AutoIt

Duplicate SQL Server ENCRYPTBYPASSPHRASE

See more Encryption Examples

Demonstrates how to duplicate SQL Server's ENCRYPTBYPASSPHRASE. AutoIt

;  This example requires the Chilkat API to have been previously unlocked.
;  See Global Unlock Sample for sample code.

;  For SQL Server 2008 - SQL Server 2016 we must use TripleDES with SHA1
;  For SQL Server 2017 and later, use AES256 / SHA256.

Local $sPassword = "tEst1234"
Local $sEncryptedHex_v1 = "0x010000001E8E7DCDBD4061B951999E25D18445D2305474D2D71EEE98A241C755246F58AB"

;  Here's an encrypted string using AES256/SHA256
Local $sEncryptedHex_v2 = "0x02000000FFE880C0354780481E64EF25B6197A02E2A854A4BA9D8D9BDDFDAB27EB56537ABDA0B1D9C4D1050C91B313550DECF429"

$oSbEncHex = ObjCreate("Chilkat.StringBuilder")
$oSbEncHex.Append($sEncryptedHex_v1)

;  If present, we don't want the leading "0x"
If ($oSbEncHex.StartsWith("0x",False) = True) Then
    $oSbEncHex.RemoveCharsAt(0,2)
EndIf

$oCrypt = ObjCreate("Chilkat.Crypt2")
$oCrypt.EncodingMode = "hex"

;  The encrypted hex string will begin with either 01000000 or 02000000
;  version 1 is produced by SQL Server 2008 to SQL Server 2016, and we must use TripleDES with SHA1
;  version 2 is for SQL Server 2017 and later, and uses AES256 / SHA256.
Local $bV1 = $oSbEncHex.StartsWith("01",False)

Local $ivLen = 0
Local $sHashAlg

If ($bV1 = True) Then
    $oCrypt.CryptAlgorithm = "3des"
    $oCrypt.CipherMode = "cbc"
    $oCrypt.KeyLength = 168
    $ivLen = 8
    $sHashAlg = "sha1"
Else
    $oCrypt.CryptAlgorithm = "aes"
    $oCrypt.CipherMode = "cbc"
    $oCrypt.KeyLength = 256
    $ivLen = 16
    $sHashAlg = "sha256"
EndIf

;  Remove the SQL Server version info (i.e. the "01000000")
$oSbEncHex.RemoveCharsAt(0,8)

;  Get the IV part of the sbEncHex, and also remove it from the StringBuilder.
Local $sIvHex = $oSbEncHex.GetRange(0,$ivLen * 2,True)
ConsoleWrite("IV = " & $sIvHex & @CRLF)
$oCrypt.SetEncodedIV $sIvHex,"hex"

$oSbPassword = ObjCreate("Chilkat.StringBuilder")
$oSbPassword.Append($sPassword)
Local $sPwd_hash = $oSbPassword.GetHash($sHashAlg,"hex","utf-16")
$oSbKey = ObjCreate("Chilkat.StringBuilder")
$oSbKey.Append($sPwd_hash)
If ($bV1 = True) Then
    ;  For v1, we only want the 1st 16 bytes of the 20 byte hash.
    ;  (remember, the hex encoding uses 2 chars per byte, so we remove the last 8 chars)
    $oSbKey.Shorten(8)
EndIf

ConsoleWrite("crypt key: " & $oSbKey.GetAsString() & @CRLF)

$oCrypt.SetEncodedKey $oSbKey.GetAsString(),"hex"

;  Decrypt
$oBd = ObjCreate("Chilkat.BinData")
$oBd.AppendEncoded($oSbEncHex.GetAsString(),"hex")
$oCrypt.DecryptBd($oBd)

;  The result is composed of a header of 8 bytes which we can discard.
;  The remainder is the decrypted text.

;  The header we are discarding is composed of:
;  Bytes 0-3: Magic number equal to 0DF0ADBA
;  Bytes 4-5: Number of integrity bytes, which is 0 unless an authenticator is used. We're assuming no authenticator is used.
;  Bytes 6-7: Number of plain-text bytes. We really don't need this because the CBC padding takes care of it.

;  Therefore, just return the data after the 1st 8 bytes.
;  Assuming the encrypted string was utf-8 text...
$oBd.RemoveChunk(0,8)
Local $sPlainText = $oBd.GetString("utf-8")
ConsoleWrite("decrypted plain text: " & $sPlainText & @CRLF)

;  The output:

;  IV = 1E8E7DCDBD4061B9
;  crypt key: 710B9C2E61ACCC9570D4112203BD9738
;  decrypted plain text: Hello world.

;  ------------------------------------------------------------------------------------------
;  To encrypt, do the reverse...

;  Let's do v1 with TripleDES with SHA1

$oEncryptor = ObjCreate("Chilkat.Crypt2")
$oEncryptor.EncodingMode = "hex"

$oEncryptor.CryptAlgorithm = "3des"
$oEncryptor.CipherMode = "cbc"
$oEncryptor.KeyLength = 168

;  Generate a random 8-byte IV
$oPrng = ObjCreate("Chilkat.Prng")
$sIvHex = $oPrng.GenRandom(8,"hex")
$oEncryptor.SetEncodedIV $sIvHex,"hex"

;  The binary password is generated the same as above.
;  We'll use the same password (and same binary password)
$oEncryptor.SetEncodedKey $oSbKey.GetAsString(),"hex"

Local $iPlainTextLen = 8
$sPlainText = "ABCD1234"

;  Encrypt the header + the plain-text.
$oBdData = ObjCreate("Chilkat.BinData")
$oBdData.AppendEncoded("0DF0ADBA","hex")
$oBdData.AppendEncoded("0000","hex")
$oBdData.AppendInt2($iPlainTextLen,True)
ConsoleWrite("header: " & $oBdData.GetEncoded("hex") & @CRLF)
$oBdData.AppendString($sPlainText,"utf-8")
$oEncryptor.EncryptBd($oBdData)

;  Compose the result..
$oSbEnc = ObjCreate("Chilkat.StringBuilder")
$oSbEnc.Append("0x01000000")
$oSbEnc.Append($sIvHex)
$oSbEnc.Append($oBdData.GetEncoded("hex"))

ConsoleWrite("result: " & $oSbEnc.GetAsString() & @CRLF)