Tcl

Encrypt a file to a PKCS7 encrypted message using multiple certificates from different users

See more Encryption Examples

Demonstrates how to encrypt a file to a PKCS7 encrypted message using multiple certificates from different users. Any one of the users can decrypt using his/her own certificate + private key.

Note: When doing public key encryption, it is the public key that is used to encrypt. The private key is required for decryption.

Tcl

load ./chilkat.dll

set success 0

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set crypt [new_CkCrypt2]

# Tell the crypt object to use 3 certificates.
# Do this by calling AddEncryptCert for each certificate.

# Load a digital certificate. 
# We don't need the private key for encryption.
# Only the public key is needed (which is included in a certificate).
set cert1 [new_CkCert]

set success [CkCert_LoadFromFile $cert1 "qa_data/user1/cert_user1.pem"]
# Assume success for the example, but make sure your application checks for success/failure...
CkCrypt2_AddEncryptCert $crypt $cert1

set cert2 [new_CkCert]

set success [CkCert_LoadFromFile $cert2 "qa_data/user2/cert_user2.pem"]
CkCrypt2_AddEncryptCert $crypt $cert2

set cert3 [new_CkCert]

set success [CkCert_LoadFromFile $cert3 "qa_data/user3/cert_user3.pem"]
CkCrypt2_AddEncryptCert $crypt $cert3

# Indicate that we want PKI encryption (i.e. public-key infrastructure)
# to produce a CMS message (Cryptographic Message Syntax/PKCS7),
# that is be created with RSAES-OAEP padding, SHA256, and AES-128 for the
# bulk encryption.
CkCrypt2_put_CryptAlgorithm $crypt "pki"
CkCrypt2_put_Pkcs7CryptAlg $crypt "aes"
CkCrypt2_put_KeyLength $crypt 128
CkCrypt2_put_OaepHash $crypt "sha256"
CkCrypt2_put_OaepPadding $crypt 1

# Load the file to be encrypted...
set fileData [new_CkBinData]

set success [CkBinData_LoadFile $fileData "qa_data/jpg/penguins.jpg"]
# Your app should check for success/failure..

# Encrypt the data.  The contents of the fileData object are replaced with the PKCS7 encrypted message.
set success [CkCrypt2_EncryptBd $crypt $fileData]
if {$success != 1} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCrypt2 $crypt
    delete_CkCert $cert1
    delete_CkCert $cert2
    delete_CkCert $cert3
    delete_CkBinData $fileData
    exit
}

# Save the PKCS7 encrypted message to a file..
set success [CkBinData_WriteFile $fileData "qa_output/pkcs7_encrypted.p7"]

# Now indicate that the PKCS7 output is to be returned in the base64 encoding.
CkCrypt2_put_EncodingMode $crypt "base64"

puts "OK."

delete_CkCrypt2 $crypt
delete_CkCert $cert1
delete_CkCert $cert2
delete_CkCert $cert3
delete_CkBinData $fileData