##############################################################################
#
# The following are some examples of doing public key crypto in PowerShell.
# Symmetric key crypto examples are in a different script.
# Author: Jason Fossen, Enclave Consulting LLC (http://www.sans.org/sec505)
#
##############################################################################




# Get the public key certificate into a byte array from a file.
[Byte[]] $CertBytes = Get-Content -Encoding Byte -Path ".\PublicKeyCert.cer"


# Get the public key certificate into a byte array from a script variable.
# Notice how each line ends with a comma indicating line continuation.
[Byte[]] $CertBytes = 
0x30,0x82,0x04,0xE1,0x30,0x82,0x03,0xC9,0xA0,0x03,0x02,0x01,0x02,0x02,0x0A,
0x28,0xA7,0xC0,0x18,0x00,0x00,0x00,0x00,0x00,0x19,0x30,0x0D,0x06,0x09,0x2A,
0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x05,0x05,0x00,0x30,0x4A,0x31,0x15,0x30,
0x13,0x06,0x0A,0x09,0x92,0x26,0x89,0x93,0xF2,0x2C,0x64,0x01,0x19,0x16,0x05,
0x6C,0x6F,0x63,0x61,0x6C,0x31,0x17,0x30,0x15,0x06,0x0A,0x09,0x92,0x26,0x89,
0x93,0xF2,0x2C,0x64,0x01,0x19,0x16,0x07,0x74,0x65,0x73,0x74,0x69,0x6E,0x67,
0x31,0x18,0x30,0x16,0x06,0x03,0x55,0x04,0x03,0x13,0x0F,0x54,0x45,0x53,0x54,
0x49,0x4E,0x47,0x2D,0x52,0x4F,0x4F,0x54,0x2D,0x43,0x41,0x30,0x1E,0x17,0x0D,
0x31,0x32,0x31,0x31,0x31,0x37,0x32,0x30,0x31,0x35,0x31,0x32,0x5A,0x17,0x0D,
0x31,0x34,0x31,0x31,0x31,0x37,0x32,0x30,0x32,0x35,0x31,0x32,0x5A,0x30,0x10,
0x31,0x0E,0x30,0x0C,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x4A,0x61,0x73,0x6F,
0x6E,0x30,0x82,0x01,0x22,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,
0x01,0x01,0x01,0x05,0x00,0x03,0x82,0x01,0x0F,0x00,0x30,0x82,0x01,0x0A,0x02,
0x82,0x01,0x01,0x00,0xBA,0x0E,0x2B,0xCA,0x3C,0xDC,0xAE,0x03,0x15,0x25,0x97,
0x4B,0xD3,0xC0,0xDE,0x26,0x8D,0x69,0x55,0xDE,0x97,0x83,0x7B,0x97,0xD3,0x5A,
0xC8,0xE1,0xD2,0xC8,0xAA,0xAA,0xE1,0xDC,0x67,0x73,0xC8,0x56,0x6D,0xC1,0x6C,
0xBE,0xDF,0x8D,0xFD,0xAF,0x05,0x3E,0xE5,0x05,0x6B,0x34,0xC3,0x6E,0x4F,0x91,
0xEC,0x8F,0xCC,0xC5,0x8C,0x63,0xE4,0x67,0x86,0x27,0x5E,0xC5,0xD4,0x39,0x6B,
0x64,0x4B,0x91,0x95,0xA0,0xB0,0xB3,0xF0,0xE5,0x04,0xC3,0xC5,0xC9,0x11,0x8E,
0x1A,0xB7,0x6B,0xFC,0x36,0x2A,0x8B,0x95,0xDB,0x21,0x32,0x33,0x28,0xA5,0xCE,
0x75,0x27,0x48,0x02,0xE1,0x38,0x95,0xFD,0xF1,0xBF,0x4E,0x68,0xC6,0xB9,0x19,
0x31,0x3B,0xB4,0xCF,0x55,0xF9,0x56,0xBD,0xE7,0x32,0x27,0x29,0x02,0x92,0x1A,
0xF1,0x2A,0x75,0x32,0x77,0x43,0x95,0x24,0xE4,0x05,0x97,0x06,0x4E,0xA4,0xC2,
0x1A,0x3E,0x02,0xE3,0xFF,0xE1,0x64,0xD8,0xB6,0x45,0xA3,0xE9,0xD4,0x31,0xE3,
0xA9,0x79,0x58,0xEC,0x7C,0x25,0x44,0xF9,0xCA,0x0C,0xA0,0xA7,0xFC,0x1B,0xE7,
0x6B,0xED,0x0A,0x86,0x64,0xE9,0x80,0x0C,0xB4,0x8D,0x67,0xB8,0x7D,0xDC,0x2F,
0xBE,0x62,0xF8,0x79,0xC1,0x6C,0x37,0x48,0x7B,0x03,0xD3,0xBA,0x39,0x86,0x19,
0x75,0x85,0x65,0x1C,0xA3,0xF3,0xE0,0x0C,0xD7,0xA9,0x2C,0xCE,0x6C,0x1B,0x90,
0xF1,0x5E,0xCA,0xDE,0x49,0x38,0x75,0x1C,0x1D,0x77,0x31,0x4A,0x47,0xF9,0xC4,
0x00,0x9D,0x1D,0x3E,0x8B,0x8A,0xA6,0xF9,0x92,0x51,0x2E,0xE5,0xFE,0xD3,0xCC,
0xA2,0xCD,0x35,0x2B,0xA5,0x02,0x03,0x01,0x00,0x01,0xA3,0x82,0x02,0x01,0x30,
0x82,0x01,0xFD,0x30,0x3D,0x06,0x09,0x2B,0x06,0x01,0x04,0x01,0x82,0x37,0x15,
0x07,0x04,0x30,0x30,0x2E,0x06,0x26,0x2B,0x06,0x01,0x04,0x01,0x82,0x37,0x15,
0x08,0x82,0xEC,0xA2,0x5A,0x81,0x94,0xFB,0x5D,0x87,0x89,0x9F,0x1A,0x86,0x8B,
0xE8,0x26,0x81,0x94,0x8C,0x5C,0x81,0x4B,0xF7,0xA2,0x38,0x84,0xD7,0xEE,0x2C,
0x02,0x01,0x64,0x02,0x01,0x02,0x30,0x13,0x06,0x03,0x55,0x1D,0x25,0x04,0x0C,
0x30,0x0A,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x30,0x0E,0x06,
0x03,0x55,0x1D,0x0F,0x01,0x01,0xFF,0x04,0x04,0x03,0x02,0x05,0xA0,0x30,0x1B,
0x06,0x09,0x2B,0x06,0x01,0x04,0x01,0x82,0x37,0x15,0x0A,0x04,0x0E,0x30,0x0C,
0x30,0x0A,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x30,0x44,0x06,
0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x09,0x0F,0x04,0x37,0x30,0x35,0x30,
0x0E,0x06,0x08,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x03,0x02,0x02,0x02,0x00,0x80,
0x30,0x0E,0x06,0x08,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x03,0x04,0x02,0x02,0x00,
0x80,0x30,0x07,0x06,0x05,0x2B,0x0E,0x03,0x02,0x07,0x30,0x0A,0x06,0x08,0x2A,
0x86,0x48,0x86,0xF7,0x0D,0x03,0x07,0x30,0x1D,0x06,0x03,0x55,0x1D,0x0E,0x04,
0x16,0x04,0x14,0xE9,0x64,0xAA,0xA9,0xEB,0xF1,0x5B,0xA3,0xB0,0xE7,0x2F,0xB2,
0x98,0x95,0x47,0x9B,0xD1,0x4B,0x51,0xB0,0x30,0x1F,0x06,0x03,0x55,0x1D,0x23,
0x04,0x18,0x30,0x16,0x80,0x14,0xD3,0xB0,0xD7,0x0E,0xDB,0xF4,0x7B,0x92,0xE1,
0xB6,0xDD,0xF6,0x77,0xD6,0xD7,0xF3,0xE6,0x57,0xA8,0x2C,0x30,0x81,0xC3,0x06,
0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x01,0x01,0x04,0x81,0xB6,0x30,0x81,0xB3,
0x30,0x81,0xB0,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x30,0x02,0x86,0x81,
0xA3,0x6C,0x64,0x61,0x70,0x3A,0x2F,0x2F,0x2F,0x43,0x4E,0x3D,0x54,0x45,0x53,
0x54,0x49,0x4E,0x47,0x2D,0x52,0x4F,0x4F,0x54,0x2D,0x43,0x41,0x2C,0x43,0x4E,
0x3D,0x41,0x49,0x41,0x2C,0x43,0x4E,0x3D,0x50,0x75,0x62,0x6C,0x69,0x63,0x25,
0x32,0x30,0x4B,0x65,0x79,0x25,0x32,0x30,0x53,0x65,0x72,0x76,0x69,0x63,0x65,
0x73,0x2C,0x43,0x4E,0x3D,0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x2C,0x43,
0x4E,0x3D,0x43,0x6F,0x6E,0x66,0x69,0x67,0x75,0x72,0x61,0x74,0x69,0x6F,0x6E,
0x2C,0x44,0x43,0x3D,0x74,0x65,0x73,0x74,0x69,0x6E,0x67,0x2C,0x44,0x43,0x3D,
0x6C,0x6F,0x63,0x61,0x6C,0x3F,0x63,0x41,0x43,0x65,0x72,0x74,0x69,0x66,0x69,
0x63,0x61,0x74,0x65,0x3F,0x62,0x61,0x73,0x65,0x3F,0x6F,0x62,0x6A,0x65,0x63,
0x74,0x43,0x6C,0x61,0x73,0x73,0x3D,0x63,0x65,0x72,0x74,0x69,0x66,0x69,0x63,
0x61,0x74,0x69,0x6F,0x6E,0x41,0x75,0x74,0x68,0x6F,0x72,0x69,0x74,0x79,0x30,
0x2E,0x06,0x03,0x55,0x1D,0x11,0x04,0x27,0x30,0x25,0xA0,0x23,0x06,0x0A,0x2B,
0x06,0x01,0x04,0x01,0x82,0x37,0x14,0x02,0x03,0xA0,0x15,0x0C,0x13,0x6A,0x61,
0x73,0x6F,0x6E,0x40,0x74,0x65,0x73,0x74,0x69,0x6E,0x67,0x2E,0x6C,0x6F,0x63,
0x61,0x6C,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x05,
0x05,0x00,0x03,0x82,0x01,0x01,0x00,0x1C,0xC7,0x86,0x7B,0x68,0x88,0xF2,0x36,
0x28,0xC1,0xF5,0x07,0x63,0x39,0x82,0xB3,0x29,0x9A,0x7D,0xE7,0x5E,0x00,0x36,
0x74,0x31,0xD7,0x6E,0x8F,0x82,0x2E,0x78,0x14,0xE7,0x2C,0xF8,0xB2,0x0E,0xEC,
0xC4,0x2E,0xB6,0x6C,0x49,0xDB,0xAC,0x65,0x48,0xC9,0x3E,0xD5,0x43,0x30,0xB7,
0x2F,0xE2,0xBC,0x9C,0x57,0xAC,0xA8,0xF8,0x2D,0xAC,0xEB,0xF7,0x05,0xE0,0x7F,
0x93,0x4E,0x71,0x2C,0xF6,0xC8,0xE7,0x91,0x23,0x7F,0x69,0x31,0x09,0x23,0xCA,
0x7F,0x03,0xD9,0xE7,0x5B,0x19,0x23,0x4E,0x1C,0x0A,0x60,0x47,0xF2,0x63,0x97,
0x19,0x70,0xC5,0x49,0xDB,0xC5,0x87,0x2E,0x54,0x8A,0x9B,0x2F,0x03,0x78,0xAD,
0x64,0xFC,0x8F,0x23,0x60,0xA7,0x11,0xFE,0x6C,0xD9,0x70,0xAB,0xE8,0x8F,0x7C,
0xA3,0x08,0x60,0xC1,0xD0,0x0F,0xE6,0xD0,0xCB,0xBF,0x4A,0x6E,0x7E,0x8A,0x33,
0xA6,0xB1,0x73,0xE0,0xEE,0x10,0xB1,0x5E,0x3E,0x5B,0x0D,0x5F,0x6D,0x7A,0x5D,
0xE4,0x82,0x29,0x2F,0x50,0x72,0x62,0x42,0xF2,0x14,0xAB,0xE8,0x52,0x21,0x44,
0x0D,0x28,0x2F,0xA7,0x38,0x24,0x42,0x13,0x9F,0x7E,0x83,0xC5,0x0E,0xE4,0xA4,
0x5F,0xCA,0x38,0x43,0xD5,0xD8,0xF3,0x1A,0x8B,0x56,0xC7,0x05,0x7D,0x1D,0xDB,
0x3D,0x7C,0x5E,0x3D,0x90,0x07,0xC4,0x88,0x17,0xC5,0xBD,0xEE,0x8C,0x55,0x5C,
0x9D,0xB1,0x4C,0x28,0x66,0x91,0x5F,0x9F,0x5A,0xC2,0x0E,0xD6,0xFE,0x26,0x2B,
0x84,0x81,0xBF,0xE4,0x54,0x6D,0x65,0x52,0x17,0xFA,0x25,0x18,0x6A,0x69,0x57,
0x6B,0x03,0x78,0xA5,0x2A,0xFB,0x37,0xCF



# The certificate data does not have to be in hex, it could also be integers, which is shorter...but less pretty.
[Byte[]] $CertBytes = 
48,130,4,225,48,130,3,201,160,3,2,1,2,2,10,40,167,192,24,0,0,0,0,0,25,48,13,6,9,42,134,72,134,247,13,1,1,5,5,0,48,74,49,21,48,19,6,10,9,146,38,137,147,242,44,100,
1,25,22,5,108,111,99,97,108,49,23,48,21,6,10,9,146,38,137,147,242,44,100,1,25,22,7,116,101,115,116,105,110,103,49,24,48,22,6,3,85,4,3,19,15,84,69,83,84,73,78,71,
45,82,79,79,84,45,67,65,48,30,23,13,49,50,49,49,49,55,50,48,49,53,49,50,90,23,13,49,52,49,49,49,55,50,48,50,53,49,50,90,48,16,49,14,48,12,6,3,85,4,3,19,5,74,97,115,
111,110,48,130,1,34,48,13,6,9,42,134,72,134,247,13,1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,186,14,43,202,60,220,174,3,21,37,151,75,211,192,222,38,141,105,85,
222,151,131,123,151,211,90,200,225,210,200,170,170,225,220,103,115,200,86,109,193,108,190,223,141,253,175,5,62,229,5,107,52,195,110,79,145,236,143,204,197,140,99,228,
103,134,39,94,197,212,57,107,100,75,145,149,160,176,179,240,229,4,195,197,201,17,142,26,183,107,252,54,42,139,149,219,33,50,51,40,165,206,117,39,72,2,225,56,149,253,
241,191,78,104,198,185,25,49,59,180,207,85,249,86,189,231,50,39,41,2,146,26,241,42,117,50,119,67,149,36,228,5,151,6,78,164,194,26,62,2,227,255,225,100,216,182,69,163,
233,212,49,227,169,121,88,236,124,37,68,249,202,12,160,167,252,27,231,107,237,10,134,100,233,128,12,180,141,103,184,125,220,47,190,98,248,121,193,108,55,72,123,3,211,
186,57,134,25,117,133,101,28,163,243,224,12,215,169,44,206,108,27,144,241,94,202,222,73,56,117,28,29,119,49,74,71,249,196,0,157,29,62,139,138,166,249,146,81,46,229,
254,211,204,162,205,53,43,165,2,3,1,0,1,163,130,2,1,48,130,1,253,48,61,6,9,43,6,1,4,1,130,55,21,7,4,48,48,46,6,38,43,6,1,4,1,130,55,21,8,130,236,162,90,129,148,251,
93,135,137,159,26,134,139,232,38,129,148,140,92,129,75,247,162,56,132,215,238,44,2,1,100,2,1,2,48,19,6,3,85,29,37,4,12,48,10,6,8,43,6,1,5,5,7,3,2,48,14,6,3,85,29,15,
1,1,255,4,4,3,2,5,160,48,27,6,9,43,6,1,4,1,130,55,21,10,4,14,48,12,48,10,6,8,43,6,1,5,5,7,3,2,48,68,6,9,42,134,72,134,247,13,1,9,15,4,55,48,53,48,14,6,8,42,134,72,
134,247,13,3,2,2,2,0,128,48,14,6,8,42,134,72,134,247,13,3,4,2,2,0,128,48,7,6,5,43,14,3,2,7,48,10,6,8,42,134,72,134,247,13,3,7,48,29,6,3,85,29,14,4,22,4,20,233,100,
170,169,235,241,91,163,176,231,47,178,152,149,71,155,209,75,81,176,48,31,6,3,85,29,35,4,24,48,22,128,20,211,176,215,14,219,244,123,146,225,182,221,246,119,214,215,
243,230,87,168,44,48,129,195,6,8,43,6,1,5,5,7,1,1,4,129,182,48,129,179,48,129,176,6,8,43,6,1,5,5,7,48,2,134,129,163,108,100,97,112,58,47,47,47,67,78,61,84,69,83,84,
73,78,71,45,82,79,79,84,45,67,65,44,67,78,61,65,73,65,44,67,78,61,80,117,98,108,105,99,37,50,48,75,101,121,37,50,48,83,101,114,118,105,99,101,115,44,67,78,61,83,101,
114,118,105,99,101,115,44,67,78,61,67,111,110,102,105,103,117,114,97,116,105,111,110,44,68,67,61,116,101,115,116,105,110,103,44,68,67,61,108,111,99,97,108,63,99,65,
67,101,114,116,105,102,105,99,97,116,101,63,98,97,115,101,63,111,98,106,101,99,116,67,108,97,115,115,61,99,101,114,116,105,102,105,99,97,116,105,111,110,65,117,116,
104,111,114,105,116,121,48,46,6,3,85,29,17,4,39,48,37,160,35,6,10,43,6,1,4,1,130,55,20,2,3,160,21,12,19,106,97,115,111,110,64,116,101,115,116,105,110,103,46,108,111,
99,97,108,48,13,6,9,42,134,72,134,247,13,1,1,5,5,0,3,130,1,1,0,28,199,134,123,104,136,242,54,40,193,245,7,99,57,130,179,41,154,125,231,94,0,54,116,49,215,110,143,130,
46,120,20,231,44,248,178,14,236,196,46,182,108,73,219,172,101,72,201,62,213,67,48,183,47,226,188,156,87,172,168,248,45,172,235,247,5,224,127,147,78,113,44,246,200,231,
145,35,127,105,49,9,35,202,127,3,217,231,91,25,35,78,28,10,96,71,242,99,151,25,112,197,73,219,197,135,46,84,138,155,47,3,120,173,100,252,143,35,96,167,17,254,108,217,
112,171,232,143,124,163,8,96,193,208,15,230,208,203,191,74,110,126,138,51,166,177,115,224,238,16,177,94,62,91,13,95,109,122,93,228,130,41,47,80,114,98,66,242,20,171,232,
82,33,68,13,40,47,167,56,36,66,19,159,126,131,197,14,228,164,95,202,56,67,213,216,243,26,139,86,199,5,125,29,219,61,124,94,61,144,7,196,136,23,197,189,238,140,85,92,
157,177,76,40,102,145,95,159,90,194,14,214,254,38,43,132,129,191,228,84,109,101,82,23,250,37,24,106,105,87,107,3,120,165,42,251,55,207



# Create an X.509 certificate object from the byte array.  Note the comma in the -ArgumentList argument
# to trick PowerShell into passing in the array as a single object instead of the array's contents.
$Cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList (,$CertBytes)


# The X.509 certificate object has many properties and methods to explore.
$Cert | Format-List *
$Cert | Get-Member


# One property is named "Thumbprint", which is the SHA1 hash of the certificate.
$Thumbprint = $Cert.Thumbprint


# The certificate's public key can be extracted as another object.  This public
# key object has the workhorse methods we need for encryption, decryption, etc.
$PublicKey = $Cert.PublicKey.Key


# Convert your input plaintext into a byte array, especially if that data is text
# so that you can explicitly choose the encoding scheme, e.g., UTF8, UTF16, etc.
# Note that you cannot encrypt more bytes than there are bytes in the public key;
# if you have more to encrypt, encrypt your data with a random symmetric key 
# first and then encrypt the symmetric key with the public key.
$PlainText = "Text encoding, BOM and newline issues can drive you nuts."
$PlainBytes = [System.Text.Encoding]::UTF8.GetBytes( $PlainText ) 


# Encrypt the input byte array with the public key, creating a new array of enciphered bytes.
# $False is for PKCS 1 version 1.5 padding (RFC 2437) and wider smart card compatibility.
# $True would have used PKCS 1 version 2.0 OAEP padding (RFC 3447) which is newer.
# Note that cipherbytes size will equal the size of the public key.
[Byte[]] $CipherBytes = $PublicKey.Encrypt($PlainBytes, $False)


# Now you could save the encrypted bytes to a new file, base64-encode, send by TCP, etc.
#      For example: 
#        $CipherBytes | Set-Content -Encoding Byte -Path ".\somefile.bin"  
# But we just want to decrypt those bytes here and show the plaintext.







##############################################################################
#
# Certificate Stores
#
##############################################################################



# Certificates are held in "stores", which are abstractrations presented as containers.
$CurrentUserStore =  [System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser
$LocalMachineStore = [System.Security.Cryptography.X509Certificates.StoreLocation]::LocalMachine


# And a certificate store can be opened with one or more permissions combined together with -bor.
$ReadOnlyFlag =     [System.Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly
$ReadWriteFlag =    [System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite
$ArchivedAlsoFlag = [System.Security.Cryptography.X509Certificates.OpenFlags]::IncludeArchived   #Archived certificates are hidden.
$ExistingOnlyFlag = [System.Security.Cryptography.X509Certificates.OpenFlags]::OpenExistingOnly  #Does not create a new store with Open().
$ExistingReadOnlyFlags = $ReadOnlyFlag -bor $ExistingOnlyFlag


# Open the current user's existing certificate store with read-only permissions, copy out
# the user's certificates, and immediately release/close the store again.
$UserCertStore = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Store -ArgumentList $CurrentUserStore
$UserCertStore.Open($ExistingReadOnlyFlags) 
$UserCertificates = $UserCertStore.Certificates
$UserCertStore.Close()


# Now the user's certificates can be displayed or manipulated in some way.
# The array contains X509Certificate2 objects with many properties and methods.
$UserCertificates | Format-List *
$UserCertificates | Get-Member


# To use a certificate's public or private key, it must be selected, but how?
# Certificates have properties like Thumbprint, Subject, SerialNumber, DnsNameList,
# EnhancedKeyUsageList, Extensions, and HasPrivateKey.  These properties will be
# frequently used for selecting the correct certificate(s).  Here we will cheat
# and use the thumbprint previously saved instead of doing a search.
$Cert = $UserCertificates | Where { $_.Thumbprint -eq $Thumbprint } 


# The private key property of the certificate can be extracted as a new object,
# and this object is our workhorse with many useful properties and methods.
# Let's use it to decrypt our cipherbytes with the same padding method too.
# $False is for PKCS 1 version 1.5 padding (RFC 2437) and wider smart card compatibility.
# $True would have used PKCS 1 version 2.0 OAEP padding (RFC 3447) which is newer.
[Byte[]] $PlainBytes = $Cert.PrivateKey.Decrypt($CipherBytes,$False) 


# Convert the decrypted bytes back into a plaintext string.
$PlainText = [System.Text.Encoding]::UTF8.GetString($PlainBytes) 
$PlainText