(SQL Server) RSAES-OAEP Encrypt String with AES-128 Content Encryption and SHA256

Encrypts a string using RSAES-OAEP with SHA256 and AES-128 content encryption to produce PKCS7 output (base64 encoded).

Note: This example requires Chilkat v9.5.0.67 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat Crypt API to have been previously unlocked.
    -- See Unlock Chilkat Crypt for sample code.

    -- First build a string to be encrypted
    DECLARE @sb int
    -- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sb OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @i int
    SELECT @i = 1
    WHILE @i < 25
      BEGIN
        DECLARE @success int
        EXEC sp_OAMethod @sb, 'AppendInt', @success OUT, @i
        EXEC sp_OAMethod @sb, 'Append', @success OUT, ' the quick brown fox jumped over the lazy dog.' + CHAR(13) + CHAR(10)
        SELECT @i = @i + 1
      END

    EXEC sp_OAMethod @sb, 'GetAsString', @sTmp0 OUT
    PRINT @sTmp0

    -- The string to be encrypted looks like this:

    -- 1 the quick brown fox jumped over the lazy dog.
    -- 2 the quick brown fox jumped over the lazy dog.
    -- 3 the quick brown fox jumped over the lazy dog.
    -- 4 the quick brown fox jumped over the lazy dog.
    -- 5 the quick brown fox jumped over the lazy dog.
    -- 6 the quick brown fox jumped over the lazy dog.
    -- ...

    -- Load a digital certificate. 
    -- We don't need the private key for encryption.
    -- Only the public key is needed (which is included in a certificate).
    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadFromFile', @success OUT, 'qa_data/rsaes-oaep/cert.pem'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @sb
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    DECLARE @crypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT

    -- Tell the crypt object to use the certificate.
    EXEC sp_OAMethod @crypt, 'SetEncryptCert', @success OUT, @cert

    -- Indicate that we want PKI encryption (i.e. public-key infrastructure)
    -- to produce a CMS message (Cryptographic Message Syntax/PKCS7),
    -- that is be created with RSAES-OAEP padding, SHA256, and AES-128 for the
    -- bulk encryption.
    EXEC sp_OASetProperty @crypt, 'CryptAlgorithm', 'pki'
    EXEC sp_OASetProperty @crypt, 'Pkcs7CryptAlg', 'aes'
    EXEC sp_OASetProperty @crypt, 'KeyLength', 128
    EXEC sp_OASetProperty @crypt, 'OaepHash', 'sha256'
    EXEC sp_OASetProperty @crypt, 'OaepPadding', 1

    -- Also, don't forget to be specific about the character encoding (byte representation) of the
    -- string to be encrypted.
    EXEC sp_OASetProperty @crypt, 'Charset', 'utf-8'

    -- Now indicate that the PKCS7 output is to be returned in the base64 encoding.
    EXEC sp_OASetProperty @crypt, 'EncodingMode', 'base64'

    DECLARE @base64Pkcs7 nvarchar(4000)
    EXEC sp_OAMethod @sb, 'GetAsString', @sTmp0 OUT
    EXEC sp_OAMethod @crypt, 'EncryptStringENC', @base64Pkcs7 OUT, @sTmp0
    EXEC sp_OAGetProperty @crypt, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @sb
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @crypt
        RETURN
      END

    -- Show the output

    PRINT @base64Pkcs7

    -- This base64 can be copy-and-pasted into the form at http://lapo.it/asn1js/
    -- to verify that all the chosen algorithms were indeed used.


    PRINT 'OK.'

    EXEC @hr = sp_OADestroy @sb
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @crypt


END
GO