Encrypt URL Query Parameters

Demonstrates how to encrypt URL query parameters. Query parameter values are encrypted using AES encryption and then base64 encoded. Base64 encoding is the most efficient means of transforming binary data into printable chars. In Base64 encoding, 4 printable chars represent 3 binary bytes. Therefore, the size of the output is expanded by 4/3rds. In addition, the output of AES encryption is always padded to a multiple of 16 bytes (prior to base64 encoding).

One issue with Base64 encoding is that the following alphabet is used:

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

The "+" and "/" characters would disrupt a URL. Therefore, you'll want to URL-encode the base64 output. This example shows how to do it, and then how to reverse the process.

PS> The Base64 encoding algorithm may also include one or two "=" characters at the very end of the encoded data, and this would also disrupt a URL...

Download Chilkat Crypt ActiveX

Dim crypt As New ChilkatCrypt2

'  We want to arrive at a URL with encrypted query parameter
'  values, such as:
'  www.chilkatsoft.com/login?fieldOne=xxxxxxxxxxxx&fieldTwo=xxxxxxxxxxxx&fieldThree=xxxxxxxxxxx&fieldFour=xxxxxxxxxxx

'  Any string argument automatically begins the 30-day trial.
Dim success As Long
success = crypt.UnlockComponent("30-day trial")
If (success <> 1) Then
    MsgBox crypt.LastErrorText
    Exit Sub
End If

Dim fieldOne As String
fieldOne = "This is a test"

crypt.CryptAlgorithm = "aes"

'  The default cipher mode is CBC (Cipher Block Chaining)
'  We'll use ECB here because the amount of data to be
'  encrypted is small anyway...
crypt.CipherMode = "ecb"

'  AES supports 128, 192, and 256-bit encryption.
crypt.KeyLength = 128

'  We need a 16-byte secret key (i.e. 128 bits)
crypt.SetEncodedKey "000102030405060708090A0B0C0D0E0F","hex"

crypt.EncodingMode = "base64"

Dim e1 As String
e1 = crypt.EncryptStringENC(fieldOne)

Text1.Text = Text1.Text & e1 & vbCrLf

'  Let's URL encode it:
crypt.CryptAlgorithm = "none"
crypt.EncodingMode = "url"
'  Because the encryption algorithm = "none", it's a simple
'  pass-through with encoding...
Dim e2 As String
e2 = crypt.EncryptStringENC(e1)

Text1.Text = Text1.Text & e2 & vbCrLf

'  Now form the URL:
Dim url As String
url = "http://www.chilkatsoft.com/login?fieldOne=" & e2

Text1.Text = Text1.Text & url & vbCrLf

'  Now reverse the process:
crypt.CryptAlgorithm = "none"
crypt.EncodingMode = "url"
Dim d2 As String
d2 = crypt.DecryptStringENC(e2)

'  Back to base64:
Text1.Text = Text1.Text & d2 & vbCrLf

'  Now back to the original string:
crypt.CryptAlgorithm = "aes"
crypt.EncodingMode = "base64"
Dim d1 As String
d1 = crypt.DecryptStringENC(d2)

Text1.Text = Text1.Text & d1 & vbCrLf

'  A final note:  If decrypting in ASP or ASP.NET,
'  depending on what you're doing,
'  you may not need the explicit URL-decoding step.
'  It may be that ASP already did the URL decoding when you
'  fetch the query parameter value.  If so, you only need
'  to decrypt using base64 for the encoding mode.