(SQL Server) Encrypt a file to a PKCS7 encrypted message using multiple certificates from different users

Demonstrates how to encrypt a file to a PKCS7 encrypted message using multiple certificates from different users. Any one of the users can decrypt using his/her own certificate + private key.

Note: When doing public key encryption, it is the public key that is used to encrypt. The private key is required for decryption.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat Crypt API to have been previously unlocked.
    -- See Unlock Chilkat Crypt for sample code.

    DECLARE @crypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- Tell the crypt object to use 3 certificates.
    -- Do this by calling AddEncryptCert for each certificate.

    -- Load a digital certificate. 
    -- We don't need the private key for encryption.
    -- Only the public key is needed (which is included in a certificate).
    DECLARE @cert1 int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert1 OUT

    DECLARE @success int
    EXEC sp_OAMethod @cert1, 'LoadFromFile', @success OUT, 'qa_data/user1/cert_user1.pem'
    -- Assume success for the example, but make sure your application checks for success/failure...
    EXEC sp_OAMethod @crypt, 'AddEncryptCert', NULL, @cert1

    DECLARE @cert2 int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert2 OUT

    EXEC sp_OAMethod @cert2, 'LoadFromFile', @success OUT, 'qa_data/user2/cert_user2.pem'
    EXEC sp_OAMethod @crypt, 'AddEncryptCert', NULL, @cert2

    DECLARE @cert3 int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert3 OUT

    EXEC sp_OAMethod @cert3, 'LoadFromFile', @success OUT, 'qa_data/user3/cert_user3.pem'
    EXEC sp_OAMethod @crypt, 'AddEncryptCert', NULL, @cert3

    -- Indicate that we want PKI encryption (i.e. public-key infrastructure)
    -- to produce a CMS message (Cryptographic Message Syntax/PKCS7),
    -- that is be created with RSAES-OAEP padding, SHA256, and AES-128 for the
    -- bulk encryption.
    EXEC sp_OASetProperty @crypt, 'CryptAlgorithm', 'pki'
    EXEC sp_OASetProperty @crypt, 'Pkcs7CryptAlg', 'aes'
    EXEC sp_OASetProperty @crypt, 'KeyLength', 128
    EXEC sp_OASetProperty @crypt, 'OaepHash', 'sha256'
    EXEC sp_OASetProperty @crypt, 'OaepPadding', 1

    -- Load the file to be encrypted...
    DECLARE @fileData int
    -- Use "Chilkat_9_5_0.BinData" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.BinData', @fileData OUT

    EXEC sp_OAMethod @fileData, 'LoadFile', @success OUT, 'qa_data/jpg/penguins.jpg'
    -- Your app should check for success/failure..

    -- Encrypt the data.  The contents of the fileData object are replaced with the PKCS7 encrypted message.
    EXEC sp_OAMethod @crypt, 'EncryptBd', @success OUT, @fileData
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert1
        EXEC @hr = sp_OADestroy @cert2
        EXEC @hr = sp_OADestroy @cert3
        EXEC @hr = sp_OADestroy @fileData
        RETURN
      END

    -- Save the PKCS7 encrypted message to a file..
    EXEC sp_OAMethod @fileData, 'WriteFile', @success OUT, 'qa_output/pkcs7_encrypted.p7'

    -- Now indicate that the PKCS7 output is to be returned in the base64 encoding.
    EXEC sp_OASetProperty @crypt, 'EncodingMode', 'base64'


    PRINT 'OK.'

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @cert1
    EXEC @hr = sp_OADestroy @cert2
    EXEC @hr = sp_OADestroy @cert3
    EXEC @hr = sp_OADestroy @fileData


END
GO