$CertPath = ".\recipient.crt"
$InputFile = ".\file.txt"

# Load CRT, supporting both PEM and DER
$raw = [System.IO.File]::ReadAllBytes($CertPath)
$text = [System.Text.Encoding]::ASCII.GetString($raw)

if ($text -match "-----BEGIN CERTIFICATE-----") {
    $b64 = $text `
        -replace "-----BEGIN CERTIFICATE-----", "" `
        -replace "-----END CERTIFICATE-----", "" `
        -replace "\s", ""

    $raw = [Convert]::FromBase64String($b64)
}

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @(,$raw)

# Extract RSA public key
$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($cert)

if ($null -eq $rsa) {
    throw "Certificate does not contain an RSA public key."
}

# Generate random AES-256 key and IV
$aes = [System.Security.Cryptography.Aes]::Create()
$aes.KeySize = 256
$aes.BlockSize = 128
$aes.Mode = [System.Security.Cryptography.CipherMode]::CBC
$aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$aes.GenerateKey()
$aes.GenerateIV()

# Encrypt AES key using RSA-OAEP/SHA1
if ($rsa -is [System.Security.Cryptography.RSACryptoServiceProvider]) {
    # $true = OAEP
    $encryptedKey = $rsa.Encrypt($aes.Key, $true)
}
else {
    $padding = [System.Security.Cryptography.RSAEncryptionPadding]::OaepSHA1
    $encryptedKey = $rsa.Encrypt($aes.Key, $padding)
}

[System.IO.File]::WriteAllBytes("$InputFile.key.enc", $encryptedKey)
[System.IO.File]::WriteAllBytes("$InputFile.iv", $aes.IV)

# Encrypt the actual file with AES
$inputStream = [System.IO.File]::OpenRead($InputFile)
$outputStream = [System.IO.File]::Create("$InputFile.enc")

$encryptor = $aes.CreateEncryptor()

$cryptoStream = New-Object System.Security.Cryptography.CryptoStream(
    $outputStream,
    $encryptor,
    [System.Security.Cryptography.CryptoStreamMode]::Write
)

try {
    $inputStream.CopyTo($cryptoStream)
    $cryptoStream.FlushFinalBlock()
}
finally {
    $cryptoStream.Dispose()
    $inputStream.Dispose()
    $outputStream.Dispose()
    $encryptor.Dispose()
    $aes.Dispose()
    $rsa.Dispose()
}

Write-Host "Created:"
Write-Host "  $InputFile.enc"
Write-Host "  $InputFile.key.enc"
Write-Host "  $InputFile.iv"