(VB.NET) AES GCM Encrypt and Decrypt a File

See more Encryption Examples

Demonstrates how to AES GCM encrypt and decrypt a file.

Chilkat .NET Downloads Chilkat .NET Framework Chilkat for .NET Core

' This example assumes the Chilkat API to have been previously unlocked.
' See Global Unlock Sample for sample code.

Dim crypt As New Chilkat.Crypt2

' Set the encryption algorithm to "AES"	
crypt.CryptAlgorithm = "aes"

' Indicate that the Galois/Counter Mode (GCM) should be used:
crypt.CipherMode = "gcm"

' KeyLength may be 128, 192, 256
crypt.KeyLength = 256

' This is the 256-bit AES secret key (in hex format)
Dim K As String = "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"

' This is the 16-byte initialization vector (in hex format)
Dim IV As String = "000102030405060708090A0B0C0D0E0F"

' This is the OPTIONAL additional data (in hex format) to be used as input to the GCM AEAD algorithm,
' but is not included in the output.  It plays a role in the computation of the
' resulting authenticated tag.
Dim AAD As String = "feedfacedeadbeeffeedfacedeadbeefabaddad2"

' Set the secret key and IV
crypt.SetEncodedIV(IV,"hex")
crypt.SetEncodedKey(K,"hex")

' Set the additional authenticated data (AAD)
Dim success As Boolean = crypt.SetEncodedAad(AAD,"hex")

' Encrypt a file.
Dim inFile As String = "qa_data/hamlet.xml"
Dim outFile As String = "c:/temp/qa_output/hamlet_aes_gcm.enc"
success = crypt.CkEncryptFile(inFile,outFile)
If (success = False) Then
    Debug.WriteLine(crypt.LastErrorText)
    Exit Sub
End If


' Get the authentication tag in hex format
Dim authTag As String = crypt.GetEncodedAuthTag("hex")
Debug.WriteLine("authentication tag = " & authTag)



' Decrypt..

' Before decrypting, you must provide the expected authentication tag.
' The decrypt will fail if the resulting authentication tag computed while decrypting is not equal to the
' expected authentication tag.
crypt.SetEncodedAuthTag(authTag,"hex")

inFile = outFile
outFile = "c:/temp/qa_output/hamlet_restored.xml"
success = crypt.CkDecryptFile(inFile,outFile)
If (success = False) Then
    Debug.WriteLine(crypt.LastErrorText)
    Exit Sub
End If


Debug.WriteLine("Success.")


' --------------------------------------------------------------------------------------------
' About AES-GCM:

' AES-GCM (Advanced Encryption Standard - Galois/Counter Mode) is a widely-used
' encryption mode that provides both confidentiality (encryption) and
' integrity/authentication (data integrity verification) in one operation. It is
' commonly used in secure communications due to its efficiency and strong security
' properties.
' 
' Key Concepts:
' 
'     AES (Advanced Encryption Standard):
' 
'         AES is a symmetric encryption algorithm, meaning the same key is used
'         for both encryption and decryption.
' 
'         It operates on fixed-size blocks of data (128 bits) using key sizes of
'         128, 192, or 256 bits.
' 
'         In AES-GCM, AES is used to perform the actual data encryption.
' 
'     GCM (Galois/Counter Mode):
' 
'         Counter Mode (CTR): GCM uses counter mode for encryption. In this mode,
'         a nonce (or initialization vector, IV) and a counter are combined and encrypted
'         with AES. The result is XORed with the plaintext to produce the ciphertext. 
' 
'         Galois Mode (GMAC): GCM also includes an authentication mechanism based
'         on a Galois field. It generates an authentication tag, which ensures the
'         integrity of both the ciphertext and any additional data (called AAD -
'         Additional Authenticated Data). This tag is verified during decryption to ensure
'         that the data hasn't been tampered with.
' 
' Key Features:
' 
'     Confidentiality (Encryption):
' 
'         The plaintext is encrypted using AES in counter mode. Each block of
'         plaintext is XORed with the output of AES applied to a combination of the IV and
'         an incremented counter.
' 
'     Integrity (Authentication):
' 
'         In addition to encryption, GCM provides authentication for both the
'         encrypted data (ciphertext) and any Additional Authenticated Data (AAD), such as
'         headers or metadata that need to be protected but not encrypted.
' 
'         The authentication tag is generated using a Galois field multiplication
'         of the ciphertext and AAD. This ensures that any changes to the encrypted
'         message or the AAD will be detected during decryption.
' 
' Key Components:
' 
'     - Plaintext: The data you want to encrypt.
'     - Ciphertext: The encrypted data.
'     - Key: A symmetric key used for both encryption and decryption.
'     - Nonce/IV: A unique value used for each encryption to ensure security. It is not secret but should never be reused with the same key.
'     - AAD (Additional Authenticated Data): Optional data that is not encrypted but needs to be authenticated (e.g., headers).
'     - Authentication Tag: A tag generated to verify the integrity and authenticity of the ciphertext and AAD