(SQL Server) Example: Crypt2.RandomizeIV method

Demonstrates using a random initialization vector for AES GCM encryption.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example assumes the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @crypt int
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OASetProperty @crypt, 'CryptAlgorithm', 'aes'
    EXEC sp_OASetProperty @crypt, 'CipherMode', 'gcm'
    EXEC sp_OASetProperty @crypt, 'KeyLength', 256

    DECLARE @K nvarchar(4000)
    SELECT @K = '000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F'
    DECLARE @AAD nvarchar(4000)
    SELECT @AAD = 'feedfacedeadbeeffeedfacedeadbeefabaddad2'
    DECLARE @PT nvarchar(4000)
    SELECT @PT = 'This is the text to be AES-GCM encrypted.'

    -- Generate a random IV.
    EXEC sp_OAMethod @crypt, 'RandomizeIV', NULL
    DECLARE @IV nvarchar(4000)
    EXEC sp_OAMethod @crypt, 'GetEncodedIV', @IV OUT, 'hex'

    EXEC sp_OAMethod @crypt, 'SetEncodedKey', NULL, @K, 'hex'

    DECLARE @success int
    EXEC sp_OAMethod @crypt, 'SetEncodedAad', @success OUT, @AAD, 'hex'

    -- Return the encrypted bytes as base64
    EXEC sp_OASetProperty @crypt, 'EncodingMode', 'base64'
    EXEC sp_OASetProperty @crypt, 'Charset', 'utf-8'
    DECLARE @cipherText nvarchar(4000)
    EXEC sp_OAMethod @crypt, 'EncryptStringENC', @cipherText OUT, @PT
    EXEC sp_OAGetProperty @crypt, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        RETURN
      END

    -- Get the GCM authenticated tag computed when encrypting.
    DECLARE @authTag nvarchar(4000)
    EXEC sp_OAMethod @crypt, 'GetEncodedAuthTag', @authTag OUT, 'base64'


    PRINT 'Cipher Text: ' + @cipherText

    PRINT 'Auth Tag: ' + @authTag

    -- Let's send the IV, CipherText, and AuthTag to the decrypting party.
    -- We'll send them concatenated like this: [IV || Ciphertext || AuthTag]
    -- In base64 format.
    DECLARE @bdEncrypted int
    EXEC @hr = sp_OACreate 'Chilkat.BinData', @bdEncrypted OUT

    EXEC sp_OAMethod @bdEncrypted, 'AppendEncoded', @success OUT, @IV, 'hex'
    EXEC sp_OAMethod @bdEncrypted, 'AppendEncoded', @success OUT, @cipherText, 'base64'
    EXEC sp_OAMethod @bdEncrypted, 'AppendEncoded', @success OUT, @authTag, 'base64'

    DECLARE @concatenatedGcmOutput nvarchar(4000)
    EXEC sp_OAMethod @bdEncrypted, 'GetEncoded', @concatenatedGcmOutput OUT, 'base64'

    PRINT 'Concatenated GCM Output: ' + @concatenatedGcmOutput

    -- Sample output so far:

    -- -------------------------------------------------------------------------------------
    -- Now let's GCM decrypt...
    -- -------------------------------------------------------------------------------------

    DECLARE @decrypt int
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @decrypt OUT

    -- The values shared and agreed upon by both sides beforehand are: algorithm, cipher mode, secret key, and AAD.
    -- Sometimes the IV can be a value already known and agreed upon, but in this case the encryptor sends the IV to the decryptor.
    EXEC sp_OASetProperty @decrypt, 'CryptAlgorithm', 'aes'
    EXEC sp_OASetProperty @decrypt, 'CipherMode', 'gcm'
    EXEC sp_OASetProperty @decrypt, 'KeyLength', 256
    EXEC sp_OAMethod @decrypt, 'SetEncodedKey', NULL, @K, 'hex'
    EXEC sp_OAMethod @decrypt, 'SetEncodedAad', @success OUT, @AAD, 'hex'

    DECLARE @bdFromEncryptor int
    EXEC @hr = sp_OACreate 'Chilkat.BinData', @bdFromEncryptor OUT

    EXEC sp_OAMethod @bdFromEncryptor, 'AppendEncoded', @success OUT, @concatenatedGcmOutput, 'base64'

    DECLARE @sz int
    EXEC sp_OAGetProperty @bdFromEncryptor, 'NumBytes', @sz OUT

    -- Extract the parts.
    DECLARE @extractedIV nvarchar(4000)
    EXEC sp_OAMethod @bdFromEncryptor, 'GetEncodedChunk', @extractedIV OUT, 0, 16, 'hex'
    DECLARE @extractedCipherText nvarchar(4000)
    EXEC sp_OAMethod @bdFromEncryptor, 'GetEncodedChunk', @extractedCipherText OUT, 16, @sz - 32, 'base64'
    DECLARE @expectedAuthTag nvarchar(4000)
    EXEC sp_OAMethod @bdFromEncryptor, 'GetEncodedChunk', @expectedAuthTag OUT, @sz - 16, 16, 'base64'

    -- Before GCM decrypting, we must set the authenticated tag to the value that is expected.
    -- The decryption will fail if the resulting authenticated tag is not equal to the expected result.
    EXEC sp_OAMethod @decrypt, 'SetEncodedAuthTag', @success OUT, @expectedAuthTag, 'base64'

    -- Also set the IV.
    EXEC sp_OAMethod @decrypt, 'SetEncodedIV', NULL, @extractedIV, 'hex'

    -- Decrypt..
    EXEC sp_OASetProperty @decrypt, 'EncodingMode', 'base64'
    EXEC sp_OASetProperty @decrypt, 'Charset', 'utf-8'
    DECLARE @decryptedText nvarchar(4000)
    EXEC sp_OAMethod @decrypt, 'DecryptStringENC', @decryptedText OUT, @extractedCipherText
    EXEC sp_OAGetProperty @decrypt, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        -- Failed.  The resultant authenticated tag did not equal the expected authentication tag.
        EXEC sp_OAGetProperty @decrypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @bdEncrypted
        EXEC @hr = sp_OADestroy @decrypt
        EXEC @hr = sp_OADestroy @bdFromEncryptor
        RETURN
      END


    PRINT 'Decrypted: ' + @decryptedText

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @bdEncrypted
    EXEC @hr = sp_OADestroy @decrypt
    EXEC @hr = sp_OADestroy @bdFromEncryptor


END
GO