.');
    }

    $pinBlockStart = '1' . strlen($pin) . $pin;
    $pinBlock = $pinBlockStart . str_repeat('F', 16 - strlen($pinBlockStart));

    $publicKeyPem = derHexToPem($rsaPublicKeyDerHex);
    $encrypted = '';

    $ok = openssl_public_encrypt(
        hex2bin($pinBlock),
        $encrypted,
        $publicKeyPem,
        OPENSSL_PKCS1_PADDING
    );

    if (!$ok) {
        throw new RuntimeException('PIN encryption failed.');
    }

    return strtoupper(bin2hex($encrypted));
}