(SQL Server) How to Generate an Elliptic Curve Shared Secret

Demonstrates how to generate an ECC (Elliptic Curve Cryptography) shared secret. Imagine a cilent has one ECC private key, the server has another. A shared secret is computed by each side providing it's public key to the other. The private keys are kept private.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    -- This example includes both client-side and server-side code.
    -- Each code segment is marked as client-side or server-side.
    -- Imagine these segments are running on separate computers...

    DECLARE @success int

    -- -----------------------------------------------------------------
    -- (Client-Side) Generate an ECC key, save the public part to a file.
    -- -----------------------------------------------------------------
    DECLARE @prngClient int
    -- Use "Chilkat_9_5_0.Prng" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Prng', @prngClient OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @eccClient int
    -- Use "Chilkat_9_5_0.Ecc" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Ecc', @eccClient OUT

    DECLARE @privKeyClient int
    EXEC sp_OAMethod @eccClient, 'GenEccKey', @privKeyClient OUT, 'secp256r1', @prngClient
    EXEC sp_OAGetProperty @eccClient, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @eccClient, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @prngClient
        EXEC @hr = sp_OADestroy @eccClient
        RETURN
      END
    DECLARE @pubKeyClient int
    EXEC sp_OAMethod @privKeyClient, 'GetPublicKey', @pubKeyClient OUT
    EXEC sp_OAMethod @pubKeyClient, 'SavePemFile', @success OUT, 0, 'qa_output/eccClientPub.pem'
    EXEC @hr = sp_OADestroy @pubKeyClient

    -- -----------------------------------------------------------------
    -- (Server-Side) Generate an ECC key, save the public part to a file.
    -- -----------------------------------------------------------------
    DECLARE @prngServer int
    -- Use "Chilkat_9_5_0.Prng" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Prng', @prngServer OUT

    DECLARE @eccServer int
    -- Use "Chilkat_9_5_0.Ecc" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Ecc', @eccServer OUT

    DECLARE @privKeyServer int
    EXEC sp_OAMethod @eccServer, 'GenEccKey', @privKeyServer OUT, 'secp256r1', @prngServer
    EXEC sp_OAGetProperty @eccServer, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @eccServer, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @prngClient
        EXEC @hr = sp_OADestroy @eccClient
        EXEC @hr = sp_OADestroy @prngServer
        EXEC @hr = sp_OADestroy @eccServer
        RETURN
      END
    DECLARE @pubKeyServer int
    EXEC sp_OAMethod @privKeyServer, 'GetPublicKey', @pubKeyServer OUT
    EXEC sp_OAMethod @pubKeyServer, 'SavePemFile', @success OUT, 0, 'qa_output/eccServerPub.pem'
    EXEC @hr = sp_OADestroy @pubKeyServer

    -- -----------------------------------------------------------------
    -- (Client-Side) Generate the shared secret using our private key, and the other's public key.
    -- -----------------------------------------------------------------

    -- Imagine that the server sent the public key PEM to the client.
    -- (This is simulated by loading the server's public key from the file.
    DECLARE @pubKeyFromServer int
    -- Use "Chilkat_9_5_0.PublicKey" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.PublicKey', @pubKeyFromServer OUT

    EXEC sp_OAMethod @pubKeyFromServer, 'LoadFromFile', @success OUT, 'qa_output/eccServerPub.pem'
    DECLARE @sharedSecret1 nvarchar(4000)
    EXEC sp_OAMethod @eccClient, 'SharedSecretENC', @sharedSecret1 OUT, @privKeyClient, @pubKeyFromServer, 'base64'
    EXEC @hr = sp_OADestroy @privKeyClient

    -- -----------------------------------------------------------------
    -- (Server-Side) Generate the shared secret using our private key, and the other's public key.
    -- -----------------------------------------------------------------

    -- Imagine that the client sent the public key PEM to the server.
    -- (This is simulated by loading the client's public key from the file.
    DECLARE @pubKeyFromClient int
    -- Use "Chilkat_9_5_0.PublicKey" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.PublicKey', @pubKeyFromClient OUT

    EXEC sp_OAMethod @pubKeyFromClient, 'LoadFromFile', @success OUT, 'qa_output/eccClientPub.pem'
    DECLARE @sharedSecret2 nvarchar(4000)
    EXEC sp_OAMethod @eccServer, 'SharedSecretENC', @sharedSecret2 OUT, @privKeyServer, @pubKeyFromClient, 'base64'
    EXEC @hr = sp_OADestroy @privKeyServer

    -- ---------------------------------------------------------
    -- Examine the shared secrets.  They should be the same.
    -- Both sides now have a secret that only they know.
    -- ---------------------------------------------------------

    PRINT @sharedSecret1

    PRINT @sharedSecret2

    EXEC @hr = sp_OADestroy @prngClient
    EXEC @hr = sp_OADestroy @eccClient
    EXEC @hr = sp_OADestroy @prngServer
    EXEC @hr = sp_OADestroy @eccServer
    EXEC @hr = sp_OADestroy @pubKeyFromServer
    EXEC @hr = sp_OADestroy @pubKeyFromClient


END
GO