(Delphi DLL) Example: Crypt2.RandomizeIV method

Demonstrates using a random initialization vector for AES GCM encryption.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, BinData, Crypt2;

...

procedure TForm1.Button1Click(Sender: TObject);
var
crypt: HCkCrypt2;
K: PWideChar;
AAD: PWideChar;
PT: PWideChar;
IV: PWideChar;
success: Boolean;
cipherText: PWideChar;
authTag: PWideChar;
bdEncrypted: HCkBinData;
concatenatedGcmOutput: PWideChar;
decrypt: HCkCrypt2;
bdFromEncryptor: HCkBinData;
sz: Integer;
extractedIV: PWideChar;
extractedCipherText: PWideChar;
expectedAuthTag: PWideChar;
decryptedText: PWideChar;

begin
// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

crypt := CkCrypt2_Create();

CkCrypt2_putCryptAlgorithm(crypt,'aes');
CkCrypt2_putCipherMode(crypt,'gcm');
CkCrypt2_putKeyLength(crypt,256);

K := '000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F';
AAD := 'feedfacedeadbeeffeedfacedeadbeefabaddad2';
PT := 'This is the text to be AES-GCM encrypted.';

// Generate a random IV.
CkCrypt2_RandomizeIV(crypt);
IV := CkCrypt2__getEncodedIV(crypt,'hex');

CkCrypt2_SetEncodedKey(crypt,K,'hex');

success := CkCrypt2_SetEncodedAad(crypt,AAD,'hex');

// Return the encrypted bytes as base64
CkCrypt2_putEncodingMode(crypt,'base64');
CkCrypt2_putCharset(crypt,'utf-8');
cipherText := CkCrypt2__encryptStringENC(crypt,PT);
if (CkCrypt2_getLastMethodSuccess(crypt) <> True) then
  begin
    Memo1.Lines.Add(CkCrypt2__lastErrorText(crypt));
    Exit;
  end;

// Get the GCM authenticated tag computed when encrypting.
authTag := CkCrypt2__getEncodedAuthTag(crypt,'base64');

Memo1.Lines.Add('Cipher Text: ' + cipherText);
Memo1.Lines.Add('Auth Tag: ' + authTag);

// Let's send the IV, CipherText, and AuthTag to the decrypting party.
// We'll send them concatenated like this: [IV || Ciphertext || AuthTag]
// In base64 format.
bdEncrypted := CkBinData_Create();
CkBinData_AppendEncoded(bdEncrypted,IV,'hex');
CkBinData_AppendEncoded(bdEncrypted,cipherText,'base64');
CkBinData_AppendEncoded(bdEncrypted,authTag,'base64');

concatenatedGcmOutput := CkBinData__getEncoded(bdEncrypted,'base64');
Memo1.Lines.Add('Concatenated GCM Output: ' + concatenatedGcmOutput);

// Sample output so far:

// -------------------------------------------------------------------------------------
// Now let's GCM decrypt...
// -------------------------------------------------------------------------------------

decrypt := CkCrypt2_Create();

// The values shared and agreed upon by both sides beforehand are: algorithm, cipher mode, secret key, and AAD.
// Sometimes the IV can be a value already known and agreed upon, but in this case the encryptor sends the IV to the decryptor.
CkCrypt2_putCryptAlgorithm(decrypt,'aes');
CkCrypt2_putCipherMode(decrypt,'gcm');
CkCrypt2_putKeyLength(decrypt,256);
CkCrypt2_SetEncodedKey(decrypt,K,'hex');
CkCrypt2_SetEncodedAad(decrypt,AAD,'hex');

bdFromEncryptor := CkBinData_Create();
CkBinData_AppendEncoded(bdFromEncryptor,concatenatedGcmOutput,'base64');

sz := CkBinData_getNumBytes(bdFromEncryptor);

// Extract the parts.
extractedIV := CkBinData__getEncodedChunk(bdFromEncryptor,0,16,'hex');
extractedCipherText := CkBinData__getEncodedChunk(bdFromEncryptor,16,sz - 32,'base64');
expectedAuthTag := CkBinData__getEncodedChunk(bdFromEncryptor,sz - 16,16,'base64');

// Before GCM decrypting, we must set the authenticated tag to the value that is expected.
// The decryption will fail if the resulting authenticated tag is not equal to the expected result.
success := CkCrypt2_SetEncodedAuthTag(decrypt,expectedAuthTag,'base64');

// Also set the IV.
CkCrypt2_SetEncodedIV(decrypt,extractedIV,'hex');

// Decrypt..
CkCrypt2_putEncodingMode(decrypt,'base64');
CkCrypt2_putCharset(decrypt,'utf-8');
decryptedText := CkCrypt2__decryptStringENC(decrypt,extractedCipherText);
if (CkCrypt2_getLastMethodSuccess(decrypt) <> True) then
  begin
    // Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    Memo1.Lines.Add(CkCrypt2__lastErrorText(decrypt));
    Exit;
  end;

Memo1.Lines.Add('Decrypted: ' + decryptedText);

CkCrypt2_Dispose(crypt);
CkBinData_Dispose(bdEncrypted);
CkCrypt2_Dispose(decrypt);
CkBinData_Dispose(bdFromEncryptor);

end;