AutoIt

AES GCM Encrypt and Decrypt a File

See more Encryption Examples

Demonstrates how to AES GCM encrypt and decrypt a file. AutoIt

Local $bSuccess = False

;  This example assumes the Chilkat API to have been previously unlocked.
;  See Global Unlock Sample for sample code.

$oCrypt = ObjCreate("Chilkat.Crypt2")

;  Set the encryption algorithm to "AES"	
$oCrypt.CryptAlgorithm = "aes"

;  Indicate that the Galois/Counter Mode (GCM) should be used:
$oCrypt.CipherMode = "gcm"

;  KeyLength may be 128, 192, 256
$oCrypt.KeyLength = 256

;  This is the 256-bit AES secret key (in hex format)
Local $sK = "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"

;  This is the 16-byte initialization vector (in hex format)
Local $sIV = "000102030405060708090A0B0C0D0E0F"

;  This is the OPTIONAL additional data (in hex format) to be used as input to the GCM AEAD algorithm,
;  but is not included in the output.  It plays a role in the computation of the
;  resulting authenticated tag.
Local $sAAD = "feedfacedeadbeeffeedfacedeadbeefabaddad2"

;  Set the secret key and IV
$oCrypt.SetEncodedIV $sIV,"hex"
$oCrypt.SetEncodedKey $sK,"hex"

;  Set the additional authenticated data (AAD)
$bSuccess = $oCrypt.SetEncodedAad($sAAD,"hex")

;  Encrypt a file.
Local $sInFile = "qa_data/hamlet.xml"
Local $sOutFile = "c:/temp/qa_output/hamlet_aes_gcm.enc"
$bSuccess = $oCrypt.CkEncryptFile($sInFile,$sOutFile)
If ($bSuccess = False) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

;  Get the authentication tag in hex format
Local $sAuthTag = $oCrypt.GetEncodedAuthTag("hex")
ConsoleWrite("authentication tag = " & $sAuthTag & @CRLF)

;  Decrypt..

;  Before decrypting, you must provide the expected authentication tag.
;  The decrypt will fail if the resulting authentication tag computed while decrypting is not equal to the
;  expected authentication tag.
$oCrypt.SetEncodedAuthTag($sAuthTag,"hex")

$sInFile = $sOutFile
$sOutFile = "c:/temp/qa_output/hamlet_restored.xml"
$bSuccess = $oCrypt.CkDecryptFile($sInFile,$sOutFile)
If ($bSuccess = False) Then
    ConsoleWrite($oCrypt.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("Success." & @CRLF)

;  --------------------------------------------------------------------------------------------
;  About AES-GCM:

;  AES-GCM (Advanced Encryption Standard - Galois/Counter Mode) is a widely-used
;  encryption mode that provides both confidentiality (encryption) and
;  integrity/authentication (data integrity verification) in one operation. It is
;  commonly used in secure communications due to its efficiency and strong security
;  properties.
;  
;  Key Concepts:
;  
;      AES (Advanced Encryption Standard):
;  
;          AES is a symmetric encryption algorithm, meaning the same key is used
;          for both encryption and decryption.
;  
;          It operates on fixed-size blocks of data (128 bits) using key sizes of
;          128, 192, or 256 bits.
;  
;          In AES-GCM, AES is used to perform the actual data encryption.
;  
;      GCM (Galois/Counter Mode):
;  
;          Counter Mode (CTR): GCM uses counter mode for encryption. In this mode,
;          a nonce (or initialization vector, IV) and a counter are combined and encrypted
;          with AES. The result is XORed with the plaintext to produce the ciphertext. 
;  
;          Galois Mode (GMAC): GCM also includes an authentication mechanism based
;          on a Galois field. It generates an authentication tag, which ensures the
;          integrity of both the ciphertext and any additional data (called AAD -
;          Additional Authenticated Data). This tag is verified during decryption to ensure
;          that the data hasn't been tampered with.
;  
;  Key Features:
;  
;      Confidentiality (Encryption):
;  
;          The plaintext is encrypted using AES in counter mode. Each block of
;          plaintext is XORed with the output of AES applied to a combination of the IV and
;          an incremented counter.
;  
;      Integrity (Authentication):
;  
;          In addition to encryption, GCM provides authentication for both the
;          encrypted data (ciphertext) and any Additional Authenticated Data (AAD), such as
;          headers or metadata that need to be protected but not encrypted.
;  
;          The authentication tag is generated using a Galois field multiplication
;          of the ciphertext and AAD. This ensures that any changes to the encrypted
;          message or the AAD will be detected during decryption.
;  
;  Key Components:
;  
;      - Plaintext: The data you want to encrypt.
;      - Ciphertext: The encrypted data.
;      - Key: A symmetric key used for both encryption and decryption.
;      - Nonce/IV: A unique value used for each encryption to ensure security. It is not secret but should never be reused with the same key.
;      - AAD (Additional Authenticated Data): Optional data that is not encrypted but needs to be authenticated (e.g., headers).
;      - Authentication Tag: A tag generated to verify the integrity and authenticity of the ciphertext and AAD.