(Tcl) Decrypt 256-bit AES GCM Produced by Something Unknown

Demonstrates how to decrypt something produced elsewhere (unknown) with 256-bit AES GCM.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# We have the following to decrypt:

# Key (Base64): 
set keyBase64 "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# IV (Base64Url):
set ivBase64Url "xrvaINMLqotAbWRK"

# ciphertext (base64url):
set cipherBase64Url "RtGNAS-zQOxSB8W0HfqJjCoyt9KgImW_l-HjVC40hOOl-RNfRF3hzDIT1kvFVF8i_KX9XmqAftb6lyq-jLCEc_MSgqt3q1ixv3Ez4SbS3G5e3qGzLwxIMi2sCt00aDNwK2ipsJ4aw8s7ePPnl4oY-y1st9rwCWR0rrgEZwS9jmS4uJWGPn9K3jbKRnMslznDbtFLNJctMVXBTP-cv47JelxLCBOQSlK29rMuEFrhHR_VQrPq6gtZaBVSXZSYT0XOklp7nu9mVhrMCRtBCC5oiu5MPE5JYx4ANo3hUY7_NyQl2bpn9GfRXrdvqRGE-gy2upj-cDkm0t_tV8xmYge9DBQTH3B_4BGl2qTk_o-m7pEmKkS8XSdQhGcuFlykqrkE8SzB5I8esfzWOM0pwxbz0H_VaylKYHY="

set crypt [new_CkCrypt2]

CkCrypt2_put_CryptAlgorithm $crypt "aes"
CkCrypt2_put_CipherMode $crypt "gcm"
CkCrypt2_put_KeyLength $crypt 256

set success [CkCrypt2_SetEncodedAad $crypt "random" "ascii"]
CkCrypt2_SetEncodedKey $crypt $keyBase64 "base64"
CkCrypt2_SetEncodedIV $crypt $ivBase64Url "base64url"

# The cipher text contains the 16-byte auth tag at the end.
# get it separately..
set bdEncrypted [new_CkBinData]

set bdAuthTag [new_CkBinData]

set success [CkBinData_AppendEncoded $bdEncrypted $cipherBase64Url "base64url"]

set numBytes [CkBinData_get_NumBytes $bdEncrypted]
set authTagHex [CkBinData_getEncodedChunk $bdEncrypted [expr $numBytes - 16] 16 "hex"]

puts "Auth tag in hex: $authTagHex"

set success [CkBinData_AppendEncoded $bdAuthTag $authTagHex "hex"]
CkBinData_RemoveChunk $bdEncrypted [expr $numBytes - 16] 16

# Use this special value to tell Chilkat to ignore the auth tag.
set success [CkCrypt2_SetEncodedAuthTag $crypt "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" "hex"]

# Decrypt
CkCrypt2_put_EncodingMode $crypt "base64"
set originalText [CkCrypt2_decryptStringENC $crypt [CkBinData_getEncoded $bdEncrypted "base64"]]
if {[CkCrypt2_get_LastMethodSuccess $crypt] == 0} then {
    puts [CkCrypt2_lastErrorText $crypt]
} else {
    puts "$originalText"
    puts "Success."
}

# Decrypted text

delete_CkCrypt2 $crypt
delete_CkBinData $bdEncrypted
delete_CkBinData $bdAuthTag