Classic ASP

Example: Crypt2.RandomizeIV method

Demonstrates using a random initialization vector for AES GCM encryption. Classic ASP

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<%
success = 0

'  This example assumes the Chilkat API to have been previously unlocked.
'  See Global Unlock Sample for sample code.

set crypt = Server.CreateObject("Chilkat.Crypt2")

crypt.CryptAlgorithm = "aes"
crypt.CipherMode = "gcm"
crypt.KeyLength = 256

K = "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
AAD = "feedfacedeadbeeffeedfacedeadbeefabaddad2"
PT = "This is the text to be AES-GCM encrypted."

'  Generate a random IV.
crypt.RandomizeIV 
IV = crypt.GetEncodedIV("hex")

crypt.SetEncodedKey K,"hex"

success = crypt.SetEncodedAad(AAD,"hex")

'  Return the encrypted bytes as base64
crypt.EncodingMode = "base64"
crypt.Charset = "utf-8"
cipherText = crypt.EncryptStringENC(PT)
If (crypt.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( crypt.LastErrorText) & "</pre>"
    Response.End
End If

'  Get the GCM authenticated tag computed when encrypting.
authTag = crypt.GetEncodedAuthTag("base64")

Response.Write "<pre>" & Server.HTMLEncode( "Cipher Text: " & cipherText) & "</pre>"
Response.Write "<pre>" & Server.HTMLEncode( "Auth Tag: " & authTag) & "</pre>"

'  Let's send the IV, CipherText, and AuthTag to the decrypting party.
'  We'll send them concatenated like this: [IV || Ciphertext || AuthTag]
'  In base64 format.
set bdEncrypted = Server.CreateObject("Chilkat.BinData")
success = bdEncrypted.AppendEncoded(IV,"hex")
success = bdEncrypted.AppendEncoded(cipherText,"base64")
success = bdEncrypted.AppendEncoded(authTag,"base64")

concatenatedGcmOutput = bdEncrypted.GetEncoded("base64")
Response.Write "<pre>" & Server.HTMLEncode( "Concatenated GCM Output: " & concatenatedGcmOutput) & "</pre>"

'  Sample output so far:

'  -------------------------------------------------------------------------------------
'  Now let's GCM decrypt...
'  -------------------------------------------------------------------------------------

set decrypt = Server.CreateObject("Chilkat.Crypt2")

'  The values shared and agreed upon by both sides beforehand are: algorithm, cipher mode, secret key, and AAD.
'  Sometimes the IV can be a value already known and agreed upon, but in this case the encryptor sends the IV to the decryptor.
decrypt.CryptAlgorithm = "aes"
decrypt.CipherMode = "gcm"
decrypt.KeyLength = 256
decrypt.SetEncodedKey K,"hex"
success = decrypt.SetEncodedAad(AAD,"hex")

set bdFromEncryptor = Server.CreateObject("Chilkat.BinData")
success = bdFromEncryptor.AppendEncoded(concatenatedGcmOutput,"base64")

sz = bdFromEncryptor.NumBytes

'  Extract the parts.
extractedIV = bdFromEncryptor.GetEncodedChunk(0,16,"hex")
extractedCipherText = bdFromEncryptor.GetEncodedChunk(16,sz - 32,"base64")
expectedAuthTag = bdFromEncryptor.GetEncodedChunk(sz - 16,16,"base64")

'  Before GCM decrypting, we must set the authenticated tag to the value that is expected.
'  The decryption will fail if the resulting authenticated tag is not equal to the expected result.
success = decrypt.SetEncodedAuthTag(expectedAuthTag,"base64")

'  Also set the IV.
decrypt.SetEncodedIV extractedIV,"hex"

'  Decrypt..
decrypt.EncodingMode = "base64"
decrypt.Charset = "utf-8"
decryptedText = decrypt.DecryptStringENC(extractedCipherText)
If (decrypt.LastMethodSuccess <> 1) Then
    '  Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    Response.Write "<pre>" & Server.HTMLEncode( decrypt.LastErrorText) & "</pre>"
    Response.End
End If

Response.Write "<pre>" & Server.HTMLEncode( "Decrypted: " & decryptedText) & "</pre>"

%>
</body>
</html>