Rust

Duplicate SQL Server ENCRYPTBYPASSPHRASE

See more Encryption Examples

Demonstrates how to duplicate SQL Server's ENCRYPTBYPASSPHRASE. Rust

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// For SQL Server 2008 - SQL Server 2016 we must use TripleDES with SHA1
// For SQL Server 2017 and later, use AES256 / SHA256.

let password = "tEst1234".to_string();
let encrypted_hex_v1 = "0x010000001E8E7DCDBD4061B951999E25D18445D2305474D2D71EEE98A241C755246F58AB".to_string();

// Here's an encrypted string using AES256/SHA256
let encrypted_hex_v2 = "0x02000000FFE880C0354780481E64EF25B6197A02E2A854A4BA9D8D9BDDFDAB27EB56537ABDA0B1D9C4D1050C91B313550DECF429".to_string();

let sb_enc_hex = chilkat::StringBuilder::new();
let _ = sb_enc_hex.append(&encrypted_hex_v1);

// If present, we don't want the leading "0x"
if sb_enc_hex.starts_with("0x", false) {
    let _ = sb_enc_hex.remove_chars_at(0, 2);
}

let crypt = chilkat::Crypt2::new();
crypt.set_encoding_mode("hex");

// The encrypted hex string will begin with either 01000000 or 02000000
// version 1 is produced by SQL Server 2008 to SQL Server 2016, and we must use TripleDES with SHA1
// version 2 is for SQL Server 2017 and later, and uses AES256 / SHA256.
let v1 = sb_enc_hex.starts_with("01", false);

let mut iv_len = 0;
let mut hash_alg = String::new();

if v1 {
    crypt.set_crypt_algorithm("3des");
    crypt.set_cipher_mode("cbc");
    crypt.set_key_length(168);
    iv_len = 8;
    hash_alg = "sha1".to_string();
} else {
    crypt.set_crypt_algorithm("aes");
    crypt.set_cipher_mode("cbc");
    crypt.set_key_length(256);
    iv_len = 16;
    hash_alg = "sha256".to_string();
}

// Remove the SQL Server version info (i.e. the "01000000")
let _ = sb_enc_hex.remove_chars_at(0, 8);

// Get the IV part of the sbEncHex, and also remove it from the StringBuilder.
let mut iv_hex = sb_enc_hex.get_range(0, iv_len * 2, true).unwrap_or_default();
println!("IV = {}", iv_hex);
crypt.set_encoded_iv(&iv_hex, "hex");

let sb_password = chilkat::StringBuilder::new();
let _ = sb_password.append(&password);
let pwd_hash = sb_password.get_hash(&hash_alg, "hex", "utf-16").unwrap_or_default();
let sb_key = chilkat::StringBuilder::new();
let _ = sb_key.append(&pwd_hash);
if v1 {
    // For v1, we only want the 1st 16 bytes of the 20 byte hash.
    // (remember, the hex encoding uses 2 chars per byte, so we remove the last 8 chars)
    let _ = sb_key.shorten(8);
}

println!("crypt key: {}", sb_key.get_as_string().unwrap_or_default());

crypt.set_encoded_key(&sb_key.get_as_string().unwrap_or_default(), "hex");

// Decrypt
let bd = chilkat::BinData::new();
let _ = bd.append_encoded(&sb_enc_hex.get_as_string().unwrap_or_default(), "hex");
let _ = crypt.decrypt_bd(&bd);

// The result is composed of a header of 8 bytes which we can discard.
// The remainder is the decrypted text.

// The header we are discarding is composed of:
// Bytes 0-3: Magic number equal to 0DF0ADBA
// Bytes 4-5: Number of integrity bytes, which is 0 unless an authenticator is used. We're assuming no authenticator is used.
// Bytes 6-7: Number of plain-text bytes. We really don't need this because the CBC padding takes care of it.

// Therefore, just return the data after the 1st 8 bytes.
// Assuming the encrypted string was utf-8 text...
let _ = bd.remove_chunk(0, 8);
let mut plain_text = bd.get_string("utf-8").unwrap_or_default();
println!("decrypted plain text: {}", plain_text);

// The output:

// IV = 1E8E7DCDBD4061B9
// crypt key: 710B9C2E61ACCC9570D4112203BD9738
// decrypted plain text: Hello world.

// ------------------------------------------------------------------------------------------
// To encrypt, do the reverse...

// Let's do v1 with TripleDES with SHA1

let encryptor = chilkat::Crypt2::new();
encryptor.set_encoding_mode("hex");

encryptor.set_crypt_algorithm("3des");
encryptor.set_cipher_mode("cbc");
encryptor.set_key_length(168);

// Generate a random 8-byte IV
let prng = chilkat::Prng::new();
iv_hex = prng.gen_random(8, "hex").unwrap_or_default();
encryptor.set_encoded_iv(&iv_hex, "hex");

// The binary password is generated the same as above.
// We'll use the same password (and same binary password)
encryptor.set_encoded_key(&sb_key.get_as_string().unwrap_or_default(), "hex");

let plain_text_len = 8;
plain_text = "ABCD1234".to_string();

// Encrypt the header + the plain-text.
let bd_data = chilkat::BinData::new();
let _ = bd_data.append_encoded("0DF0ADBA", "hex");
let _ = bd_data.append_encoded("0000", "hex");
let _ = bd_data.append_int2(plain_text_len, true);
println!("header: {}", bd_data.get_encoded("hex").unwrap_or_default());
let _ = bd_data.append_string(&plain_text, "utf-8");
let _ = encryptor.encrypt_bd(&bd_data);

// Compose the result..
let sb_enc = chilkat::StringBuilder::new();
let _ = sb_enc.append("0x01000000");
let _ = sb_enc.append(&iv_hex);
let _ = sb_enc.append(&bd_data.get_encoded("hex").unwrap_or_default());

println!("result: {}", sb_enc.get_as_string().unwrap_or_default());