PowerBuilder

AEAD AES 128-bit GCM

See more Encryption Examples

Demonstrates AES encryption using the Galois/Counter Mode (GCM). GCM is an authenticated encryption mode with "additional data" (often referred to as AEAD). GCM is a cipher mode that can be applied to any symmetric encryption algorithm with a 16-byte block size, such as AES and Twofish. In GCM mode, the block encryption algorithm is transformed into a stream encryption algorithm, and therefore no padding occurs (and the PaddingScheme property does not apply). The "additional data" (known as the AAD) does not get encrypted but plays a role in the computation of the resulting "authenticated tag". PowerBuilder

integer li_rc
long li_Success
oleobject loo_Crypt
string K
string ls_IV
string ls_AAD
string ls_PT
string ls_CT
string T
string ls_CtResult
string ls_TResult
string ls_PtResult
string ls_TInvalid

li_Success = 0

//  This example assumes the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

loo_Crypt = create oleobject
li_rc = loo_Crypt.ConnectToNewObject("Chilkat.Crypt2")
if li_rc < 0 then
    destroy loo_Crypt
    MessageBox("Error","Connecting to COM object failed")
    return
end if

//  Set the encryption algorithm to "AES"	
loo_Crypt.CryptAlgorithm = "aes"

//  Indicate that the Galois/Counter Mode (GCM) should be used:
loo_Crypt.CipherMode = "gcm"

//  KeyLength may be 128, 192, 256
loo_Crypt.KeyLength = 128

//  This is the 128-bit AES secret key (in hex format)
K = "feffe9928665731c6d6a8f9467308308"

//  This is the 16-byte initialization vector:
ls_IV = "cafebabefacedbaddecaf888"

//  This is the additional data to be used as input to the GCM AEAD algorithm,
//  but is not included in the output.  It plays a role in the computation of the
//  resulting authenticated tag.
ls_AAD = "feedfacedeadbeeffeedfacedeadbeefabaddad2"

//  The plain-text bytes (in hex format) to be encrypted.
ls_PT = "d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39"

//  The expected cipher text (in hex format)
ls_CT = "42831ec2217774244b7221b784d0d49ce3aa212f2c02a4e035c17e2329aca12e21d514b25466931c7d8f6a5aac84aa051ba30b396a0aac973d58e091"

//  The expected authenticated tag given the above inputs.
T = "5bc94fbc3221a5db94fae95ae7121a47"

//  Note: The above data are the values for test vector #4 from 
//  the PDF document at: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf

//  EncodingMode specifies the encoding of the output for
//  encryption, and the input for decryption.
//  It may be "hex", "url", "base64", or "quoted-printable".
loo_Crypt.EncodingMode = "hex"

//  Set the secret key and IV
loo_Crypt.SetEncodedIV(ls_IV,"hex")
loo_Crypt.SetEncodedKey(K,"hex")

//  Set the additional authenticated data (AAD)
li_Success = loo_Crypt.SetEncodedAad(ls_AAD,"hex")

//  For the purpose of duplicating the test vectors, we are using the EncryptEncoded method.
//  This method decodes the input string according to the encoding specified by the EncodingMode
//  property, which in this case is "hex".  The decoded bytes are encrypted using the mode specified
//  by the CipherMode property.  The resulting
//  encrypted bytes are encoded (again using the encoding mode specified by EncodingMode),
//  and the result is returned.
//  <b>Note:</b> The CipherMode property sets the block mode of operation (gcm, cfb, cbc, ofb, ecb, etc.) 
//  for any of the Chilkat encryption/decryption methods (such as EncryptBytes, EncryptString, 
//  CkEncryptFile, etc.)   Just because GCM mode is demonstrated with EncryptEncoded/DecryptEncoded,
//  does not imply that GCM mode is specific to only these methods.
ls_CtResult = loo_Crypt.EncryptEncoded(ls_PT)
if loo_Crypt.LastMethodSuccess <> 1 then
    Write-Debug loo_Crypt.LastErrorText
    destroy loo_Crypt
    return
end if

//  Examine the result.  It should be the same (case insensitive) as our expected result:
Write-Debug "computed result: " + ls_CtResult
Write-Debug "expected result: " + ls_CT

//  Examine the authenticated tag. It should be the same (case insensitive) as our expected authenticated tag:
ls_TResult = loo_Crypt.GetEncodedAuthTag("hex")
Write-Debug "computed authTag: " + ls_TResult
Write-Debug "expected authTag: " + T

//  -------------------------------------------------------------------------------------
//  Now let's GCM decrypt...
//  -------------------------------------------------------------------------------------

//  Before GCM decrypting, we must set the authenticated tag to the value that is expected.
//  The decryption will fail if the resulting authenticated tag is not equal (case insensitive) to 
//  the expected result.
//  Note: The return value of SetEncodedAuthTag indicates whether the string passed was a valid
//  representation of the encoding specified in the 2nd arg.
li_Success = loo_Crypt.SetEncodedAuthTag(T,"hex")

//  All of our properties (IV, secret key, cipher mode, and AAD) are already set from the code above...

//  So let's decrypt CT to and check to see if we get PT.
ls_PtResult = loo_Crypt.DecryptEncoded(ls_CT)
if loo_Crypt.LastMethodSuccess <> 1 then
    //  Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    Write-Debug loo_Crypt.LastErrorText
    destroy loo_Crypt
    return
end if

//  Examine the decrypted result.  It should be the same as our expected plaintext (case insensitive)
Write-Debug "plaintext decrypted: " + ls_PtResult
Write-Debug "plaintext expected:  " + ls_PT

//  Let's intentionally set the expected authenticated tag to an incorrect value. 
//  The decrypt operation should fail:
ls_TInvalid = "ffaabbbc3221a5db94fae95ae7121a47"

li_Success = loo_Crypt.SetEncodedAuthTag(ls_TInvalid,"hex")

ls_PtResult = loo_Crypt.DecryptEncoded(ls_CT)
if loo_Crypt.LastMethodSuccess <> 1 then
    //  Failed.  The resultant authenticated tag did not equal the expected authentication tag.
    Write-Debug loo_Crypt.LastErrorText
end if



destroy loo_Crypt