(SQL Server) Encrypt a File to a PKCS7 (CMS) Message

Shows how to encrypt a file into a PKCS7 encrypted message using the recipient's certificate. Public-key encryption requires no private key. However, the recipient's private key is necessary for decryption.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @crypt int
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- Load the recipient's digital certificate. 
    -- We don't need the private key for encryption.
    -- Only the public key is needed (which is included in a certificate).
    DECLARE @cert1 int
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert1 OUT

    DECLARE @success int
    EXEC sp_OAMethod @cert1, 'LoadFromFile', @success OUT, 'qa_data/user1/cert_user1.pem'
    -- Assume success for the example, but make sure your application checks for success/failure...
    EXEC sp_OAMethod @crypt, 'SetEncryptCert', @success OUT, @cert1

    -- Indicate that we want PKI encryption (i.e. public-key infrastructure)
    -- to produce a CMS message (Cryptographic Message Syntax/PKCS7),
    -- that is be created with RSAES-OAEP padding, SHA256, and AES-256 for the
    -- bulk encryption.
    EXEC sp_OASetProperty @crypt, 'CryptAlgorithm', 'pki'
    EXEC sp_OASetProperty @crypt, 'Pkcs7CryptAlg', 'aes'
    EXEC sp_OASetProperty @crypt, 'KeyLength', 256
    EXEC sp_OASetProperty @crypt, 'OaepHash', 'sha256'
    EXEC sp_OASetProperty @crypt, 'OaepPadding', 1

    -- Load the file to be encrypted...
    DECLARE @fileData int
    EXEC @hr = sp_OACreate 'Chilkat.BinData', @fileData OUT

    EXEC sp_OAMethod @fileData, 'LoadFile', @success OUT, 'qa_data/jpg/penguins.jpg'
    -- Your app should check for success/failure..

    -- Encrypt the data.  The contents of the fileData object are replaced with the PKCS7 encrypted message.
    EXEC sp_OAMethod @crypt, 'EncryptBd', @success OUT, @fileData
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert1
        EXEC @hr = sp_OADestroy @fileData
        RETURN
      END

    -- Save the PKCS7 encrypted message to a file..
    EXEC sp_OAMethod @fileData, 'WriteFile', @success OUT, 'qa_output/pkcs7_encrypted.p7'


    PRINT 'OK.'

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @cert1
    EXEC @hr = sp_OADestroy @fileData


END
GO