Xbase++

Example: Crypt2.RandomizeIV method

Demonstrates using a random initialization vector for AES GCM encryption. Xbase++

LOCAL nSuccess
LOCAL oCrypt
LOCAL K
LOCAL cAAD
LOCAL cPT
LOCAL cIV
LOCAL cCipherText
LOCAL cAuthTag
LOCAL oBdEncrypted
LOCAL cConcatenatedGcmOutput
LOCAL oDecrypt
LOCAL oBdFromEncryptor
LOCAL nSz
LOCAL cExtractedIV
LOCAL cExtractedCipherText
LOCAL cExpectedAuthTag
LOCAL cDecryptedText

nSuccess := 0

//  This example assumes the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

oCrypt := CreateObject("Chilkat.Crypt2")

oCrypt:CryptAlgorithm := "aes"
oCrypt:CipherMode := "gcm"
oCrypt:KeyLength := 256

K := "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
cAAD := "feedfacedeadbeeffeedfacedeadbeefabaddad2"
cPT := "This is the text to be AES-GCM encrypted."

//  Generate a random IV.
oCrypt:RandomizeIV()
cIV := oCrypt:GetEncodedIV("hex")

oCrypt:SetEncodedKey(K, "hex")

nSuccess := oCrypt:SetEncodedAad(cAAD, "hex")

//  Return the encrypted bytes as base64
oCrypt:EncodingMode := "base64"
oCrypt:Charset := "utf-8"
cCipherText := oCrypt:EncryptStringENC(cPT)
IF (oCrypt:LastMethodSuccess != 1)
    ? oCrypt:LastErrorText
    oCrypt:destroy()
    RETURN
ENDIF

//  Get the GCM authenticated tag computed when encrypting.
cAuthTag := oCrypt:GetEncodedAuthTag("base64")

? "Cipher Text: " + cCipherText
? "Auth Tag: " + cAuthTag

//  Let's send the IV, CipherText, and AuthTag to the decrypting party.
//  We'll send them concatenated like this: [IV || Ciphertext || AuthTag]
//  In base64 format.
oBdEncrypted := CreateObject("Chilkat.BinData")
oBdEncrypted:AppendEncoded(cIV, "hex")
oBdEncrypted:AppendEncoded(cCipherText, "base64")
oBdEncrypted:AppendEncoded(cAuthTag, "base64")

cConcatenatedGcmOutput := oBdEncrypted:GetEncoded("base64")
? "Concatenated GCM Output: " + cConcatenatedGcmOutput

//  Sample output so far:

//  -------------------------------------------------------------------------------------
//  Now let's GCM decrypt...
//  -------------------------------------------------------------------------------------

oDecrypt := CreateObject("Chilkat.Crypt2")

//  The values shared and agreed upon by both sides beforehand are: algorithm, cipher mode, secret key, and AAD.
//  Sometimes the IV can be a value already known and agreed upon, but in this case the encryptor sends the IV to the decryptor.
oDecrypt:CryptAlgorithm := "aes"
oDecrypt:CipherMode := "gcm"
oDecrypt:KeyLength := 256
oDecrypt:SetEncodedKey(K, "hex")
oDecrypt:SetEncodedAad(cAAD, "hex")

oBdFromEncryptor := CreateObject("Chilkat.BinData")
oBdFromEncryptor:AppendEncoded(cConcatenatedGcmOutput, "base64")

nSz := oBdFromEncryptor:NumBytes

//  Extract the parts.
cExtractedIV := oBdFromEncryptor:GetEncodedChunk(0, 16, "hex")
cExtractedCipherText := oBdFromEncryptor:GetEncodedChunk(16, nSz - 32, "base64")
cExpectedAuthTag := oBdFromEncryptor:GetEncodedChunk(nSz - 16, 16, "base64")

//  Before GCM decrypting, we must set the authenticated tag to the value that is expected.
//  The decryption will fail if the resulting authenticated tag is not equal to the expected result.
nSuccess := oDecrypt:SetEncodedAuthTag(cExpectedAuthTag, "base64")

//  Also set the IV.
oDecrypt:SetEncodedIV(cExtractedIV, "hex")

//  Decrypt..
oDecrypt:EncodingMode := "base64"
oDecrypt:Charset := "utf-8"
cDecryptedText := oDecrypt:DecryptStringENC(cExtractedCipherText)
IF (oDecrypt:LastMethodSuccess != 1)
    //  Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    ? oDecrypt:LastErrorText
    oCrypt:destroy()
    oBdEncrypted:destroy()
    oDecrypt:destroy()
    oBdFromEncryptor:destroy()
    RETURN
ENDIF

? "Decrypted: " + cDecryptedText

oCrypt:destroy()
oBdEncrypted:destroy()
oDecrypt:destroy()
oBdFromEncryptor:destroy()