AutoIt

AES GCM Encrypt and Decrypt a File

See more Encryption Examples

Demonstrates how to AES GCM encrypt and decrypt a file. AutoIt

Local $bSuccess = False

; This example assumes the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

$oCrypt = ObjCreate("Chilkat.Crypt2")

; Set the encryption algorithm to "AES"	
$oCrypt.CryptAlgorithm = "aes"

; Indicate that the Galois/Counter Mode (GCM) should be used:
$oCrypt.CipherMode = "gcm"

; KeyLength may be 128, 192, 256
$oCrypt.KeyLength = 256

; This is the 256-bit AES secret key (in hex format)
Local $sK = "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"

; This is the 16-byte initialization vector (in hex format)
Local $sIV = "000102030405060708090A0B0C0D0E0F"

; This is the OPTIONAL additional data (in hex format) to be used as input to the GCM AEAD algorithm,
; but is not included in the output.  It plays a role in the computation of the
; resulting authenticated tag.
Local $sAAD = "feedfacedeadbeeffeedfacedeadbeefabaddad2"

; Set the secret key and IV
$oCrypt.SetEncodedIV $sIV,"hex"
$oCrypt.SetEncodedKey $sK,"hex"

; Set the additional authenticated data (AAD)
$bSuccess = $oCrypt.SetEncodedAad($sAAD,"hex")

; Encrypt a file.
Local $sInFile = "qa_data/hamlet.xml"
Local $sOutFile = "c:/temp/qa_output/hamlet_aes_gcm.enc"
$bSuccess = $oCrypt.CkEncryptFile($sInFile,$sOutFile)
If ($bSuccess = False) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

; Get the authentication tag in hex format
Local $sAuthTag = $oCrypt.GetEncodedAuthTag("hex")
ConsoleWrite("authentication tag = " & $sAuthTag & @CRLF)

; Decrypt..

; Before decrypting, you must provide the expected authentication tag.
; The decrypt will fail if the resulting authentication tag computed while decrypting is not equal to the
; expected authentication tag.
$oCrypt.SetEncodedAuthTag($sAuthTag,"hex")

$sInFile = $sOutFile
$sOutFile = "c:/temp/qa_output/hamlet_restored.xml"
$bSuccess = $oCrypt.CkDecryptFile($sInFile,$sOutFile)
If ($bSuccess = False) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("Success." & @CRLF)

; --------------------------------------------------------------------------------------------
; About AES-GCM:

; AES-GCM (Advanced Encryption Standard - Galois/Counter Mode) is a widely-used
; encryption mode that provides both confidentiality (encryption) and
; integrity/authentication (data integrity verification) in one operation. It is
; commonly used in secure communications due to its efficiency and strong security
; properties.
; 
; Key Concepts:
; 
;     AES (Advanced Encryption Standard):
; 
;         AES is a symmetric encryption algorithm, meaning the same key is used
;         for both encryption and decryption.
; 
;         It operates on fixed-size blocks of data (128 bits) using key sizes of
;         128, 192, or 256 bits.
; 
;         In AES-GCM, AES is used to perform the actual data encryption.
; 
;     GCM (Galois/Counter Mode):
; 
;         Counter Mode (CTR): GCM uses counter mode for encryption. In this mode,
;         a nonce (or initialization vector, IV) and a counter are combined and encrypted
;         with AES. The result is XORed with the plaintext to produce the ciphertext. 
; 
;         Galois Mode (GMAC): GCM also includes an authentication mechanism based
;         on a Galois field. It generates an authentication tag, which ensures the
;         integrity of both the ciphertext and any additional data (called AAD -
;         Additional Authenticated Data). This tag is verified during decryption to ensure
;         that the data hasn't been tampered with.
; 
; Key Features:
; 
;     Confidentiality (Encryption):
; 
;         The plaintext is encrypted using AES in counter mode. Each block of
;         plaintext is XORed with the output of AES applied to a combination of the IV and
;         an incremented counter.
; 
;     Integrity (Authentication):
; 
;         In addition to encryption, GCM provides authentication for both the
;         encrypted data (ciphertext) and any Additional Authenticated Data (AAD), such as
;         headers or metadata that need to be protected but not encrypted.
; 
;         The authentication tag is generated using a Galois field multiplication
;         of the ciphertext and AAD. This ensures that any changes to the encrypted
;         message or the AAD will be detected during decryption.
; 
; Key Components:
; 
;     - Plaintext: The data you want to encrypt.
;     - Ciphertext: The encrypted data.
;     - Key: A symmetric key used for both encryption and decryption.
;     - Nonce/IV: A unique value used for each encryption to ensure security. It is not secret but should never be reused with the same key.
;     - AAD (Additional Authenticated Data): Optional data that is not encrypted but needs to be authenticated (e.g., headers).
;     - Authentication Tag: A tag generated to verify the integrity and authenticity of the ciphertext and AAD