RSA Encrypt Data

RSA encryption in ComfyUI sounds like it should be about scrambling an image. It isn't, and the node will tell you so the first time you feed it a PNG-sized pile of bytes: RSA can only encrypt payloads smaller than the key, and that ceiling is a couple of hundred bytes. What RSA Encrypt Data is actually good for is the thing real crypto uses RSA for - wrapping a small symmetric key, or hiding a one-line secret in a graph. Beyond that caveat it does exactly what its name says, on top of pyca's cryptography.

Where this fits

This is one of the nine RSA nodes in the ComfyUI ARG Toolkit (ARG Toolkit/Cryptography/Modern/Asymmetric in the node menu), a pack built for Alternate Reality Game puzzles - secret messages hidden in images, cipher chains, that kind of thing. The rest of it covers classical ciphers, Morse, spectrograms and image steganography. Only a handful of people do this in ComfyUI, which is why the pack exists: the normal answer to "how do I encrypt a message" is CyberChef or dCode.fr in another browser tab, and the author's goal is to never leave ComfyUI.

Think of RSA Encrypt Data as the plumbing between a text node and a hidden payload. You'll reach for AES or a classical cipher far more often; this one is for asymmetric handoff - a recipient gets a public key, you keep the private one.

How it works under the hood

The source is short: grab a hash object from signature_algorithm, then call public_key.encrypt(data, padding). Two paddings.

• OAEP (the default) with MGF1 over whatever hash you picked. Modern, sane, and it's where the hash choice actually matters. OAEP also reserves overhead: 2048-bit key with SHA256 leaves you roughly 190 usable bytes.
• PKCS1v15 - the 1998 legacy scheme. Read the source and you'll notice the hash algorithm is simply ignored on this path. It fits slightly more data and carries a long history of padding-oracle attacks. Use it to interoperate with something old, not by preference.

The label input is OAEP's optional tag, mixed into the derivation - same ciphertext, different label, no decryption. Leave it unwired unless a puzzle says otherwise, but if the other side set one you'll need those exact bytes.

Inputs and output that matter

public_key (type KEYOBJ) and data (type BYTESLIKE) are both forced inputs - wires only, no typing - and both are pack-specific types rather than strings, which is the first thing that trips up beginners.

• Feed public_key from RSA Public Key Bytes (RSA Public Key Format), which generates or serializes a key, or from RSA Public Numbers into Key if all you were given is a modulus and exponent.
• Feed data from Bytes-like Object Encode, which turns a multiline text box into BYTESLIKE with a choice of Hexadecimal / Base64 / UTF-8 / Binary / Raw Bytes.

signature_algorithm is a 15-entry hash list, and the name is a leftover from the signing node - here it's the OAEP hash, so the tooltip's "used for the signature" is misleading. SHA256 is the boring right answer. SHA1, MD5 and SM3 sit at the bottom of the list for solving old puzzles, not for securing anything you care about.

Output is a single encrypted_data (BYTESLIKE) - raw ciphertext. Wire it into Bytes-like Object Decode (Base64 or Hex) to get something you can paste into a note or a filename.

Install

Easiest path is ComfyUI Manager: open it, search ComfyUI ARG Toolkit, install, restart ComfyUI and refresh the browser. Manually:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit
cd ComfyUI-ARG-Toolkit
pip install -r requirements.txt   # read the warning below first

No models to download - this pack is all code. The warning: requirements.txt is a full uv lock that pins torch and torchaudio alongside cryptography, stegano and invisible-watermark, so running it into an existing ComfyUI environment can replace your CUDA torch build with the pinned one. Manager's path is safer; if you go manual, check python -c "import torch; print(torch.cuda.is_available())" after. The pack declares Python >=3.12.

Common issues

"Data too long for key size" - that's the ceiling, not a bug. OAEP with a 2048-bit key and SHA256 gives you about 190 bytes. Symmetric-encrypt the payload and RSA-encrypt only the key; the pack ships AES key wrap nodes for that.

Decrypts to nothing sensible - padding mismatch, nearly always. A PKCS1v15 ciphertext under an OAEP decrypt raises rather than returning garbage, which is honest but unhelpful; same for the hash and the label.

Nothing accepts your string - you skipped the converter. A BYTESLIKE socket only takes a BYTESLIKE wire, and ComfyUI refuses the link without explaining why.

One expectation to set: the pack is young, single-author and barely discussed online, and the README admits its testing is manual functionality checks rather than a suite. Great for puzzles. Not where you keep house keys.