Java

Duplicate SQL Server ENCRYPTBYPASSPHRASE

See more Encryption Examples

Demonstrates how to duplicate SQL Server's ENCRYPTBYPASSPHRASE. Chilkat2 Java

import com.chilkatsoft.chilkat2.BinData;
import com.chilkatsoft.chilkat2.Crypt2;
import com.chilkatsoft.chilkat2.Prng;
import com.chilkatsoft.chilkat2.StringBuilder;

public class ChilkatExample {

    public static void main(String[] args) {
        // This example requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // For SQL Server 2008 - SQL Server 2016 we must use TripleDES with SHA1
        // For SQL Server 2017 and later, use AES256 / SHA256.

        String password = "tEst1234";
        String encryptedHex_v1 = "0x010000001E8E7DCDBD4061B951999E25D18445D2305474D2D71EEE98A241C755246F58AB";

        // Here's an encrypted string using AES256/SHA256
        String encryptedHex_v2 = "0x02000000FFE880C0354780481E64EF25B6197A02E2A854A4BA9D8D9BDDFDAB27EB56537ABDA0B1D9C4D1050C91B313550DECF429";

        StringBuilder sbEncHex = new StringBuilder();
        sbEncHex.append(encryptedHex_v1);

        // If present, we don't want the leading "0x"
        if (sbEncHex.startsWith("0x", false)) {
            sbEncHex.removeCharsAt(0, 2);
        }

        Crypt2 crypt = new Crypt2();
        crypt.setEncodingMode("hex");

        // The encrypted hex string will begin with either 01000000 or 02000000
        // version 1 is produced by SQL Server 2008 to SQL Server 2016, and we must use TripleDES with SHA1
        // version 2 is for SQL Server 2017 and later, and uses AES256 / SHA256.
        boolean v1 = sbEncHex.startsWith("01", false);

        int ivLen = 0;
        String hashAlg = "";

        if (v1) {
            crypt.setCryptAlgorithm("3des");
            crypt.setCipherMode("cbc");
            crypt.setKeyLength(168);
            ivLen = 8;
            hashAlg = "sha1";
        } else {
            crypt.setCryptAlgorithm("aes");
            crypt.setCipherMode("cbc");
            crypt.setKeyLength(256);
            ivLen = 16;
            hashAlg = "sha256";
        }

        // Remove the SQL Server version info (i.e. the "01000000")
        sbEncHex.removeCharsAt(0, 8);

        // Get the IV part of the sbEncHex, and also remove it from the StringBuilder.
        String ivHex = sbEncHex.getRange(0, ivLen * 2, true);
        System.out.println("IV = " + ivHex);
        crypt.setEncodedIV(ivHex, "hex");

        StringBuilder sbPassword = new StringBuilder();
        sbPassword.append(password);
        String pwd_hash = sbPassword.getHash(hashAlg, "hex", "utf-16");
        StringBuilder sbKey = new StringBuilder();
        sbKey.append(pwd_hash);
        if (v1) {
            // For v1, we only want the 1st 16 bytes of the 20 byte hash.
            // (remember, the hex encoding uses 2 chars per byte, so we remove the last 8 chars)
            sbKey.shorten(8);
        }

        System.out.println("crypt key: " + sbKey.getAsString());

        crypt.setEncodedKey(sbKey.getAsString(), "hex");

        // Decrypt
        BinData bd = new BinData();
        bd.appendEncoded(sbEncHex.getAsString(), "hex");
        crypt.decryptBd(bd);

        // The result is composed of a header of 8 bytes which we can discard.
        // The remainder is the decrypted text.

        // The header we are discarding is composed of:
        // Bytes 0-3: Magic number equal to 0DF0ADBA
        // Bytes 4-5: Number of integrity bytes, which is 0 unless an authenticator is used. We're assuming no authenticator is used.
        // Bytes 6-7: Number of plain-text bytes. We really don't need this because the CBC padding takes care of it.

        // Therefore, just return the data after the 1st 8 bytes.
        // Assuming the encrypted string was utf-8 text...
        bd.removeChunk(0, 8);
        String plainText = bd.getString("utf-8");
        System.out.println("decrypted plain text: " + plainText);

        // The output:

        // IV = 1E8E7DCDBD4061B9
        // crypt key: 710B9C2E61ACCC9570D4112203BD9738
        // decrypted plain text: Hello world.

        // ------------------------------------------------------------------------------------------
        // To encrypt, do the reverse...

        // Let's do v1 with TripleDES with SHA1

        Crypt2 encryptor = new Crypt2();
        encryptor.setEncodingMode("hex");

        encryptor.setCryptAlgorithm("3des");
        encryptor.setCipherMode("cbc");
        encryptor.setKeyLength(168);

        // Generate a random 8-byte IV
        Prng prng = new Prng();
        ivHex = prng.genRandom(8, "hex");
        encryptor.setEncodedIV(ivHex, "hex");

        // The binary password is generated the same as above.
        // We'll use the same password (and same binary password)
        encryptor.setEncodedKey(sbKey.getAsString(), "hex");

        int plainTextLen = 8;
        plainText = "ABCD1234";

        // Encrypt the header + the plain-text.
        BinData bdData = new BinData();
        bdData.appendEncoded("0DF0ADBA", "hex");
        bdData.appendEncoded("0000", "hex");
        bdData.appendInt2(plainTextLen, true);
        System.out.println("header: " + bdData.getEncoded("hex"));
        bdData.appendString(plainText, "utf-8");
        encryptor.encryptBd(bdData);

        // Compose the result..
        StringBuilder sbEnc = new StringBuilder();
        sbEnc.append("0x01000000");
        sbEnc.append(ivHex);
        sbEnc.append(bdData.getEncoded("hex"));

        System.out.println("result: " + sbEnc.getAsString());
    }
}