Perl

Example: Crypt2.RandomizeIV method

Demonstrates using a random initialization vector for AES GCM encryption. Chilkat2 Perl

use strict;
use warnings;
use Chilkat2;

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

my $crypt = Chilkat2::Crypt2->new;

$crypt->CryptAlgorithm('aes');
$crypt->CipherMode('gcm');
$crypt->KeyLength(256);

my $K = '000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F';
my $AAD = 'feedfacedeadbeeffeedfacedeadbeefabaddad2';
my $PT = 'This is the text to be AES-GCM encrypted.';

# Generate a random IV.
$crypt->RandomizeIV();
my $IV = $crypt->GetEncodedIV('hex');

$crypt->SetEncodedKey($K, 'hex');

my $success = $crypt->SetEncodedAad($AAD, 'hex');

# Return the encrypted bytes as base64
$crypt->EncodingMode('base64');
$crypt->Charset('utf-8');
my $cipherText = $crypt->EncryptStringENC($PT);
if (!$crypt->LastMethodSuccess) {
    print $crypt->LastErrorText, "\n";
    exit;
}

# Get the GCM authenticated tag computed when encrypting.
my $authTag = $crypt->GetEncodedAuthTag('base64');

print 'Cipher Text: ', $cipherText, "\n";
print 'Auth Tag: ', $authTag, "\n";

# Let's send the IV, CipherText, and AuthTag to the decrypting party.
# We'll send them concatenated like this: [IV || Ciphertext || AuthTag]
# In base64 format.
my $bdEncrypted = Chilkat2::BinData->new;
$bdEncrypted->AppendEncoded($IV, 'hex');
$bdEncrypted->AppendEncoded($cipherText, 'base64');
$bdEncrypted->AppendEncoded($authTag, 'base64');

my $concatenatedGcmOutput = $bdEncrypted->GetEncoded('base64');
print 'Concatenated GCM Output: ', $concatenatedGcmOutput, "\n";

# Sample output so far:

# -------------------------------------------------------------------------------------
# Now let's GCM decrypt...
# -------------------------------------------------------------------------------------

my $decrypt = Chilkat2::Crypt2->new;

# The values shared and agreed upon by both sides beforehand are: algorithm, cipher mode, secret key, and AAD.
# Sometimes the IV can be a value already known and agreed upon, but in this case the encryptor sends the IV to the decryptor.
$decrypt->CryptAlgorithm('aes');
$decrypt->CipherMode('gcm');
$decrypt->KeyLength(256);
$decrypt->SetEncodedKey($K, 'hex');
$decrypt->SetEncodedAad($AAD, 'hex');

my $bdFromEncryptor = Chilkat2::BinData->new;
$bdFromEncryptor->AppendEncoded($concatenatedGcmOutput, 'base64');

my $sz = $bdFromEncryptor->NumBytes;

# Extract the parts.
my $extractedIV = $bdFromEncryptor->GetEncodedChunk(0, 16, 'hex');
my $extractedCipherText = $bdFromEncryptor->GetEncodedChunk(16, $sz - 32, 'base64');
my $expectedAuthTag = $bdFromEncryptor->GetEncodedChunk($sz - 16, 16, 'base64');

# Before GCM decrypting, we must set the authenticated tag to the value that is expected.
# The decryption will fail if the resulting authenticated tag is not equal to the expected result.
$success = $decrypt->SetEncodedAuthTag($expectedAuthTag, 'base64');

# Also set the IV.
$decrypt->SetEncodedIV($extractedIV, 'hex');

# Decrypt..
$decrypt->EncodingMode('base64');
$decrypt->Charset('utf-8');
my $decryptedText = $decrypt->DecryptStringENC($extractedCipherText);
if (!$decrypt->LastMethodSuccess) {
    # Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    print $decrypt->LastErrorText, "\n";
    exit;
}

print 'Decrypted: ', $decryptedText, "\n";