Zig

Duplicate SQL Server ENCRYPTBYPASSPHRASE

See more Encryption Examples

Demonstrates how to duplicate SQL Server's ENCRYPTBYPASSPHRASE. Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // For SQL Server 2008 - SQL Server 2016 we must use TripleDES with SHA1
    // For SQL Server 2017 and later, use AES256 / SHA256.

    const password = "tEst1234";
    const encrypted_hex_v1 = "0x010000001E8E7DCDBD4061B951999E25D18445D2305474D2D71EEE98A241C755246F58AB";

    // Here's an encrypted string using AES256/SHA256

    const sb_enc_hex = try chilkat.StringBuilder.init();
    defer sb_enc_hex.deinit();
    sb_enc_hex.append(encrypted_hex_v1) catch {};

    // If present, we don't want the leading "0x"
    if (sb_enc_hex.startsWith("0x", false)) {
        sb_enc_hex.removeCharsAt(0, 2) catch {};
    }

    const crypt = try chilkat.Crypt2.init();
    defer crypt.deinit();
    crypt.setEncodingMode("hex");

    // The encrypted hex string will begin with either 01000000 or 02000000
    // version 1 is produced by SQL Server 2008 to SQL Server 2016, and we must use TripleDES with SHA1
    // version 2 is for SQL Server 2017 and later, and uses AES256 / SHA256.
    const v1 = sb_enc_hex.startsWith("01", false);

    var iv_len: i32 = 0;
    var hash_alg: [:0]const u8 = "";

    if (v1) {
        crypt.setCryptAlgorithm("3des");
        crypt.setCipherMode("cbc");
        crypt.setKeyLength(168);
        iv_len = 8;
        hash_alg = "sha1";
    } else {
        crypt.setCryptAlgorithm("aes");
        crypt.setCipherMode("cbc");
        crypt.setKeyLength(256);
        iv_len = 16;
        hash_alg = "sha256";
    }

    // Remove the SQL Server version info (i.e. the "01000000")
    sb_enc_hex.removeCharsAt(0, 8) catch {};

    // Get the IV part of the sbEncHex, and also remove it from the StringBuilder.
    var iv_hex: [:0]const u8 = try sb_enc_hex.getRange(alloc, 0, iv_len * 2, true);
    std.debug.print("IV = {s}\n", .{iv_hex});
    crypt.setEncodedIV(iv_hex, "hex");

    const sb_password = try chilkat.StringBuilder.init();
    defer sb_password.deinit();
    sb_password.append(password) catch {};
    const pwd_hash = try sb_password.getHash(alloc, hash_alg, "hex", "utf-16");
    const sb_key = try chilkat.StringBuilder.init();
    defer sb_key.deinit();
    sb_key.append(pwd_hash) catch {};
    if (v1) {
        // For v1, we only want the 1st 16 bytes of the 20 byte hash.
        // (remember, the hex encoding uses 2 chars per byte, so we remove the last 8 chars)
        sb_key.shorten(8) catch {};
    }

    std.debug.print("crypt key: {s}\n", .{try sb_key.getAsString(alloc)});

    crypt.setEncodedKey(try sb_key.getAsString(alloc), "hex");

    // Decrypt
    const bd = try chilkat.BinData.init();
    defer bd.deinit();
    bd.appendEncoded(try sb_enc_hex.getAsString(alloc), "hex") catch {};
    crypt.decryptBd(bd) catch {};

    // The result is composed of a header of 8 bytes which we can discard.
    // The remainder is the decrypted text.

    // The header we are discarding is composed of:
    // Bytes 0-3: Magic number equal to 0DF0ADBA
    // Bytes 4-5: Number of integrity bytes, which is 0 unless an authenticator is used. We're assuming no authenticator is used.
    // Bytes 6-7: Number of plain-text bytes. We really don't need this because the CBC padding takes care of it.

    // Therefore, just return the data after the 1st 8 bytes.
    // Assuming the encrypted string was utf-8 text...
    bd.removeChunk(0, 8) catch {};
    var plain_text: [:0]const u8 = try bd.getString(alloc, "utf-8");
    std.debug.print("decrypted plain text: {s}\n", .{plain_text});

    // The output:

    // IV = 1E8E7DCDBD4061B9
    // crypt key: 710B9C2E61ACCC9570D4112203BD9738
    // decrypted plain text: Hello world.

    // ------------------------------------------------------------------------------------------
    // To encrypt, do the reverse...

    // Let's do v1 with TripleDES with SHA1

    const encryptor = try chilkat.Crypt2.init();
    defer encryptor.deinit();
    encryptor.setEncodingMode("hex");

    encryptor.setCryptAlgorithm("3des");
    encryptor.setCipherMode("cbc");
    encryptor.setKeyLength(168);

    // Generate a random 8-byte IV
    const prng = try chilkat.Prng.init();
    defer prng.deinit();
    iv_hex = try prng.genRandom(alloc, 8, "hex");
    encryptor.setEncodedIV(iv_hex, "hex");

    // The binary password is generated the same as above.
    // We'll use the same password (and same binary password)
    encryptor.setEncodedKey(try sb_key.getAsString(alloc), "hex");

    const plain_text_len = 8;
    plain_text = "ABCD1234";

    // Encrypt the header + the plain-text.
    const bd_data = try chilkat.BinData.init();
    defer bd_data.deinit();
    bd_data.appendEncoded("0DF0ADBA", "hex") catch {};
    bd_data.appendEncoded("0000", "hex") catch {};
    bd_data.appendInt2(plain_text_len, true) catch {};
    std.debug.print("header: {s}\n", .{try bd_data.getEncoded(alloc, "hex")});
    bd_data.appendString(plain_text, "utf-8") catch {};
    encryptor.encryptBd(bd_data) catch {};

    // Compose the result..
    const sb_enc = try chilkat.StringBuilder.init();
    defer sb_enc.deinit();
    sb_enc.append("0x01000000") catch {};
    sb_enc.append(iv_hex) catch {};
    sb_enc.append(try bd_data.getEncoded(alloc, "hex")) catch {};

    std.debug.print("result: {s}\n", .{try sb_enc.getAsString(alloc)});
}