(DataFlex) RSA Encrypt/Decrypt AES Key

Demonstrates how to use RSA to protect a key for AES encryption. It can be used in this scenario: You will provide your RSA public key to any number of counterparts. Your counterpart will generate an AES key, encrypt data (or a file) using it, then encrypt the AES key using your RSA public key. Your counterpart sends you both the encrypted data and the encrypted key. Since you are the only one with access to the RSA private key, only you can decrypt the AES key. You decrypt the key, then decrypt the data using the AES key.

This example will show the entire process. (1) Generate an RSA key and save both private and public parts to PEM files. (2) Encrypt a file using a randomly generated AES encryption key. (3) RSA encrypt the AES key. (4) RSA decrypt the AES key. (5) Use it to AES decrypt the file or data.

Note: This example requires Chilkat v11.0.0 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoRsa
    Variant vPrivKey
    Handle hoPrivKey
    Variant vPubKey
    Handle hoPubKey
    Handle hoCrypt
    String sRandomKey
2    Handle hoRsa2
    Variant vPubKey2
    Handle hoPubKey2
    Boolean iBUsePrivateKey
    String sEncryptedAesKey
3    Handle hoRsa3
    Variant vPrivKey
2    Handle hoPrivKey2
    String sDecryptedAesKey
2    Handle hoCrypt2
    String sTemp1

    Move False To iSuccess

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // ------------------
    // Step 1.  Generate an RSA key and save to PEM files.

    Get Create (RefClass(cComChilkatRsa)) To hoRsa
    If (Not(IsComObjectCreated(hoRsa))) Begin
        Send CreateComObject of hoRsa
    End

    // Generate a 2048-bit key. 
    Get Create (RefClass(cComChilkatPrivateKey)) To hoPrivKey
    If (Not(IsComObjectCreated(hoPrivKey))) Begin
        Send CreateComObject of hoPrivKey
    End
    Get pvComObject of hoPrivKey to vPrivKey
    Get ComGenKey Of hoRsa 2048 vPrivKey To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoRsa To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatPublicKey)) To hoPubKey
    If (Not(IsComObjectCreated(hoPubKey))) Begin
        Send CreateComObject of hoPubKey
    End
    Get pvComObject of hoPubKey to vPubKey
    Get ComToPublicKey Of hoPrivKey vPubKey To iSuccess

    // For brevity, we are not checking the return value...
    Get ComSavePemFile Of hoPubKey False "qa_temp/pubKey.pem" To iSuccess
    Get ComSavePemFile Of hoPrivKey "qa_temp/privKey.pem" To iSuccess

    // Other methods exist for saving the private key in PKCS8 format,
    // both encrypted and un-encrypted..

    // ------------------
    // Step 2.   This is the code your counterpart will run to 
    // AES encrypt a file.  It generates a random AES key
    // to use for the encryption.

    Get Create (RefClass(cComChilkatCrypt2)) To hoCrypt
    If (Not(IsComObjectCreated(hoCrypt))) Begin
        Send CreateComObject of hoCrypt
    End

    Set ComCryptAlgorithm Of hoCrypt To "aes"
    Set ComCipherMode Of hoCrypt To "cbc"
    Set ComKeyLength Of hoCrypt To 256

    // Generate random bytes and return the random bytes
    // in a hex string:
    Set ComEncodingMode Of hoCrypt To "hex"
    Get ComGenRandomBytesENC Of hoCrypt 32 To sRandomKey
    Showln "AES key = " sRandomKey

    // Set the key.
    Send ComSetEncodedKey To hoCrypt sRandomKey "hex"

    // Set the IV to a known value that will be used on both sides.
    // (If desired, you could generate a random IV and protect it in the same
    // way as the key...)
    // The length of the IV for AES is always 16 bytes, regardless of the key size.
    Send ComSetEncodedIV To hoCrypt "000102030405060708090A0B0C0D0E0F" "hex"

    // AES Encrypt the file (the file may be any size because it will
    // stream the file in/out.
    Get ComCkEncryptFile Of hoCrypt "qa_data/hamlet.xml" "qa_temp/aesEncrypted.dat" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCrypt To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // ------------------
    // Step 3.
    // ------------------
    // RSA encrypt the AES key.
    // We'll pretend  your counter part has the public-key PEM file and needs
    // to load it.  Therefore, we'll start with a new RSA object and load
    // the public key from the PEM..
    Get Create (RefClass(cComChilkatRsa)) To hoRsa2
    If (Not(IsComObjectCreated(hoRsa2))) Begin
        Send CreateComObject of hoRsa2
    End

    Get Create (RefClass(cComChilkatPublicKey)) To hoPubKey2
    If (Not(IsComObjectCreated(hoPubKey2))) Begin
        Send CreateComObject of hoPubKey2
    End
    Get ComLoadFromFile Of hoPubKey2 "qa_temp/pubKey.pem" To iSuccess
    Get pvComObject of hoPubKey2 to vPubKey2
    Get ComUsePublicKey Of hoRsa2 vPubKey2 To iSuccess

    // RSA encrypt the AES key and return it as a base64 encoded string.
    Set ComEncodingMode Of hoRsa2 To "base64"
    Move False To iBUsePrivateKey
    Get ComEncryptStringENC Of hoRsa2 sRandomKey iBUsePrivateKey To sEncryptedAesKey

    // At this point, your counterpart sends you the encryptedAesKey,
    // and the encrypted file.

    // ------------------
    // Step 4 - RSA decrypt the AES key.
    // ------------------

    // Start with a new RSA object and load the private key from the PEM.
    Get Create (RefClass(cComChilkatRsa)) To hoRsa3
    If (Not(IsComObjectCreated(hoRsa3))) Begin
        Send CreateComObject of hoRsa3
    End
    Get Create (RefClass(cComChilkatPrivateKey)) To hoPrivKey2
    If (Not(IsComObjectCreated(hoPrivKey2))) Begin
        Send CreateComObject of hoPrivKey2
    End
    Get ComLoadPemFile Of hoPrivKey2 "qa_temp/privKey.pem" To iSuccess
    Get pvComObject of hoPrivKey2 to vPrivKey2
    Get ComUsePrivateKey Of hoRsa3 vPrivKey2 To iSuccess

    // The encrypted AES key is encoded using base64, so set
    // our EncodingMode to "base64".
    Set ComEncodingMode Of hoRsa3 To "base64"

    Move True To iBUsePrivateKey
    Get ComDecryptStringENC Of hoRsa3 sEncryptedAesKey iBUsePrivateKey To sDecryptedAesKey
    Showln "decryptedAesKey = " sDecryptedAesKey

    // ------------------
    // Step 5 - AES decrypt the file.
    // ------------------

    Get Create (RefClass(cComChilkatCrypt2)) To hoCrypt2
    If (Not(IsComObjectCreated(hoCrypt2))) Begin
        Send CreateComObject of hoCrypt2
    End

    Set ComCryptAlgorithm Of hoCrypt2 To "aes"
    Set ComCipherMode Of hoCrypt2 To "cbc"
    Set ComKeyLength Of hoCrypt2 To 256

    // Set the key.
    Send ComSetEncodedKey To hoCrypt2 sDecryptedAesKey "hex"

    // Set the IV 
    Send ComSetEncodedIV To hoCrypt2 "000102030405060708090A0B0C0D0E0F" "hex"

    // AES Decrypt the file (the file may be any size because it will
    // stream the file in/out.
    Get ComCkDecryptFile Of hoCrypt2 "qa_temp/aesEncrypted.dat" "qa_temp/decrypted.xml" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCrypt2 To sTemp1
        Showln sTemp1
        Procedure_Return
    End



End_Procedure