(C#) Duplicate SQL Server ENCRYPTBYPASSPHRASE

See more Encryption Examples

Demonstrates how to duplicate SQL Server's ENCRYPTBYPASSPHRASE.

Chilkat .NET Downloads Chilkat .NET Framework Chilkat for .NET Core

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// For SQL Server 2008 - SQL Server 2016 we must use TripleDES with SHA1
// For SQL Server 2017 and later, use AES256 / SHA256.

string password = "tEst1234";
string encryptedHex_v1 = "0x010000001E8E7DCDBD4061B951999E25D18445D2305474D2D71EEE98A241C755246F58AB";

// Here's an encrypted string using AES256/SHA256
string encryptedHex_v2 = "0x02000000FFE880C0354780481E64EF25B6197A02E2A854A4BA9D8D9BDDFDAB27EB56537ABDA0B1D9C4D1050C91B313550DECF429";

Chilkat.StringBuilder sbEncHex = new Chilkat.StringBuilder();
sbEncHex.Append(encryptedHex_v1);

// If present, we don't want the leading "0x"
if (sbEncHex.StartsWith("0x",false) == true) {
    sbEncHex.RemoveCharsAt(0,2);
}

Chilkat.Crypt2 crypt = new Chilkat.Crypt2();
crypt.EncodingMode = "hex";

// The encrypted hex string will begin with either 01000000 or 02000000
// version 1 is produced by SQL Server 2008 to SQL Server 2016, and we must use TripleDES with SHA1
// version 2 is for SQL Server 2017 and later, and uses AES256 / SHA256.
bool v1 = sbEncHex.StartsWith("01",false);

int ivLen = 0;
string hashAlg;

if (v1 == true) {
    crypt.CryptAlgorithm = "3des";
    crypt.CipherMode = "cbc";
    crypt.KeyLength = 168;
    ivLen = 8;
    hashAlg = "sha1";
}
else {
    crypt.CryptAlgorithm = "aes";
    crypt.CipherMode = "cbc";
    crypt.KeyLength = 256;
    ivLen = 16;
    hashAlg = "sha256";
}

// Remove the SQL Server version info (i.e. the "01000000")
sbEncHex.RemoveCharsAt(0,8);

// Get the IV part of the sbEncHex, and also remove it from the StringBuilder.
string ivHex = sbEncHex.GetRange(0,ivLen * 2,true);
Debug.WriteLine("IV = " + ivHex);
crypt.SetEncodedIV(ivHex,"hex");

Chilkat.StringBuilder sbPassword = new Chilkat.StringBuilder();
sbPassword.Append(password);
string pwd_hash = sbPassword.GetHash(hashAlg,"hex","utf-16");
Chilkat.StringBuilder sbKey = new Chilkat.StringBuilder();
sbKey.Append(pwd_hash);
if (v1 == true) {
    // For v1, we only want the 1st 16 bytes of the 20 byte hash.
    // (remember, the hex encoding uses 2 chars per byte, so we remove the last 8 chars)
    sbKey.Shorten(8);
}

Debug.WriteLine("crypt key: " + sbKey.GetAsString());

crypt.SetEncodedKey(sbKey.GetAsString(),"hex");

// Decrypt
Chilkat.BinData bd = new Chilkat.BinData();
bd.AppendEncoded(sbEncHex.GetAsString(),"hex");
crypt.DecryptBd(bd);

// The result is composed of a header of 8 bytes which we can discard.
// The remainder is the decrypted text.

// The header we are discarding is composed of:
// Bytes 0-3: Magic number equal to 0DF0ADBA
// Bytes 4-5: Number of integrity bytes, which is 0 unless an authenticator is used. We're assuming no authenticator is used.
// Bytes 6-7: Number of plain-text bytes. We really don't need this because the CBC padding takes care of it.

// Therefore, just return the data after the 1st 8 bytes.
// Assuming the encrypted string was utf-8 text...
bd.RemoveChunk(0,8);
string plainText = bd.GetString("utf-8");
Debug.WriteLine("decrypted plain text: " + plainText);

// The output:

// IV = 1E8E7DCDBD4061B9
// crypt key: 710B9C2E61ACCC9570D4112203BD9738
// decrypted plain text: Hello world.

// ------------------------------------------------------------------------------------------
// To encrypt, do the reverse...

// Let's do v1 with TripleDES with SHA1

Chilkat.Crypt2 encryptor = new Chilkat.Crypt2();
encryptor.EncodingMode = "hex";

encryptor.CryptAlgorithm = "3des";
encryptor.CipherMode = "cbc";
encryptor.KeyLength = 168;

// Generate a random 8-byte IV
Chilkat.Prng prng = new Chilkat.Prng();
ivHex = prng.GenRandom(8,"hex");
encryptor.SetEncodedIV(ivHex,"hex");

// The binary password is generated the same as above.
// We'll use the same password (and same binary password)
encryptor.SetEncodedKey(sbKey.GetAsString(),"hex");

int plainTextLen = 8;
plainText = "ABCD1234";

// Encrypt the header + the plain-text.
Chilkat.BinData bdData = new Chilkat.BinData();
bdData.AppendEncoded("0DF0ADBA","hex");
bdData.AppendEncoded("0000","hex");
bdData.AppendInt2(plainTextLen,true);
Debug.WriteLine("header: " + bdData.GetEncoded("hex"));
bdData.AppendString(plainText,"utf-8");
encryptor.EncryptBd(bdData);

// Compose the result..
Chilkat.StringBuilder sbEnc = new Chilkat.StringBuilder();
sbEnc.Append("0x01000000");
sbEnc.Append(ivHex);
sbEnc.Append(bdData.GetEncoded("hex"));

Debug.WriteLine("result: " + sbEnc.GetAsString());