(SQL Server) AES CTR Mode Encryption

Demonstrates how to encrypt using AES CTR mode.

CTR mode is special in a few ways:

(1) Padding doesn't apply. Normally, a block encryption algorithm (AES, Blowfish, DES, RC2, etc.) emit encrypted output that is a multiple of the block size (16 bytes for AES as an example). With CTR mode, the number of bytes output is exactly equal to the number of bytes input, so no padding/unpadding is required. The PaddingScheme property does not apply for counter mode.

(2) CTR mode increments a counter for each subsequent block encrypted. For example, if an application encrypted the string "1234567890" twenty times in a row, using the same instance of the Chilkat Crypt2 object, then each iteration's result would be different. This is because the counter is being incremented. The decrypting application would need to decrypt in exactly the same manner. The 1st decrypt should begin with a new instance of a Crypt2 object so that it's counter is at the initial value of 0.

It would be a mistake to encrypt 20 strings using an instance of the Crypt2 object, and then attempt to decrypt with the same Crypt2 object. To decrypt successfully, the app would need to instantiate a new Crypt2 object and then decrypt, so that the counters match.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- This example assumes the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @crypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- AES is also known as Rijndael.		
    EXEC sp_OASetProperty @crypt, 'CryptAlgorithm', 'aes'

    -- CipherMode may be "ctr", "cfb", "ecb" or "cbc"
    EXEC sp_OASetProperty @crypt, 'CipherMode', 'ctr'

    -- KeyLength may be 128, 192, 256
    EXEC sp_OASetProperty @crypt, 'KeyLength', 256

    -- Counter mode emits the exact number of bytes input, and therefore 
    -- padding is not used.  The PaddingScheme property does not apply with CTR mode.

    -- EncodingMode specifies the encoding of the output for
    -- encryption, and the input for decryption.
    -- It may be "hex", "url", "base64", "quoted-printable", or many other choices.
    EXEC sp_OASetProperty @crypt, 'EncodingMode', 'hex'

    -- An initialization vector (nonce) is required if using CTR mode.
    -- The length of the IV is equal to the algorithm's block size.
    -- It is NOT equal to the length of the key.
    DECLARE @ivHex nvarchar(4000)
    SELECT @ivHex = '000102030405060708090A0B0C0D0E0F'
    EXEC sp_OAMethod @crypt, 'SetEncodedIV', NULL, @ivHex, 'hex'

    -- The secret key must equal the size of the key.  For
    -- 256-bit encryption, the binary secret key is 32 bytes.
    -- For 128-bit encryption, the binary secret key is 16 bytes.
    DECLARE @keyHex nvarchar(4000)
    SELECT @keyHex = '000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
    EXEC sp_OAMethod @crypt, 'SetEncodedKey', NULL, @keyHex, 'hex'

    -- Encrypt a string...
    -- The input string is 44 ANSI characters (i.e. 44 bytes), so
    -- the output should be 48 bytes (a multiple of 16).
    -- Because the output is a hex string, it should
    -- be 96 characters long (2 chars per byte).
    DECLARE @encStr nvarchar(4000)
    EXEC sp_OAMethod @crypt, 'EncryptStringENC', @encStr OUT, 'The quick red fox jumps over the sleeping dog.'

    PRINT @encStr

    DECLARE @decrypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @decrypt OUT

    EXEC sp_OASetProperty @decrypt, 'CryptAlgorithm', 'aes'
    EXEC sp_OASetProperty @decrypt, 'CipherMode', 'ctr'
    EXEC sp_OASetProperty @decrypt, 'KeyLength', 256
    EXEC sp_OASetProperty @decrypt, 'EncodingMode', 'hex'
    EXEC sp_OAMethod @decrypt, 'SetEncodedIV', NULL, @ivHex, 'hex'
    EXEC sp_OAMethod @decrypt, 'SetEncodedKey', NULL, @keyHex, 'hex'

    -- Now decrypt:
    DECLARE @decStr nvarchar(4000)
    EXEC sp_OAMethod @decrypt, 'DecryptStringENC', @decStr OUT, @encStr

    PRINT @decStr

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @decrypt


END
GO