Windowsユーザーの資格情報を使用して暗号化／復号を行うPowerShellのサンプルコード

example.ps1

$rawText = "パスワード"

Add-Type -AssemblyName System.Security

$SALT_LEN = 16 # 128bit
$SALT_BASE64_LEN = 24

function ConvertTo-EncryptedString {
    param(
        [string]$text
    )
    $txtBytes = [System.Text.Encoding]::Unicode.GetBytes($text)
    $salt = [System.Security.Cryptography.RandomNumberGenerator]::GetBytes($SALT_LEN)
    $scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser
    $encryptedTextBytes = [System.Security.Cryptography.ProtectedData]::Protect($txtBytes, $salt, $scope)
    $encryptedTextWithSalt = [System.Convert]::ToBase64String($salt) + [System.Convert]::ToBase64String($encryptedTextBytes)
    return $encryptedTextWithSalt
}

function ConvertFrom-EncryptedString {
    param(
        [string]$text
    )
    $salt = [System.Convert]::FromBase64String($text.Substring(0, $SALT_BASE64_LEN))
    $encryptedTextBytes = [System.Convert]::FromBase64String($text.Substring($SALT_BASE64_LEN))
    $scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser
    $rawTextBytes = [System.Security.Cryptography.ProtectedData]::UnProtect($encryptedTextBytes, $salt, $scope)
    return [System.Text.Encoding]::Unicode.GetString($rawTextBytes)
}

Write-Output "Raw Text: $rawText"

$encryptedTextWithSalt = ConvertTo-EncryptedString $rawText

Write-Output "Encrypted Text: $encryptedTextWithSalt"

$decryptedText = ConvertFrom-EncryptedString $encryptedTextWithSalt

Write-Output "Decrypted Text: $decryptedText"

# 出力例
# Raw Text: パスワード
# Encrypted Text: rwv/ViQOPXaD0jH99ovNwA==AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAx8tGJnXnzUy6zFSaW+UPXQAAAAACAAAAAAAQZgAAAAEAACAAAAB47LtO7NgZbSwYIFeGOOnsID6qadfoHyUiesUNWhxa9AAAAAAOgAAAAAIAACAAAABi2QvOBRS2uoLd9aNNbrpQ/CxtpdjhOun60ChZ+YZdchAAAABaKC1V5F8sKj+CTH1p1kThQAAAAApxObcuaR+wZUg27FtRYYBILeOswvjfM9B5MjTWVOH+5wQCmTmcUu0Ip/qvECjCW+h82yRwCxn01WoiA9sanJo=
# Decrypted Text: パスワード