From a7939b11de3eb688dd4f1f65834e71be57c27cb7 Mon Sep 17 00:00:00 2001
From: Patrick Weiss <83357588+p4trickweiss@users.noreply.github.com>
Date: Wed, 27 Aug 2025 12:32:17 +0200
Subject: [PATCH] Switch ncrack password encryption from rsa to age-encryption

Signed-off-by: Patrick Weiss <83357588+p4trickweiss@users.noreply.github.com>
---
 CONTRIBUTORS.md                               |   1 +
 scanners/ncrack/.helm-docs.gotmpl             |  22 +--
 scanners/ncrack/README.md                     |  16 ++-
 scanners/ncrack/examples/dummy-ssh/README.md  |   6 +-
 scanners/ncrack/parser/__testFiles__/key.txt  |   6 +
 .../parser/__testFiles__/public-key.txt       |   1 +
 .../__testFiles__/public-key.txt.license      |   3 +
 .../parser/__testFiles__/public_key.pem       |   6 -
 .../__testFiles__/public_key.pem.license      |   3 -
 scanners/ncrack/parser/package-lock.json      |  95 +++++++++++++
 scanners/ncrack/parser/package.json           |   1 +
 scanners/ncrack/parser/parser.js              |  86 +++++++-----
 scanners/ncrack/parser/parser.test.js         |  42 +++---
 .../templates/ncrack-parse-definition.yaml    |  19 ++-
 .../tests/__snapshot__/scanner_test.yaml.snap | 126 ++++++++++++++++++
 scanners/ncrack/tests/scanner_test.yaml       |  26 +++-
 scanners/package-lock.json                    |   3 +-
 17 files changed, 367 insertions(+), 95 deletions(-)
 create mode 100644 scanners/ncrack/parser/__testFiles__/key.txt
 create mode 100644 scanners/ncrack/parser/__testFiles__/public-key.txt
 create mode 100644 scanners/ncrack/parser/__testFiles__/public-key.txt.license
 delete mode 100644 scanners/ncrack/parser/__testFiles__/public_key.pem
 delete mode 100644 scanners/ncrack/parser/__testFiles__/public_key.pem.license

diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index fa5402b2fb..ad4696f13d 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -60,3 +60,4 @@ Committing with `git commit -s` will add the sign-off at the end of the commit m
 - Ochi Daiki <lbfdeatq@gmail.com>
 - Kai Schäfer <kai.schaefer@claranet.com>
 - Joel Saß <joel.sass@iteratec.com>
+- Patrick Weiss <patrick.weiss@iteratec.com>
diff --git a/scanners/ncrack/.helm-docs.gotmpl b/scanners/ncrack/.helm-docs.gotmpl
index 3405924b59..32f814b332 100644
--- a/scanners/ncrack/.helm-docs.gotmpl
+++ b/scanners/ncrack/.helm-docs.gotmpl
@@ -73,7 +73,7 @@ TIMING AND PERFORMANCE:
     to (time-out): maximum cracking <time> for service, regardless of success so far
   -T<0-5>: Set timing template (higher is faster)
   --connection-limit <number>: threshold for total concurrent connections
-  --stealthy-linear: try credentials using only one connection against each specified host 
+  --stealthy-linear: try credentials using only one connection against each specified host
     until you hit the same host again. Overrides all other timing options.
 AUTHENTICATION:
   -U <filename>: username file
@@ -117,20 +117,24 @@ SEE THE MAN PAGE (http://nmap.org/ncrack/man.html) FOR MORE OPTIONS AND EXAMPLES
 #### Password encryption
 
 Because **Ncrack** findings are very sensitive, you probably don't want every *secureCodeBox* user to see them. In order
-to address this issue we provide an option that lets you encrypt found passwords with public key crypto. Just
-generate a key pair with openssl:
+to address this issue we provide an option that lets you encrypt found passwords with [age encryption](https://age-encryption.org/). Just
+generate a key pair with age-keygen:
 
 ```bash
-openssl genrsa -out key.pem 2048
-openssl rsa -in key.pem -outform PEM -pubout -out public.pem
+  age-keygen -o key.txt
+```
+
+To create a public key file from the generated key execute the following command:
+```bash
+  age-keygen -y -o public-key.txt key.txt
 ```
 
 After you created the public key file you have to create a kubernetes secret from that
 file:
 ```bash
-  kubectl create secret generic --from-file="public.key=public.pem" <ncrack-secret-name>
+  kubectl create secret generic --from-file="public.key=public-key.txt" <ncrack-secret-name>
 ```
-Now you only need to set the value *encryptPasswords.existingSecret* to the 
+Now you only need to set the value *encryptPasswords.existingSecret* to the
 secrets name when installing the scanner
 
 ```bash
@@ -140,7 +144,7 @@ secrets name when installing the scanner
 To decrypt a password from a finding use:
 
 ```bash
-base64 encryptedPassword -d | openssl pkeyutl -decrypt -inkey key.pem -out decryptedPassword.txt
+  echo "<encrypted-password>" | age -d -i key.txt -o decrypted.txt
 ```
 
 #### Setup with custom files:
@@ -152,7 +156,7 @@ kubectl create secret generic --from-file users.txt --from-file passwords.txt nc
 
 <b> IMPORTANT: Use an extra empty line at the end of your files, otherwise the last letter of the last line will be omitted (due to a bug in k8) </b>
 
-Now we created a secret named "ncrack-lists". 
+Now we created a secret named "ncrack-lists".
 Before we can use the files, we have to install the Ncrack ScanType:
 
 ```bash
diff --git a/scanners/ncrack/README.md b/scanners/ncrack/README.md
index 14195b37f9..793dd33fdb 100644
--- a/scanners/ncrack/README.md
+++ b/scanners/ncrack/README.md
@@ -135,18 +135,22 @@ Kubernetes: `>=v1.11.0-0`
 #### Password encryption
 
 Because **Ncrack** findings are very sensitive, you probably don't want every *secureCodeBox* user to see them. In order
-to address this issue we provide an option that lets you encrypt found passwords with public key crypto. Just
-generate a key pair with openssl:
+to address this issue we provide an option that lets you encrypt found passwords with [age encryption](https://age-encryption.org/). Just
+generate a key pair with age-keygen:
 
 ```bash
-openssl genrsa -out key.pem 2048
-openssl rsa -in key.pem -outform PEM -pubout -out public.pem
+  age-keygen -o key.txt
+```
+
+To create a public key file from the generated key execute the following command:
+```bash
+  age-keygen -y -o public-key.txt key.txt
 ```
 
 After you created the public key file you have to create a kubernetes secret from that
 file:
 ```bash
-  kubectl create secret generic --from-file="public.key=public.pem" <ncrack-secret-name>
+  kubectl create secret generic --from-file="public.key=public-key.txt" <ncrack-secret-name>
 ```
 Now you only need to set the value *encryptPasswords.existingSecret* to the
 secrets name when installing the scanner
@@ -158,7 +162,7 @@ secrets name when installing the scanner
 To decrypt a password from a finding use:
 
 ```bash
-base64 encryptedPassword -d | openssl pkeyutl -decrypt -inkey key.pem -out decryptedPassword.txt
+  echo "<encrypted-password>" | age -d -i key.txt -o decrypted.txt
 ```
 
 #### Setup with custom files:
diff --git a/scanners/ncrack/examples/dummy-ssh/README.md b/scanners/ncrack/examples/dummy-ssh/README.md
index 39d2459986..c4025162a6 100644
--- a/scanners/ncrack/examples/dummy-ssh/README.md
+++ b/scanners/ncrack/examples/dummy-ssh/README.md
@@ -19,7 +19,7 @@ printf "THEPASSWORDYOUCREATED\n123456\npassword\n" > passwords.txt
 kubectl create secret generic --from-file users.txt --from-file passwords.txt ncrack-lists
 
 # Install dummy-ssh app. We'll use ncrack to enumerate its ssh username and password
-helm install dummy-ssh oci://ghcr.io/securecodebox/helm/dummy-ssh/ --wait
+helm install dummy-ssh oci://ghcr.io/securecodebox/helm/dummy-ssh --wait
 
 # Install the ncrack scanType and set mount the files from the ncrack-lists Kubernetes secret
 cat <<EOF | helm upgrade --install ncrack oci://ghcr.io/securecodebox/helm/ncrack --values -
@@ -39,9 +39,9 @@ After that you can execute the scan in this directory:
 kubectl apply -f scan.yaml
 ```
 
-The scan should find credentials for username 'root' with password 'THEPASSWORDYOUCREATED'. 
+The scan should find credentials for username 'root' with password 'THEPASSWORDYOUCREATED'.
 
 #### Troubleshooting:
 * <b> Make sure to leave a blank line at the end of each file used in the secret!</b>
 * If printf doesn't create new lines, try 'echo -e "..."'
-* You can show your existing secrets with 'kubectl get secrets' 
+* You can show your existing secrets with 'kubectl get secrets'
diff --git a/scanners/ncrack/parser/__testFiles__/key.txt b/scanners/ncrack/parser/__testFiles__/key.txt
new file mode 100644
index 0000000000..a7d7954ccd
--- /dev/null
+++ b/scanners/ncrack/parser/__testFiles__/key.txt
@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: the secureCodeBox authors
+#
+# SPDX-License-Identifier: Apache-2.0
+# created: 2025-08-21T12:52:24+02:00
+# public key: age14t6tm8lqrhuw8wrpfxf438gl2fvpnl02tgpf3dhex6e9jejy4feqfus7jf
+AGE-SECRET-KEY-1JRMTLELHHAUZ6U7SJ7HTZKUU0QX9A09PSXDVW9TVG704G9PVANXQS94G8T
diff --git a/scanners/ncrack/parser/__testFiles__/public-key.txt b/scanners/ncrack/parser/__testFiles__/public-key.txt
new file mode 100644
index 0000000000..c064959efd
--- /dev/null
+++ b/scanners/ncrack/parser/__testFiles__/public-key.txt
@@ -0,0 +1 @@
+age14t6tm8lqrhuw8wrpfxf438gl2fvpnl02tgpf3dhex6e9jejy4feqfus7jf
diff --git a/scanners/ncrack/parser/__testFiles__/public-key.txt.license b/scanners/ncrack/parser/__testFiles__/public-key.txt.license
new file mode 100644
index 0000000000..abd9aa6406
--- /dev/null
+++ b/scanners/ncrack/parser/__testFiles__/public-key.txt.license
@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: the secureCodeBox authors
+#
+# SPDX-License-Identifier: Apache-2.0
diff --git a/scanners/ncrack/parser/__testFiles__/public_key.pem b/scanners/ncrack/parser/__testFiles__/public_key.pem
deleted file mode 100644
index a57c6792c8..0000000000
--- a/scanners/ncrack/parser/__testFiles__/public_key.pem
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDftYgZ2MhLWumXTylT/nEhZ3Ul
-rk8xuf8EFA3ffMRgyW3n9mEpVFHVXZCaEYz55/pZqnsffUosPnHtKDV4uGPVqPJk
-Mi5WUj6oUE9O/BXArK8pJfncOKYqCQN45hKc/Plt7uvTCTS/oFKoowv1MyzLzbrL
-AI4I7JPgFA1nOp8UDQIDAQAB
------END PUBLIC KEY-----
diff --git a/scanners/ncrack/parser/__testFiles__/public_key.pem.license b/scanners/ncrack/parser/__testFiles__/public_key.pem.license
deleted file mode 100644
index c95bc37185..0000000000
--- a/scanners/ncrack/parser/__testFiles__/public_key.pem.license
+++ /dev/null
@@ -1,3 +0,0 @@
-SPDX-FileCopyrightText: the secureCodeBox authors
-
-SPDX-License-Identifier: Apache-2.0
diff --git a/scanners/ncrack/parser/package-lock.json b/scanners/ncrack/parser/package-lock.json
index db99125f55..67486b4343 100644
--- a/scanners/ncrack/parser/package-lock.json
+++ b/scanners/ncrack/parser/package-lock.json
@@ -9,10 +9,71 @@
       "version": "1.0.0",
       "license": "Apache-2.0",
       "dependencies": {
+        "age-encryption": "^0.2.4",
         "xml2js": "^0.6.2"
       },
       "devDependencies": {}
     },
+    "node_modules/@noble/ciphers": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.3.0.tgz",
+      "integrity": "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@noble/curves": {
+      "version": "1.9.7",
+      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz",
+      "integrity": "sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==",
+      "license": "MIT",
+      "dependencies": {
+        "@noble/hashes": "1.8.0"
+      },
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@scure/base": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@scure/base/-/base-1.2.6.tgz",
+      "integrity": "sha512-g/nm5FgUa//MCj1gV09zTJTaM6KBAHqLN907YVQqf7zC49+DcO4B1so4ZX07Ef10Twr6nuqYEH9GEggFXA4Fmg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/age-encryption": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/age-encryption/-/age-encryption-0.2.4.tgz",
+      "integrity": "sha512-9STi5PzVCn3YZurHLMI2njLwCT4ACkHFoktp1JNyFF0m4qHSn9JZQB8nnnJnpEGEJZduVBL1oxZzr4lteqRbzw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@noble/ciphers": "^1.2.0",
+        "@noble/curves": "^1.3.0",
+        "@noble/hashes": "^1.3.3",
+        "@scure/base": "^1.1.5"
+      }
+    },
     "node_modules/sax": {
       "version": "1.2.4",
       "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
@@ -41,6 +102,40 @@
     }
   },
   "dependencies": {
+    "@noble/ciphers": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.3.0.tgz",
+      "integrity": "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw=="
+    },
+    "@noble/curves": {
+      "version": "1.9.7",
+      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz",
+      "integrity": "sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==",
+      "requires": {
+        "@noble/hashes": "1.8.0"
+      }
+    },
+    "@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="
+    },
+    "@scure/base": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@scure/base/-/base-1.2.6.tgz",
+      "integrity": "sha512-g/nm5FgUa//MCj1gV09zTJTaM6KBAHqLN907YVQqf7zC49+DcO4B1so4ZX07Ef10Twr6nuqYEH9GEggFXA4Fmg=="
+    },
+    "age-encryption": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/age-encryption/-/age-encryption-0.2.4.tgz",
+      "integrity": "sha512-9STi5PzVCn3YZurHLMI2njLwCT4ACkHFoktp1JNyFF0m4qHSn9JZQB8nnnJnpEGEJZduVBL1oxZzr4lteqRbzw==",
+      "requires": {
+        "@noble/ciphers": "^1.2.0",
+        "@noble/curves": "^1.3.0",
+        "@noble/hashes": "^1.3.3",
+        "@scure/base": "^1.1.5"
+      }
+    },
     "sax": {
       "version": "1.2.4",
       "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
diff --git a/scanners/ncrack/parser/package.json b/scanners/ncrack/parser/package.json
index be584ac7cf..8b2ecc147d 100644
--- a/scanners/ncrack/parser/package.json
+++ b/scanners/ncrack/parser/package.json
@@ -8,6 +8,7 @@
   "author": "iteratec GmbH",
   "license": "Apache-2.0",
   "dependencies": {
+    "age-encryption": "^0.2.4",
     "xml2js": "^0.6.2"
   },
   "devDependencies": {}
diff --git a/scanners/ncrack/parser/parser.js b/scanners/ncrack/parser/parser.js
index 2d98d28194..cf472fb346 100644
--- a/scanners/ncrack/parser/parser.js
+++ b/scanners/ncrack/parser/parser.js
@@ -3,8 +3,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { parseString } from "xml2js";
-import { publicEncrypt, constants } from "node:crypto";
 import { readFile } from "node:fs/promises";
+import * as age from "age-encryption";
 
 export async function parse(
   fileContent,
@@ -26,44 +26,42 @@ export async function parse(
 }
 
 function transformToFindings(ncrackrun, publicKey) {
-  return ncrackrun.service.flatMap(({ address, port, credentials = [] }) => {
-    const { addr: ipAddress } = address[0]["$"];
-    const { protocol, portid, name: portName } = port[0]["$"];
+  const findings = ncrackrun.service.flatMap(
+    ({ address, port, credentials = [] }) => {
+      const { addr: ipAddress } = address[0]["$"];
+      const { protocol, portid, name: portName } = port[0]["$"];
 
-    return credentials.map((credential) => {
-      let { username, password } = credential["$"];
+      return credentials.map(async (credential) => {
+        let { username, password } = credential["$"];
 
-      if (publicKey) {
-        password = publicEncrypt(
-          {
-            key: publicKey,
-            padding: constants.RSA_PKCS1_OAEP_PADDING,
+        if (publicKey) {
+          password = await encryptWithAGE(password, publicKey);
+        }
+
+        return {
+          name: `Credentials for Service ${portName}://${ipAddress}:${portid} discovered via bruteforce.`,
+          description: "",
+          category: "Discovered Credentials",
+          location: `${portName}://${ipAddress}:${portid}`,
+          osi_layer: "APPLICATION",
+          severity: "HIGH",
+          mitigation:
+            "Use a more secure password or disable the service at " +
+            `${portName}://${ipAddress}:${portid}`,
+          attributes: {
+            port: portid,
+            ip_addresses: [ipAddress],
+            protocol: protocol,
+            service: portName,
+            username,
+            password,
           },
-          Buffer.from(password),
-        ).toString("base64");
-      }
+        };
+      });
+    },
+  );
 
-      return {
-        name: `Credentials for Service ${portName}://${ipAddress}:${portid} discovered via bruteforce.`,
-        description: "",
-        category: "Discovered Credentials",
-        location: `${portName}://${ipAddress}:${portid}`,
-        osi_layer: "APPLICATION",
-        severity: "HIGH",
-        mitigation:
-          "Use a more secure password or disable the service at " +
-          `${portName}://${ipAddress}:${portid}`,
-        attributes: {
-          port: portid,
-          ip_addresses: [ipAddress],
-          protocol: protocol,
-          service: portName,
-          username,
-          password,
-        },
-      };
-    });
-  });
+  return Promise.all(findings);
 }
 
 function transformXML(fileContent) {
@@ -79,5 +77,21 @@ function transformXML(fileContent) {
 }
 
 async function readPublicKey(keyLocation) {
-  return readFile(keyLocation);
+  return readFile(keyLocation, "utf-8");
+}
+
+async function encryptWithAGE(password, publicKey) {
+  // remove newlines
+  publicKey = publicKey.trim();
+
+  const e = new age.Encrypter();
+  e.addRecipient(publicKey);
+  const ciphertext = await e.encrypt(password);
+
+  /**
+  age encrypted files (the inputs of Decrypter.decrypt and outputs of Encrypter.encrypt) are binary files, of type Uint8Array.
+  There is an official ASCII "armor" format, based on PEM, which provides a way to encode an encrypted file as text.
+  **/
+  const armored = age.armor.encode(ciphertext);
+  return armored;
 }
diff --git a/scanners/ncrack/parser/parser.test.js b/scanners/ncrack/parser/parser.test.js
index aaf7006d78..2e30ff3040 100644
--- a/scanners/ncrack/parser/parser.test.js
+++ b/scanners/ncrack/parser/parser.test.js
@@ -3,8 +3,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { readFileSync } from "node:fs";
-import { privateDecrypt, constants } from "node:crypto";
 import { validateParser } from "@securecodebox/parser-sdk-nodejs/parser-utils";
+import * as age from "age-encryption";
 
 import { parse } from "./parser";
 
@@ -134,34 +134,22 @@ it("should encrypt findings when a public key is set", async () => {
   const [finding] = await parse(
     ncrackXML,
     null,
-    __dirname + "/__testFiles__/public_key.pem",
+    __dirname + "/__testFiles__/public-key.txt",
   );
 
-  let decryptedData = privateDecrypt(
-    {
-      key: privateKey,
-      padding: constants.RSA_PKCS1_OAEP_PADDING,
-    },
-    Buffer.from(finding.attributes.password, "base64"),
-  );
+  let decryptedData = await decryptWithAGE(finding.attributes.password);
 
-  expect(finding.attributes.password.length).toBe(172);
-  expect(decryptedData.toString()).toBe("aaf076d4fe7cfb63fd1628df91");
+  expect(finding.attributes.password.length).toBe(377);
+  expect(decryptedData).toBe("aaf076d4fe7cfb63fd1628df91");
 });
 
-const privateKey =
-  "-----BEGIN RSA PRIVATE KEY-----\n" +
-  "MIICXQIBAAKBgQDftYgZ2MhLWumXTylT/nEhZ3Ulrk8xuf8EFA3ffMRgyW3n9mEp\n" +
-  "VFHVXZCaEYz55/pZqnsffUosPnHtKDV4uGPVqPJkMi5WUj6oUE9O/BXArK8pJfnc\n" +
-  "OKYqCQN45hKc/Plt7uvTCTS/oFKoowv1MyzLzbrLAI4I7JPgFA1nOp8UDQIDAQAB\n" +
-  "AoGAV5tepkiX/7KlocS1eZg+M4exf8UobF/bd3xnBmt0+DZJ3TpGSIol1fnjRAK1\n" +
-  "g7SN/QlfWDCXmIYH1YkWj6UeKvWim86OV+61QX4imLAOsi7fSA8fcNRxYVX73hhk\n" +
-  "kxt10a4l+CPAb4cyJa4Ud3UHhLtRlanJtQyAXZtQ38fRSiECQQDxIhBjkU4Sf96t\n" +
-  "wpEWr/RnOA2aHOUWH8GCB4DAcw5wrISDcvRsgKggjec2VAJPovqSri1lQS4hV28M\n" +
-  "4iTcj+ylAkEA7YB0rAebUzbFXzMrxUPxBbjze+idw1COqCXkX+N9RYVY23D8mUlR\n" +
-  "8cMru4Rauu6DluSWZCgR14+Hi0TNrUHlSQJBAJBoJgh67JaHnYPSEbHUjjmCiCLT\n" +
-  "Sx6Exg5pD+IxBWTU7EcMgPS51/YnBWCzzu6CXC2bwfPxpP6yrf65L/om90ECQQDe\n" +
-  "HGYAhFSkq/JFp+tlXrbHbUJ4PQFdqbbgVh+P9YYwQBbrkm0JReKWwLnjclIPxAPY\n" +
-  "WAq1vCuDdr2CZ2QahifRAkBd9mv+G4WO0hOsTBypeoEnL6VECzSauDwfIP/kSdBz\n" +
-  "bmkZ6DCScZa8gz1J5ZamBnP4N2dtQn/zDtNUkS+qK+s2\n" +
-  "-----END RSA PRIVATE KEY-----";
+async function decryptWithAGE(data) {
+  const d = new age.Decrypter();
+  d.addIdentity(ageSecretKey);
+  const decoded = age.armor.decode(data);
+  const out = await d.decrypt(decoded, "text");
+  return out;
+}
+
+const ageSecretKey =
+  "AGE-SECRET-KEY-1JRMTLELHHAUZ6U7SJ7HTZKUU0QX9A09PSXDVW9TVG704G9PVANXQS94G8T";
diff --git a/scanners/ncrack/templates/ncrack-parse-definition.yaml b/scanners/ncrack/templates/ncrack-parse-definition.yaml
index 2b69a13685..2a46a26fee 100644
--- a/scanners/ncrack/templates/ncrack-parse-definition.yaml
+++ b/scanners/ncrack/templates/ncrack-parse-definition.yaml
@@ -10,13 +10,17 @@ spec:
   image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}"
   imagePullPolicy: {{ .Values.parser.image.pullPolicy }}
   ttlSecondsAfterFinished: {{ .Values.parser.ttlSecondsAfterFinished }}
-  env: 
-    {{- toYaml .Values.parser.env | nindent 4 }}
+  env:
+    {{- $env := .Values.parser.env | default (list) }}
+    {{- if .Values.encryptPasswords.existingSecret }}
+    {{- $env = append $env (dict "name" "ENCRYPTION_KEY_LOCATION" "value" (printf "/secrets/%s" .Values.encryptPasswords.key)) }}
+    {{- end }}
+    {{- toYaml $env | nindent 4 }}
   scopeLimiterAliases:
     {{- toYaml .Values.parser.scopeLimiterAliases | nindent 4 }}
   affinity:
     {{- toYaml .Values.parser.affinity | nindent 4 }}
-  tolerations: 
+  tolerations:
     {{- toYaml .Values.parser.tolerations | nindent 4 }}
   {{- with .Values.imagePullSecrets }}
   imagePullSecrets:
@@ -30,3 +34,12 @@ spec:
   nodeSelector:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- if .Values.encryptPasswords.existingSecret }}
+  volumes:
+    - name: "ncrack-secret"
+      secret:
+        secretName: {{ .Values.encryptPasswords.existingSecret }}
+  volumeMounts:
+    - name: "ncrack-secret"
+      mountPath: "/secrets/"
+  {{- end }}
diff --git a/scanners/ncrack/tests/__snapshot__/scanner_test.yaml.snap b/scanners/ncrack/tests/__snapshot__/scanner_test.yaml.snap
index 159cb837fe..8a4dc499a4 100644
--- a/scanners/ncrack/tests/__snapshot__/scanner_test.yaml.snap
+++ b/scanners/ncrack/tests/__snapshot__/scanner_test.yaml.snap
@@ -374,3 +374,129 @@ matches the snapshot:
               tolerations:
                 - foo: bar
               volumes: []
+merges encryption and empty env array:
+  1: |
+    apiVersion: execution.securecodebox.io/v1
+    kind: ParseDefinition
+    metadata:
+      name: ncrack-xml
+    spec:
+      affinity: {}
+      env:
+        - name: ENCRYPTION_KEY_LOCATION
+          value: /secrets/public.key
+      image: docker.io/securecodebox/parser-ncrack:0.0.0
+      imagePullPolicy: IfNotPresent
+      scopeLimiterAliases: {}
+      tolerations: []
+      ttlSecondsAfterFinished: null
+      volumeMounts:
+        - mountPath: /secrets/
+          name: ncrack-secret
+      volumes:
+        - name: ncrack-secret
+          secret:
+            secretName: foobar
+  2: |
+    apiVersion: execution.securecodebox.io/v1
+    kind: ScanType
+    metadata:
+      name: ncrack
+    spec:
+      extractResults:
+        location: /home/securecodebox/ncrack-results.xml
+        type: ncrack-xml
+      jobTemplate:
+        spec:
+          backoffLimit: 3
+          suspend: false
+          template:
+            spec:
+              affinity: {}
+              containers:
+                - command:
+                    - ncrack
+                    - -oX
+                    - /home/securecodebox/ncrack-results.xml
+                  env: []
+                  image: docker.io/securecodebox/scanner-ncrack:0.0.0
+                  imagePullPolicy: IfNotPresent
+                  name: ncrack
+                  resources: {}
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    capabilities:
+                      drop:
+                        - all
+                    privileged: false
+                    readOnlyRootFilesystem: true
+                    runAsNonRoot: true
+                  volumeMounts: []
+              restartPolicy: OnFailure
+              securityContext: {}
+              tolerations: []
+              volumes: []
+merges encryption and env array:
+  1: |
+    apiVersion: execution.securecodebox.io/v1
+    kind: ParseDefinition
+    metadata:
+      name: ncrack-xml
+    spec:
+      affinity: {}
+      env:
+        - name: foo
+          value: bar
+        - name: ENCRYPTION_KEY_LOCATION
+          value: /secrets/public.key
+      image: docker.io/securecodebox/parser-ncrack:0.0.0
+      imagePullPolicy: IfNotPresent
+      scopeLimiterAliases: {}
+      tolerations: []
+      ttlSecondsAfterFinished: null
+      volumeMounts:
+        - mountPath: /secrets/
+          name: ncrack-secret
+      volumes:
+        - name: ncrack-secret
+          secret:
+            secretName: foobar
+  2: |
+    apiVersion: execution.securecodebox.io/v1
+    kind: ScanType
+    metadata:
+      name: ncrack
+    spec:
+      extractResults:
+        location: /home/securecodebox/ncrack-results.xml
+        type: ncrack-xml
+      jobTemplate:
+        spec:
+          backoffLimit: 3
+          suspend: false
+          template:
+            spec:
+              affinity: {}
+              containers:
+                - command:
+                    - ncrack
+                    - -oX
+                    - /home/securecodebox/ncrack-results.xml
+                  env: []
+                  image: docker.io/securecodebox/scanner-ncrack:0.0.0
+                  imagePullPolicy: IfNotPresent
+                  name: ncrack
+                  resources: {}
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    capabilities:
+                      drop:
+                        - all
+                    privileged: false
+                    readOnlyRootFilesystem: true
+                    runAsNonRoot: true
+                  volumeMounts: []
+              restartPolicy: OnFailure
+              securityContext: {}
+              tolerations: []
+              volumes: []
diff --git a/scanners/ncrack/tests/scanner_test.yaml b/scanners/ncrack/tests/scanner_test.yaml
index c5b3b49c3a..12ed861987 100644
--- a/scanners/ncrack/tests/scanner_test.yaml
+++ b/scanners/ncrack/tests/scanner_test.yaml
@@ -8,7 +8,7 @@ tests:
   - it: matches the snapshot
     chart:
       version: 0.0.0
-      appVersion: 0.0.0      
+      appVersion: 0.0.0
     set:
       cascadingRules.enabled: true
       imagePullSecrets: [{name: foo}]
@@ -28,3 +28,27 @@ tests:
         tolerations: [{foo: bar}]
     asserts:
       - matchSnapshot: {}
+
+  - it: merges encryption and empty env array
+    chart:
+      version: 0.0.0
+      appVersion: 0.0.0
+    set:
+      encryptPasswords:
+        existingSecret: foobar
+        key: "public.key"
+    asserts:
+      - matchSnapshot: {}
+
+  - it: merges encryption and env array
+    chart:
+      version: 0.0.0
+      appVersion: 0.0.0
+    set:
+      encryptPasswords:
+        existingSecret: foobar
+        key: "public.key"
+      parser:
+        env: [{name: foo, value: bar}]
+    asserts:
+      - matchSnapshot: {}
diff --git a/scanners/package-lock.json b/scanners/package-lock.json
index 9d737f8e0b..2e72d238a2 100644
--- a/scanners/package-lock.json
+++ b/scanners/package-lock.json
@@ -23,7 +23,8 @@
         "ajv-draft-04": "^1.0.0",
         "ajv-formats": "^3.0.1",
         "jsonpointer": "^5.0.1"
-      }
+      },
+      "devDependencies": {}
     },
     "node_modules/@securecodebox/parser-sdk-nodejs": {
       "resolved": "../parser-sdk/nodejs",