Rust

Example: Crypt2.RandomizeIV method

Demonstrates using a random initialization vector for AES GCM encryption. Rust

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

let crypt = chilkat::Crypt2::new();

crypt.set_crypt_algorithm("aes");
crypt.set_cipher_mode("gcm");
crypt.set_key_length(256);

let k = "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F".to_string();
let aad = "feedfacedeadbeeffeedfacedeadbeefabaddad2".to_string();
let pt = "This is the text to be AES-GCM encrypted.".to_string();

// Generate a random IV.
crypt.randomize_iv();
let iv = crypt.get_encoded_iv("hex").unwrap_or_default();

crypt.set_encoded_key(&k, "hex");

let _ = crypt.set_encoded_aad(&aad, "hex").is_ok();

// Return the encrypted bytes as base64
crypt.set_encoding_mode("base64");
crypt.set_charset("utf-8");
let Ok(cipher_text) = crypt.encrypt_string_enc(&pt) else {
    println!("{}", crypt.last_error_text());
    return;
};

// Get the GCM authenticated tag computed when encrypting.
let auth_tag = crypt.get_encoded_auth_tag("base64").unwrap_or_default();

println!("Cipher Text: {}", cipher_text);
println!("Auth Tag: {}", auth_tag);

// Let's send the IV, CipherText, and AuthTag to the decrypting party.
// We'll send them concatenated like this: [IV || Ciphertext || AuthTag]
// In base64 format.
let bd_encrypted = chilkat::BinData::new();
let _ = bd_encrypted.append_encoded(&iv, "hex");
let _ = bd_encrypted.append_encoded(&cipher_text, "base64");
let _ = bd_encrypted.append_encoded(&auth_tag, "base64");

let concatenated_gcm_output = bd_encrypted.get_encoded("base64").unwrap_or_default();
println!("Concatenated GCM Output: {}", concatenated_gcm_output);

// Sample output so far:

// -------------------------------------------------------------------------------------
// Now let's GCM decrypt...
// -------------------------------------------------------------------------------------

let decrypt = chilkat::Crypt2::new();

// The values shared and agreed upon by both sides beforehand are: algorithm, cipher mode, secret key, and AAD.
// Sometimes the IV can be a value already known and agreed upon, but in this case the encryptor sends the IV to the decryptor.
decrypt.set_crypt_algorithm("aes");
decrypt.set_cipher_mode("gcm");
decrypt.set_key_length(256);
decrypt.set_encoded_key(&k, "hex");
let _ = decrypt.set_encoded_aad(&aad, "hex");

let bd_from_encryptor = chilkat::BinData::new();
let _ = bd_from_encryptor.append_encoded(&concatenated_gcm_output, "base64");

let sz = bd_from_encryptor.num_bytes();

// Extract the parts.
let extracted_iv = bd_from_encryptor.get_encoded_chunk(0, 16, "hex").unwrap_or_default();
let extracted_cipher_text = bd_from_encryptor.get_encoded_chunk(16, sz - 32, "base64").unwrap_or_default();
let expected_auth_tag = bd_from_encryptor.get_encoded_chunk(sz - 16, 16, "base64").unwrap_or_default();

// Before GCM decrypting, we must set the authenticated tag to the value that is expected.
// The decryption will fail if the resulting authenticated tag is not equal to the expected result.
let _ = decrypt.set_encoded_auth_tag(&expected_auth_tag, "base64").is_ok();

// Also set the IV.
decrypt.set_encoded_iv(&extracted_iv, "hex");

// Decrypt..
decrypt.set_encoding_mode("base64");
decrypt.set_charset("utf-8");
let Ok(decrypted_text) = decrypt.decrypt_string_enc(&extracted_cipher_text) else {
    // Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    println!("{}", decrypt.last_error_text());
    return;
};

println!("Decrypted: {}", decrypted_text);