Lua

Example: Crypt2.RandomizeIV method

Demonstrates using a random initialization vector for AES GCM encryption. Lua

local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()

crypt.crypt_algorithm = "aes"
crypt.cipher_mode = "gcm"
crypt.key_length = 256

local K = "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
local AAD = "feedfacedeadbeeffeedfacedeadbeefabaddad2"
local PT = "This is the text to be AES-GCM encrypted."

-- Generate a random IV.
crypt:randomize_iv()
local IV = crypt:get_encoded_iv("hex")

crypt:set_encoded_key(K, "hex")

local success = crypt:set_encoded_aad(AAD, "hex")

-- Return the encrypted bytes as base64
crypt.encoding_mode = "base64"
crypt.charset = "utf-8"
local cipherText = crypt:encrypt_string_enc(PT)
if not crypt.last_method_success then
    print(crypt.last_error_text)
    return
end

-- Get the GCM authenticated tag computed when encrypting.
local authTag = crypt:get_encoded_auth_tag("base64")

print("Cipher Text: " .. cipherText)
print("Auth Tag: " .. authTag)

-- Let's send the IV, CipherText, and AuthTag to the decrypting party.
-- We'll send them concatenated like this: [IV || Ciphertext || AuthTag]
-- In base64 format.
local bdEncrypted = chilkat.BinData.new()
bdEncrypted:append_encoded(IV, "hex")
bdEncrypted:append_encoded(cipherText, "base64")
bdEncrypted:append_encoded(authTag, "base64")

local concatenatedGcmOutput = bdEncrypted:get_encoded("base64")
print("Concatenated GCM Output: " .. concatenatedGcmOutput)

-- Sample output so far:

-- -------------------------------------------------------------------------------------
-- Now let's GCM decrypt...
-- -------------------------------------------------------------------------------------

local decrypt = chilkat.Crypt2.new()

-- The values shared and agreed upon by both sides beforehand are: algorithm, cipher mode, secret key, and AAD.
-- Sometimes the IV can be a value already known and agreed upon, but in this case the encryptor sends the IV to the decryptor.
decrypt.crypt_algorithm = "aes"
decrypt.cipher_mode = "gcm"
decrypt.key_length = 256
decrypt:set_encoded_key(K, "hex")
decrypt:set_encoded_aad(AAD, "hex")

local bdFromEncryptor = chilkat.BinData.new()
bdFromEncryptor:append_encoded(concatenatedGcmOutput, "base64")

local sz = bdFromEncryptor.num_bytes

-- Extract the parts.
local extractedIV = bdFromEncryptor:get_encoded_chunk(0, 16, "hex")
local extractedCipherText = bdFromEncryptor:get_encoded_chunk(16, sz - 32, "base64")
local expectedAuthTag = bdFromEncryptor:get_encoded_chunk(sz - 16, 16, "base64")

-- Before GCM decrypting, we must set the authenticated tag to the value that is expected.
-- The decryption will fail if the resulting authenticated tag is not equal to the expected result.
success = decrypt:set_encoded_auth_tag(expectedAuthTag, "base64")

-- Also set the IV.
decrypt:set_encoded_iv(extractedIV, "hex")

-- Decrypt..
decrypt.encoding_mode = "base64"
decrypt.charset = "utf-8"
local decryptedText = decrypt:decrypt_string_enc(extractedCipherText)
if not decrypt.last_method_success then
    -- Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    print(decrypt.last_error_text)
    return
end

print("Decrypted: " .. decryptedText)