CkCrypt2

Setting this property to true will abort the current method, but only for those methods having an Async alternative. The property automatically resets to false at the start of each method and after an abort. Both synchronous and asynchronous methods can be aborted; synchronous methods require setting this property from another thread.

The BCrypt work factor determines the computational cost of BCryptHash and BCryptVerify . It represents the base-2 logarithm of the number of hashing rounds. For instance, a work factor of 12 corresponds to 2^12 hashing rounds. This cost factor is designed to make computations challenging enough to deter brute-force attacks. The work factor must be set between 4 and 31, inclusive, with a default value of 10.

This property indicates the block size in bytes for the chosen encryption algorithm. For instance, if the CryptAlgorithm is set to AES, the BlockSize is automatically set to 16 bytes. In contrast, the block size for the ChaCha20 streaming algorithm is 1 byte.

This property applies to all PKCS7 signature creation methods. When set to true, it ensures the inclusion of required attributes (such as content-type, message-digest, and signing-certificate-v2) to qualify the signature as at least a CAdES-BES signature. By default, this property is set to false.

This property is for PKCS7 CMS signatures that wish to include CAdES signature policy attributes. Set it to the base64-encoded hash of the policy document at the CadesSigPolicyUri using either SHA256 or SHA1.

This property is for PKCS7 CMS signatures that wish to include CAdES signature policy attributes. The CAdES Signature Policy ID is an object identifier (OID) included in a CAdES signature that specifies the exact signature policy the signer followed. It is the OID associated with the policy URL. An example OID would look like this: 2.16.840.1.101.3.2.1.48.1

An application that wishes to include signature policy attributes should set all three properties: CadesSigPolicyHash , CadesSigPolicyUri , and CadesSigPolicyId .

This property is for PKCS7 CMS signatures that wish to include CAdES signature policy attributes. The signature policy URI in a CAdES digital signature is a link that points to a document describing the rules and conditions under which the signature was created. Typically the Signature Policy URI in a CAdES signature points to a .der file, not a PDF or human-readable document. For example: http://example.com/policies/my-policy.der

This property specifies the character encoding used to represent text as bytes for encryption and hashing. By default, it uses the computer's ANSI charset, such as Windows-1252 for locales like the United States, United Kingdom, Western Europe, Australia, and New Zealand.

Most applications are advised to set this property to UTF-8. Chilkat plans to change its default to UTF-8 in a future major version to align with current standards. The current default of ANSI stems from a time when UTF-8 was not widely adopted.

Sets the cipher mode for block encryption algorithms (AES, Blowfish,TwoFish, DES, 3DES, RC2). Possible values are CBC (the default) , ECB, CTR, OFB, GCM, and CFB. These acronyms have the following meanings:

• CBC: Cipher Block Chaining,
• ECB: Electronic CookBook
• CTR: Counter Mode
• CFB: Cipher Feedback
• OFB: Output Feedback
• GCM: Galois/Counter Mode
• XTS: AES-XTS (starting in Chilkat v9.5.0.91, only works with AES encryption)

The GCM (Galois/Counter Mode) is available with any cipher having a 16-byte block size, such as AES. The CFB, OFB, CTR, and GCM modes convert block ciphers into stream ciphers. In these modes of operation, the PaddingScheme property is unused because no padding occurs.

Starting in v9.5.0.91 Chilkat supports AES-XTS mode. XTS mode additionally uses a tweak key and tweak value, which are set via the XtsSetEncodedTweakKey, XtsSetEncodedTweakValue, and XtsSetDataUnitNumber. (The latter two functions provide alternative means of setting the tweak value.) Chilkat fully supports AES-XTS mode with ciphertext-stealing, which means it will correctly encrypt/decrypt data with size not divisible by the block size (i.e. divisible by 16 bytes).

A JSON string to manage additional CMS (PKCS7) signature and validation options. Possible options are:

• boolean OmitAlgorithmIdNull: Set this JSON member to true to omit the explicit NULL within an AlgorithmIdentifier ASN.1 within the PKCS7. This should almost never be used, but helps for rare cases where a validator dislikes the explicit NULL being present.
• boolean ValidateTimestampTokens: Tells Chilkat to also validate the timestamp tokens when validating a signature that includes a timestamp.
• boolean ConstructedOctets: When set to true, tells Chilkat to use the ASN.1 constructed octets format for the data contained in the CMS (PKCS7) signed-data.
• boolean CanonicalizeITIDA: This applies to Egypt ITIDA, which requires signed documents in a CAdES-BES CMS format, using ITIDA’s JSON canonicalization (for JSON payloads), with only the Base64‑encoded signature attached—not the original data itself. When set to true, Chilkat will automatically do the special ITIDA JSON canonicalization.

Selects the encryption algorithm for encrypting and decrypting. Possible values are:

If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.

Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.

Possible causes of hangs include:

• A timeout property set to 0, indicating an infinite timeout.
• A hang occurring within an event callback in the application code.
• An internal bug in the Chilkat code causing the hang.

The EncodingMode property specifies the binary encoding format (e.g., base64, hex, base58, base64url) used by functions ending in "ENC", like EncryptStringENC and DecryptStringENC. For encryption functions, EncodingMode determines the encoding of the output. For decryption functions, it specifies the encoding of the input data.

A list of supported binary encodings is available at the link below.

The default value is base64

Using the FirstChunk and LastChunk properties is the way to do streaming encryption or decryption with Chilkat.

By default, both FirstChunk and LastChunk are set to true, indicating that the data passed to the encryption or decryption method is the full amount. To process data in multiple chunks, adjust these settings as follows:

1. For the first chunk, set FirstChunk = true and LastChunk = false.
2. For intermediate chunks, set both FirstChunk = false and LastChunk = false.
3. For the final chunk, set FirstChunk = false and LastChunk = true.

You can feed data chunks of any size, regardless of the encryption algorithm's block size (e.g., 16 bytes for AES). Chilkat will handle buffering and, upon receiving the final chunk, pad the output to the appropriate block size according to the selected PaddingScheme.

Selects the hash algorithm used by methods that create hashes. The valid choices are sha256, sha384, sha512, sha3-224, sha3-256, sha3-384, sha3-512, sha1, md2, md5, haval, ripemd128, ripemd160,ripemd256, or ripemd320.

(Chilkat supports SHA-2 because it includes the SHA-256, SHA-384, and SHA-512 hash functions.)

The default value is sha256.

Note: The HAVAL hash algorithm is affected by two other properties: HavalRounds and KeyLength .

• The HavalRounds may have values of 3, 4, or 5.
• For HAVAL hashing, the KeyLength can be 128, 160, 192, 224, or 256.

Applies to the HAVAL hash algorithm only and must be set to the integer value 3, 4, or 5. The default value is 3.

The number of milliseconds between each AbortCheck event callback. The AbortCheck callback allows an application to abort some methods call prior to completion. If HeartbeatMs is 0 (the default), no AbortCheck event callbacks will fire.

The methods with event callbacks are: CkDecryptFile, CkEncryptFile, HashFile, and HashFileENC.

Only applies when creating digital signatures. If true (the default), then additional certificates (if any) in the chain of authentication are included in the PKCS7 digital signature.

The initial counter for the ChaCha20 encryption algorithm. The default value is 0.

Iteration count to be used with password-based encryption (PBE). Password-based encryption is defined in the PKCS5 Password-Based Cryptography Standard at http://www.rsa.com/rsalabs/node.asp?id=2127

The purpose of the iteration count is to increase the computation required to encrypt and decrypt. A larger iteration count makes cracking via exhaustive search more difficult. The default value is 1024.

The key length in bits for symmetric encryption algorithms. The default value is 256.

See the documentation for the FirstChunk property.

Provides HTML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

Provides plain text information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

Provides XML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

Indicates the success or failure of the most recent method call: true means success, false means failure. This property remains unchanged by property setters or getters. This method is present to address challenges in checking for null or Nothing returns in certain programming languages.

Selects the MAC algorithm to be used for any of the Mac methods, such as MacStringENC, MacBytes, etc. The default value is hmac. Possible values are hmac and poly1305.

This property is set when a digital signature is verified. It contains the number of signer certificates. Each signing certificate can be retrieved by calling the GetSignerCert method, passing an index from 0 to NumSignerCerts-1.

Selects the hash algorithm for use within OAEP padding when encrypting using pki with RSAES-OAEP. The valid choices are sha1, sha256, sha384, sha512,

The default value is sha256

Selects the MGF hash algorithm for use within OAEP padding when encrypting using pki with RSAES-OAEP. The valid choices are sha1, sha256, sha384, sha512, The default is sha256.

Selects the RSA encryption scheme when encrypting using pki (with a certificate and private key). The default value is false, which selects RSAES_PKCS1-V1_5. If set to true, then RSAES_OAEP is used.

The padding scheme used by block encryption algorithms such as AES (Rijndael), Blowfish, Twofish, RC2, DES, 3DES, etc. Block encryption algorithms pad encrypted data to a multiple of algorithm's block size. The default value of this property is 0.

Possible values are:

0 = RFC 1423 padding scheme: Each padding byte is set to the number of padding bytes. If the data is already a multiple of algorithm's block size bytes, an extra block is appended each having a value equal to the block size. (for example, if the algorithm's block size is 16, then 16 bytes having the value 0x10 are added.). (This is also known as PKCS5 padding: PKCS #5 padding string consists of a sequence of bytes, each of which is equal to the total number of padding bytes added. )

1 = FIPS81 (Federal Information Processing Standards 81) where the last byte contains the number of padding bytes, including itself, and the other padding bytes are set to random values.

2 = Each padding byte is set to a random value. The decryptor must know how many bytes are in the original unencrypted data.

3 = Pad with NULLs. (If already a multiple of the algorithm's block size, no padding is added).

4 = Pad with SPACE chars(0x20). (If already a multiple of algorithm's block size, no padding is added).

If the CryptAlgorithm property is set to pbes1 or pbes2, this property specifies the underlying encryption algorithm to be used with password-based encryption (PBE). Password-based encryption is defined in the PKCS5 Password-Based Cryptography Standard at http://www.rsa.com/rsalabs/node.asp?id=2127

The password to be used with password-based encryption (PBE). Password-based encryption is defined in the PKCS5 Password-Based Cryptography Standard at http://www.rsa.com/rsalabs/node.asp?id=2127

When the CryptAlgorithm property is PKI to select PKCS7 public-key encryption, this selects the underlying symmetric encryption algorithm. Possible values are: aes, des, 3des, and rc2. The default value is aes.

The effective key length (in bits) for the RC2 encryption algorithm. When RC2 is used, both the KeyLength and Rc2EffectiveKeyLength properties should be set. For RC2, both should be between 8 and 1024 (inclusive).

The default value is 128

This property selects the signature algorithm for the OpaqueSign*, Sign*, and CreateDetachedSignature, CreateP7M, and CreateP7S methods. The default value is PKCS1-v1_5. This can be set to RSASSA-PSS (or simply pss) to use the RSASSA-PSS signature scheme.

Note: This property only applies when the private key is an RSA private key. It does not apply for ECC or DSA private keys.

Contains JSON to specify the authenticated (signed) attributes or unauthenticated (unsigned) attributes that are to be included in CMS signatures. The default value is:

{
    "contentType": 1,
    "signingTime": 1,
    "messageDigest": 1
}

Other possible values that can be added are:

• signingCertificateV2
• signingCertificate
• sMIMECapabilities
• microsoftRecipientInfo
• encrypKeyPref
• cmsAlgorithmProtection

This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty.

Can be set to a list of the following comma separated keywords:

• UseConstructedOctets - Introduced in v9.5.0.83. When creating opaque CMS signatures (signatures that embed the data being signed), will use the constructed octets form of the ASN.1 that holds the data. This is to satify some validators that are brittle/fragile/picky and require a particular format, such as for the ICP-Brazil Digital Signature Standard.

When set to true, all const char * arguments and return values are interpreted as UTF-8 strings. When set to false, they are interpreted as ANSI strings.

In Chilkat v11.0.0 and later, the default value is true. Before v11.0.0, it was false.

When UU encoding, this is the filename to be embedded in UU encoded output. The default is file.dat. When UU decoding, this is the filename found in the UU encoded input.

When UU encoding, this is the file permissions mode to be embedded in UU encoded output. The default is 644. When UU decoding, this property is set to the mode found in the UU encoded input.

If set to true, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is false. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.

Version of the component/library, such as "10.1.0"

Adds a certificate for public-key encryption. To enable public-key encryption with digital certificates, set the CryptAlgorithm property to pki. Call AddEncryptCert separately for each certificate you wish to use for encryption.

Any of the Encrypt* methods will do RSA public-key encryption when the CryptAlgorithm is set to the keyword pki. The output is a PKCS#7 enveloped-data secure container.

Adds a PFX file to the object's list of sources for locating certificates and private keys during public-key decryption or signing. To add multiple PFX sources, call this method multiple times. bd should contain the bytes of a PFX file (also known as PKCS12 or .p12).

Note: Information about the certificate(s) needed for public-key decryption are included in the PKCS#7 enveloped-data. Chilkat will automatically find a usable certificate and private key from sources like Windows certificate stores, the Apple keychain, or other sources provided by the application.

Returns true for success, false for failure.

Adds a PFX file to the object's list of sources for locating certificates and private keys during public-key decryption or signing. To add multiple PFX sources, call this method multiple times.

Note: Information about the certificate(s) needed for public-key decryption are included in the PKCS#7 enveloped-data. Chilkat will automatically find a usable certificate and private key from sources like Windows certificate stores, the Apple keychain, or other sources provided by the application.

Returns true for success, false for failure.

Call this method once per certificate to add multiple certificates for signing. If signing with a single certificate, then the SetSigningCert or SetSigningCert2 methods can be used instead.

Returns true for success, false for failure.

Implements the AES Key Wrap Algorithm (RFC 3394) for unwrapping. The kek is the Key Encryption Key (the AES key used to unwrap the wrappedKeyData). The arguments and return value are binary encoded strings using the encoding specified by encoding (which can be base64, hex, base64url, etc.) The full list of supported encodings is available at the link below.

The kek should be an AES key of 16 bytes, 24 bytes, or 32 bytes (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the kek should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).

The wrappedKeyData contains the data to be unwrapped. The result, if decoded, is 8 bytes less than the wrapped key data. For example, if a 256-bit AES key (32 bytes) is wrapped, the size of the wrapped key data is 40 bytes. Unwrapping restores it to the original 32 bytes.

Returns true for success, false for failure.

Implements the AES Key Wrap with Padding Algorithm (RFC 5649) for unwrapping. The kek is the Key Encryption Key (the AES key used to unwrap the wrappedKeyData). The arguments and return value are binary encoded strings using the encoding specified by encoding (which can be base64, hex, base64url, etc.)

The kek should be an AES key of 16 bytes, 24 bytes, or 32 bytes (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the kek should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).

The wrappedKeyData contains the data to be unwrapped.

The unwrapped key is returned as an encoded string (using the encoding specified in encoding).

Returns true for success, false for failure.

Implements the AES Key Wrap Algorithm (RFC 3394). The kek is the Key Encryption Key (the AES key used to encrypt the keyData). The arguments and return value are binary encoded strings using the encoding specified by encoding (which can be base64, hex, base64url, etc.) The full list of supported encodings is available at the link below.

The kek should be an AES key of 16 bytes, 24 bytes, or 32 bytes (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the kek should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).

The keyData contains the data to be key wrapped. It must be a multiple of 64-bits in length. In other words, if the keyData is decoded to binary, it should be a number of bytes that is a multiple of 8.

The return string, if decoded to binary bytes, is equal to the size of the key data + 8 additional bytes.

Returns true for success, false for failure.

Implements the AES Key Wrap with Padding Algorithm (RFC 5649). The kek is the Key Encryption Key (the AES key used to encrypt the keyData). The arguments and return value are binary encoded strings using the encoding specified by encoding (which can be base64, hex, base64url, etc.)

The kek should be an AES key of 16 bytes, 24 bytes, or 32 bytes (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the kek should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).

The keyData contains the data to be key wrapped.

Returns the wrapped key using the encoding specified in encoding.

Returns true for success, false for failure.

Computes and returns a bcrypt hash of the password. The number of rounds of hashing is determined by the BCryptWorkFactor property.

Starting in v9.5.0.76, if the password is prefixed with $2b$ then the output will use the $2b version of bcrypt. For example, to create a $2b$ bcrypt has for the password secret, pass in the string $2b$secret for password.

Returns true for success, false for failure.

Verifies the password against a previously computed BCrypt hash. Returns true if the password matches the bcryptHash. Returns false if the password does not match.

Returns true for success, false for failure.

File-to-file decryption that supports files of any size by using internal streaming mode.

Returns true for success, false for failure.

Creates an asynchronous task to call the CkDecryptFile method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

File-to-file encryption that operates in streaming mode, allowing it to encrypt files of any size.

Returns true for success, false for failure.

Creates an asynchronous task to call the CkEncryptFile method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Clears the internal list of digital certificates to be used for public-key encryption.

Clears the set of certificates to be used in signing.

Returns true for success, false for failure.

Co-sign's an existing CMS signature. bdIn contains the existing CMS signature. If successful, cert is the output co-signed CMS signature.

Returns true for success, false for failure.

Computes a CRC for data contained in crcAlg, which can be either crc-32 used in the Zip file format, or crc8 for the CRC8 algorithm.

Calculates the CRC for a file's contents using the CRC algorithm specified by crcAlg. Possible algorithms are:

• crc-32 - This is the CRC used in the Zip file format.
• crc8

Creates an asynchronous task to call the CrcFile method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Signs the contents of inFilename and writes the enveloping (i.e. opaque) PKCS7 signature (.p7m) to p7mPath.

In a PKCS#7/CMS signature, the signer computes a cryptographic hash (e.g. SHA-256) of the data, then uses their private key to sign that hash.

The signature = Sign( Hash(data) )

This signed hash is what gets stored in the signature file. For enveloping/opaque signatures, the signed data is also stored in the signature file.

Set the HashAlgorithm property to specify the hash algorithmg. The valid options are sha256, sha1, sha384, and sha512.

Returns true for success, false for failure.

Creates an asynchronous task to call the CreateP7M method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Signs the contents of inFilename and writes the detached PKCS7 signature (.p7s) to p7sPath.

In a PKCS#7/CMS detached signature, the signer computes a cryptographic hash (e.g. SHA-256) of the data, then uses their private key to sign that hash.

The signature = Sign( Hash(data) )

This signed hash is what gets stored in the signature file.

Set the HashAlgorithm property to specify the hash algorithmg. The valid options are sha256, sha1, sha384, and sha512.

Returns true for success, false for failure.

Creates an asynchronous task to call the CreateP7S method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Decodes from an encoding back to the original string. The encoding can be set to any of the following strings: base64, hex, quoted-printable, url, base32, Q, B, url_rc1738, url_rfc2396, url_rfc3986, url_oauth, uu, modBase64, or html (for HTML entity encoding).

Returns true for success, false for failure.

Decrypts the contents of bd. This method can do either symmetric key decryption or CMS public key decryption (e.g., PKCS#7 EnvelopedData).

Before calling this method for symmetric key decryption (e.g., AES, ChaCha20, Blowfish, etc.), ensure the following setup:

1. Define the encryption algorithm using the CryptAlgorithm property.
2. Specify the encryption key length with the KeyLength property.
3. Establish the cipher mode through the CipherMode property.
4. Use the SetEncodedIV method to set the IV, if needed by the cipher mode.
5. Set the encryption key with the SetEncodedKey method.
6. Ensure the PaddingScheme property matches the encryptor's value.

When calling this method for public key decryption (i.e. decrypting a PKCS7 CMS message), the following setup is required:

1. The CryptAlgorithm property should be set to the string "pki".
2. Optionally specify the certificate to be used for decryption by calling SetDecryptCert. If SetDecryptCert is not called, then Chilkat will automatically search certificate sources (Windows certificate stores, Apple keychain, etc.) for the required certificate.

Returns true for success, false for failure.

Decrypts encoded encrypted data, and returns the decrypted data as a binary encoded string. For example:

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

This method supports symmetric key and public key decryption. For more information on properties that affect decryption, such as CryptAlgorithm, CipherMode, etc., refer to the DecryptBd method documentation.

Returns true for success, false for failure.

This function is intended for use when the expected decrypted output is text. It decrypts the contents of bdIn and appends the resulting string to sbOut. Ensure that the Charset property, such as utf-8, matches the one used during encryption to interpret the decrypted bytes correctly as characters.

This method supports symmetric key and public key decryption. For more information on properties that affect decryption, such as CryptAlgorithm, CipherMode, etc., refer to the DecryptBd method documentation.

Returns true for success, false for failure.

This function is intended for use when the expected decrypted output is text. It decrypts binary encoded encrypted bytes passed in cipherText and appends the resulting string to secureStr. Ensure that the Charset property, such as utf-8, matches the one used during encryption to interpret the decrypted bytes correctly as characters.

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

This method supports symmetric key and public key decryption. For more information on properties that affect decryption, such as CryptAlgorithm, CipherMode, etc., refer to the DecryptBd method documentation.

Returns true for success, false for failure.

This function is intended for use when the expected decrypted output is text. It decrypts binary encoded encrypted bytes passed in str and appends the resulting string to ARG2. Ensure that the Charset property, such as utf-8, matches the one used during encryption to interpret the decrypted bytes correctly as characters.

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

This method supports symmetric key and public key decryption. For more information on properties that affect decryption, such as CryptAlgorithm, CipherMode, etc., refer to the DecryptBd method documentation.

Returns true for success, false for failure.

Encode binary data to base64, hex, quoted-printable, or URL-encoding. The encoding can be set to any of the following strings: base64, hex, quoted-printable, url, base32, Q, B, url_rc1738, url_rfc2396, url_rfc3986, url_oauth, uu, modBase64, or html (for HTML entity encoding).

The pByteData points to the bytes to be encoded. The szByteData specifies the number of bytes to encode.

Returns true for success, false for failure.

Encodes an integer to N bytes and returns in the specified encoding. If littleEndian is true, then little-endian byte ordering is used. Otherwise big-endian byte order is used.

Returns true for success, false for failure.

Encodes a string. The toEncodingName can be set to any of the following strings: base64, hex, quoted-printable, url, base32, Q, B, url_rc1738, url_rfc2396, url_rfc3986, url_oauth, uu, modBase64, or html (for HTML entity encoding). The charsetName is important, and usually you'll want to specify ansi. For example, if the string ABC is to be encoded to hex using ANSI, the result will be 414243. However, if unicode is used, the result is 410042004300.

Returns true for success, false for failure.

Encrypts the contents of bd. This method can do either symmetric key encryption or CMS public key encryption (e.g., PKCS#7 EnvelopedData).

Before calling this method for symmetric key encryption (e.g., AES, ChaCha20, Blowfish, etc.), ensure the following setup:

1. Define the encryption algorithm using the CryptAlgorithm property.
2. Specify the encryption key length with the KeyLength property.
3. Establish the cipher mode through the CipherMode property.
4. Use the SetEncodedIV method to set the IV, if needed by the cipher mode.
5. Set the encryption key with the SetEncodedKey method.
6. Set the PaddingScheme property if needing something different than the default.

When calling this method for public key encryption (i.e. creating a PKCS7 CMS message), the following setup is required:

1. The CryptAlgorithm property should be set to the string "pki".
2. To specify the encryption certificate, use SetEncryptCert. For multiple certificates, call AddEncryptCert for each one.

Returns true for success, false for failure.

Encrypts binary-encoded data and returns it as a binary-encoded string. For example:

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

This method supports symmetric key and public key decryption. For more information on properties that affect decryption, such as CryptAlgorithm, CipherMode, etc., refer to the method documentation.

Returns true for success, false for failure.

Encrypts text and appends the encrypted bytes in bdOut. The Charset property, such as utf-8, determines the actual bytes that are encrypted.

This method supports symmetric key and public key encryption. For more information on properties that affect encryption, such as CryptAlgorithm, CipherMode, etc., refer to the EncryptBd method documentation.

Returns true for success, false for failure.

Encrypts the secure string and returns the encrypted bytes as a binary encoded string. The Charset property determines the actual bytes that are encrypted.

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

This method supports symmetric key and public key encryption. For more information on properties that affect encryption, such as CryptAlgorithm, CipherMode, etc., refer to the EncryptBd method documentation.

Returns true for success, false for failure.

Encrypts the str and returns the encrypted bytes as a binary encoded string. The Charset property determines the actual bytes that are encrypted.

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

This method supports symmetric key and public key encryption. For more information on properties that affect encryption, such as CryptAlgorithm, CipherMode, etc., refer to the EncryptBd method documentation.

Returns true for success, false for failure.

Generates a random UUID string having standard UUID format, such as de305d54-75b4-431b-adb2-eb6b9e546014.

Note: This generates a version 4 UUID using random byte values. See RFC 4122.

Returns true for success, false for failure.

Generates numBytes random bytes and returns them as an encoded string. The encoding format (e.g., base64, hex) is determined by the EncodingMode property. It utilizes the Fortuna cryptographically secure random number generator, auto-seeded by an OS-dependent secure entropy source.

Returns true for success, false for failure.

When encrypting in GCM mode, Chilkat generates the GCM authentication tag. The application can then use this method to retrieve the tag, which should be sent to the decrypting party along with the encrypted data. For further details on GCM authenticated encryption, please refer to the web pages linked below.

Returns true for success, false for failure.

This method retrieves the IV set by the application during the last call to SetEncodedIV or RandomizeIV.

Returns true for success, false for failure.

Offers details on the last method executed. While many methods provide no information, some do through GetLastJsonData. For instance, after invoking a signature verification method, GetLastJsonData will return JSON detailing the algorithms used.

This method retrieves the signing time of the Nth certificate in a digital signature after verification. The signing time for the first certificate is at index 0. The NumSignerCerts property indicates the total number of signing certificates, although typically only one is used. Note: Before accessing the signing time, use the HasSignatureSigningTime method to verify its availability, and skip indices lacking a signing time. The signing time is returned in RFC822 string format.

Returns true for success, false for failure.

Extracts the signed (authenticated) attributes for the Nth signer, where signerIndex is typically 0, as most signatures have only one signer. Provide the binary PKCS7 in pkcs7Der. If successful, sbJson will hold the signed attributes in JSON format.

Sample JSON output:

{
  "signedAttributes": [
    {
      "oid": "1.2.840.113549.1.9.3",
      "name": "Content Type"
    },
    {
      "oid": "1.2.840.113549.1.9.5",
      "name": "Signing Time"
    },
    {
      "oid": "1.2.840.113549.1.9.4"
      "name": "Message Digest"
    },
    {
      "oid": "1.2.840.113549.1.9.16.2.47",
      "name": "Signing Certificate V2"
    }
  ]
}

Returns true for success, false for failure.

Hashes the bytes in bd and returns the hash as a binary-encoded string. The hash algorithm is determined by the HashAlgorithm property, while the encoding is specified by the EncodingMode property. Encoding options include base64, hex, base64url, or others listed at the link below.

Returns true for success, false for failure.

To hash binary data in chunks, start by hashing the first chunk using this method. For additional chunks, use the HashMoreBytes method as needed. Complete the process with HashFinal or HashFinalENC to obtain the hash result. The hash algorithm used is determined by the HashAlgorithm property setting.

Returns true for success, false for failure.

To hash a large amount of text, start by processing the first chunk using this method. For subsequent chunks, use the HashMoreString method as needed. Conclude by calling HashFinalENC to obtain the final result. The hash algorithm is determined by the HashAlgorithm property setting.

Returns true for success, false for failure.

Start or continue hashing data in chunks. Set firstChunk to true for the first chunk, and false for subsequent chunks. Finish by calling HashFinalENC to obtain the result. The hash algorithm used is determined by the HashAlgorithm property.

Returns true for success, false for failure.

Hashes a file and returns the hash as an encoded string.

The hash algorithm is specified by the HashAlgorithm property, The encoding is controlled by the EncodingMode property, which can be set to base64, hex, base64url, or any of the encodings listed at the link below.

Any size file is supported because the file is hashed internally in streaming mode (keeping memory usage low and constant).

Returns true for success, false for failure.

Creates an asynchronous task to call the HashFileENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Finalizes a multi-step hash computation and returns the hash bytes encoded according to the EncodingMode property setting.

Returns true for success, false for failure.

The same as HashMoreBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Adds more text to the hash currently under computation. (See HashBeginString)

Returns true for success, false for failure.

Hashes the str and returns the hash as a binary encoded string. The Charset property determines the actual bytes that are hashed.

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

The hash algorithm is determined by the HashAlgorithm property.

Returns true for success, false for failure.

After verifying a digital signature with a signature verification method, you can call this method. It returns true if the signing time for the Nth certificate is available and can be accessed using the GetSignatureSigningTimeStr method.

Implements RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm. The arguments to this method are:

• secret: The shared secret in an enocded representation such as base64, hex, ascii, etc.
• secretEnc: The encoding of the shared secret, such as base64
• counterHex: The 8-byte counter in hexidecimal format.
• numDigits: The number of decimal digits to return.
• truncOffset: Normally set this to -1 for dynamic truncation. Otherwise can be set in the range 0..15.
• hashAlg: Normally set to sha1. Can be set to other hash algorithms such as sha256, sha512, etc.

Returns true for success, false for failure.

Returns in cert the last certificate used for public-key decryption.

Returns true for success, false for failure.

Retrieves the Nth certificate used for signing in cert, where the first certificate is at index 0. Use this method after verifying a digital signature to access the signer certificates. The NumSignerCerts property indicates the total number of signing certificates. Usually, only one certificate is used when creating a digital signature.

Returns true for success, false for failure.

Loads the caller of the task's async method.

Returns true for success, false for failure.

Generates a Message Authentication Code (MAC) for the bytes in bd using the algorithm defined by the MacAlgorithm property. The resulting MAC is encoded into a string based on the EncodingMode property (e.g., base64 or hex). The HashAlgorithm property determines the internal hash function. Before generating the MAC, specify the secret key using SetMacKeyEncoded .

Returns true for success, false for failure.

Computes a Message Authentication Code (MAC) and returns it as a binary encoded string. The MAC algorithm is defined by the MacAlgorithm property. The Charset property determines the actual bytes that are hashed.

The encoding (e.g. base64, hex, etc.) is determined by the EncodingMode property.

The hash algorithm is determined by the HashAlgorithm property. The secret key must be set beforehand by calling SetMacKeyEncoded .

Returns true for success, false for failure.

Matches MySQL's AES_DECRYPT function. strEncryptedHex is a hex-encoded AES-encrypted string, and the return value is the original unencrypted string.

Returns true for success, false for failure.

This function replicates MySQL's AES_ENCRYPT, returning the encrypted data as a hex-encoded string. In MySQL, this is done using: HEX(AES_ENCRYPT('The quick brown fox jumps over the lazy dog', 'password')).

Returns true for success, false for failure.

Digitally signs the contents of bd. If successful, the contents of bd are replaced with the PKCS#7 signed-data, which embeds the original data within the signature. Ensure a certificate is set using SetSigningCert before invoking this method. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the OpaqueSignBd method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Digitally signs a string and returns PKCS#7 signed-data as a binary encoded string. The EncodingMode property determines the binary encoding, such as base64, hex, hex_lower, base64_mime, etc. The Charset property determines the actual bytes that are hashed and signed. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the OpaqueSignStringENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

The method performs in-place verification of the PKCS#7 signed-data content of bd. If the signature is successfully verified, the content of bd is replaced with the original data, and the method returns true. If verification fails, bd remains unchanged, and the method returns false. Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

This function verifies a PKCS#7 signed-data binary-encoded signature and returns the original text data. The EncodingMode property determines how p7m is decoded to bytes. If the signature does not verify successfully, it returns an empty string. The Charset property specifies how the original data bytes are converted to characters. You can obtain signer certificates using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

This function implements the PBKDF1 (Password-Based Key Derivation Function #1) algorithm. Follow these guidelines to use it:

1. password (the password) is first converted using the character encoding specified by charset before being processed by the key derivation function.
2. hashAlg specifies the hash function to use, such as md5, sha1, or md2.
3. salt represents the salt, which should be random data of at least 8 bytes (64 bits). You can use the GenRandomBytesENC method to generate this.
4. iterationCount sets the iteration count, which must be a minimum of 1000.
5. outputKeyBitLen determines the length (in bits) of the derived key.
6. encoding defines the output encoding format, such as base64 or hex, and also the expected encoding of salt (the salt).

The function returns the derived key.

Note: If charset is specified as hex or base64, the password (password) will be treated as binary data encoded in that format. It will be decoded into binary form and used directly as such.

Returns true for success, false for failure.

Implements the PBKDF2 algorithm as follows:

1. Convert password to the character encoding specified by charset before using it in the key derivation function.
2. hashAlg specifies the hash algorithm. Options include sha256, sha384, sha512, md5, sha1, md2, or any algorithm listed in the HashAlgorithm property.
3. Provide a random salt value that is at least 8 bytes (64 bits) long. Use methods like GenRandomBytesENC to generate this salt value.
4. Ensure iterationCount is 1000 or greater.
5. Control the length of the derived key output using outputKeyBitLen.
6. Set encoding to specify the encoding format for the output and the expected encoding for salt. Options include base64 and hex.

The derived key is the output of this process. Internally, PBKDF2 uses a pseudorandom function (PRF), specifically a keyed HMAC. The hash algorithm chosen with hashAlg dictates this PRF; for example, SHA256 uses HMAC-SHA256, while SHA1 uses HMAC-SHA1.

Note: If charset is hex or base64, password is treated as binary data. It will be decoded and used directly as a binary password. SHA256 uses HMAC-SHA256, while SHA1 uses HMAC-SHA1.

PBKDF1 and PBKDF2 are both key derivation functions used to strengthen passwords for cryptographic purposes, but PBKDF2 is the improved version.

• PBKDF1: Older and limited—it can only generate small keys (up to the hash function’s output size), making it less flexible and secure.
• PBKDF2: More advanced—it can generate longer keys, is more resistant to attacks, and is widely recommended for modern security needs.

In short, PBKDF2 is stronger and more versatile than PBKDF1.

Returns true for success, false for failure.

Sets the initialization vector (IV) to a random value. The CryptAlgorithm property should be set prior to calling this method.

A random IV is used in symmetric encryption (like AES-CBC or AES-GCM) to ensure that encrypting the same plaintext with the same key produces different ciphertext each time. This prevents attackers from recognizing patterns in encrypted data and strengthens security.

Why use a random IV?

• It ensures semantic security (i.e. same plaintext never results in same ciphertext).
• Prevents replay and pattern attacks.
• Especially important in modes like CBC and GCM.

How is the IV sent to the decrypting party?

The IV is not secret, but it must be available for decryption. Common methods:

• Prepended to the ciphertext (e.g., IV || ciphertext)
• Sent in a separate field (e.g., JSON field, HTTP header)
• Concatenated and encoded (e.g., base64 of IV + ciphertext)

At the receiving side, the decryptor extracts the IV and uses it with the shared key to decrypt the ciphertext correctly.

This method converts between different encodings, such as from base64 to hex. Each argument can be any binary encoding supported by Chilkat.

Returns true for success, false for failure.

Sets the digital certificate for decryption when the CryptAlgorithm property is set to "pki". This method requires that the certificate has a private key.

Returns true for success, false for failure.

Sets the digital certificate and associated private key for decryption when the CryptAlgorithm property is set to "pki". The private key must be the one that matches the certificate's public key.

Returns true for success, false for failure.

Sets the optional authenticated additional data (AAD) for AES encryption in GCM mode. The data is provided as a binary-encoded string using the specified encoding, and any binary encoding supported by Chilkat can be used.

In GCM (Galois/Counter Mode) encryption, AAD (Additional Authenticated Data) is optional input that is not encrypted but is authenticated along with the ciphertext. It's used to verify integrity of associated data like headers or metadata. If AAD is modified, decryption will fail due to authentication tag mismatch.

Returns true for success, false for failure.

In GCM mode, the authentication tag is a short value (e.g. 16 bytes) generated during encryption that ensures the integrity and authenticity of both the ciphertext and any AAD. It must be verified during decryption to confirm the data hasn't been altered.

When decrypting AES-GCM, applications must call this method to provide the expected authentication tag.

To prevent Chilkat from checking the authentication tag after decryption, you can set the authentication tag to the special hex value FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF (16 bytes of 0xFF).

Returns true for success, false for failure.

Sets the initialization vector used in symmetric encrpytion (AES, Blowish, etc.) from a binary-encoded string using any Chilkat-supported encoding method (e.g., base64, hex).

An Initialization Vector (IV) is a random or unique value used in symmetric encryption to ensure that encrypting the same plaintext multiple times produces different ciphertexts. It prevents pattern leakage.

Cipher Modes That Require an IV:

• CBC (Cipher Block Chaining)
• CFB (Cipher Feedback)
• OFB (Output Feedback)
• CTR (Counter Mode)
• GCM (Galois/Counter Mode)

ECB (Electronic Codebook) does *not* use an IV, which makes it less secure.

Sets the encryption key used in symmetric encrpytion (AES, Blowfish, etc.) from a binary-encoded string using any Chilkat-supported encoding method (e.g., base64, hex).

The key must have a byte size equal to the KeyLength property. For instance, a KeyLength of 128 bits requires a 16-byte key, and a KeyLength of 256 bits requires a 32-byte key.

Sets the pbes2 or pbes1 salt bytes from a binary-encoded string using any Chilkat-supported encoding method (e.g., base64, hex).

Instructs the encryption library to use a specified digital certificate for public-key encryption. To encrypt using multiple certificates, call AddEncryptCert for each one. This action is equivalent to calling ClearEncryptCerts before AddEncryptCert .

Returns true for success, false for failure.

Sets the initialization vector (IV) for a symmetric encryption algorithm like AES.

Sets the MAC key from a binary-encoded string using any Chilkat-supported encoding method (e.g., base64, hex).

Returns true for success, false for failure.

Sets the MAC key from a string. The Charset property determines the actual bytes used for the MAC key.

Returns true for success, false for failure.

Sets the encryption key used in symmetric encrpytion (AES, Blowfish, etc.).

The key must have a byte size equal to the KeyLength property. For instance, a KeyLength of 128 bits requires a 16-byte key, and a KeyLength of 256 bits requires a 32-byte key.

Sets the digital certificate to be used for signing. Signing requires that the certificate has a private key.

Returns true for success, false for failure.

Sets the digital certificate and associated private key for signing. The private key must be the one that matches the certificate's public key.

Returns true for success, false for failure.

If timestamp server communications are needed for signing and special Internet settings like a proxy server are necessary, this method can provide an Http object configured with these settings.

Assigns the digital certificate for signature verification. Typically, a PKCS7 (CMS) signature includes the signing certificate information, making it unnecessary to call this method explicitly. This is only required in rare instances.

Returns true for success, false for failure.

Digitally signs the content in dataToSign and returns a detached signature (PKCS#7 signed-data) as a binary-encoded string. The EncodingMode property determines the binary-encoding. Possible encodings include base64, base64_mime, hex, and hex_lower. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the SignBdENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Digitally signs a pre-computed hash and returns a detached signature (PKCS#7 signed-data) as a binary-encoded string. The EncodingMode property determines the binary-encoding. Possible encodings include base64, base64_mime, hex, and hex_lower

encodedHash is a binary-encoded hash to be signed, with its encoding format specified by hashEncoding (e.g., base64, hex). hashAlg specifies the hash algorithm (e.g., sha256, sha1, sha512) used for encodedHash.

Returns true for success, false for failure.

Creates an asynchronous task to call the SignHashENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Digitally signs the text contained in sb and returns a detached signature (PKCS#7 signed-data) as a binary-encoded string. The EncodingMode property determines the binary-encoding. Possible encodings include base64, base64_mime, hex, and hex_lower. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing. The Charset property determines the actual bytes that are hashed and signed.

Returns true for success, false for failure.

Creates an asynchronous task to call the SignSbENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Digitally signs a string and returns a detached signature (PKCS#7 signed-data) as a binary-encoded string. The EncodingMode property determines the binary-encoding. Possible encodings include base64, base64_mime, hex, and hex_lower. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing. The Charset property determines the actual bytes that are hashed and signed.

Returns true for success, false for failure.

Creates an asynchronous task to call the SignStringENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Implements RFC 6238: TOTP: Time-Based One-Time Password Algorithm. The arguments to this method are:

• secret: The shared secret in an enocded representation such as base64, hex, ascii, etc.
• secretEnc: The encoding of the shared secret, such as base64
• t0: The Unix time to start counting time steps. It is a number in decimal string form. A Unix time is the number of seconds elapsed since midnight UTC of January 1, 1970. 0 is a typical value used for this argument.
• tNow: The current Unix time in decimal string form. To use the current system date/time, pass an empty string for this argument.
• tStep: The time step in seconds. A typical value is 30. Note: Both client and server must pre-agree on the secret, the t0, and the tStep.
• numDigits: The number of decimal digits to return.
• truncOffset: Normally set this to -1 for dynamic truncation. Otherwise can be set in the range 0..15.
• hashAlg: Normally set to sha1. Can be set to other hash algorithms such as sha256, sha512, etc.

Returns true for success, false for failure.

Adds an XML certificate vault to the object's internal list of sources to be searched for certificates and private keys when encrypting/decrypting or signing/verifying. Unlike the AddPfxSourceData and AddPfxSourceFile methods, only a single XML certificate vault can be used. If UseCertVault is called multiple times, only the last certificate vault will be used, as each call to UseCertVault will replace the certificate vault provided in previous calls.

Returns true for success, false for failure.

Verifies a detached digital signature against the original data contained in data. Returns true if the signature is verified. The encodedSig holds a binary-encoded PKCS#7 signed-data detached signature. The type of binary encoding, such as base64, hex, or base64_mime, is determined by the EncodingMode property.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

Verifies an opaque digital signature contained in a .p7m file and extracts the original data to destPath. Returns true if the .p7m is validated and the original data was extracted. Otherwise returns false.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

Verifies a detached digital signature contained in a .p7s file against the original data contained in originalDataPath. Returns true if the signature is verified.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

Verifies a detached digital signature against the original text contained in sb. Returns true if the signature is verified. The encodedSig holds a binary-encoded PKCS#7 signed-data detached signature. The type of binary encoding, such as base64, hex, or base64_mime, is determined by the EncodingMode property. The Charset property determines how the text in sb is converted to bytes for signature validation.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

Verifies a detached digital signature against the original text in str. Returns true if the signature is verified. The encodedSig holds a binary-encoded PKCS#7 signed-data detached signature. The type of binary encoding, such as base64, hex, or base64_mime, is determined by the EncodingMode property. The Charset property determines how the text in str is converted to bytes for signature validation.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

Sets the XTS-AES mode data unit number. The data unit number is a 64-bit unsigned integer. It is passed in as two 32-bit unsigned integers representing the high and low 32-bits.

Setting the data unit number is one way of setting the tweak value. The tweak value is 16 bytes in length and can alternatively be set by calling XtsSetEncodedTweakValue.

This method sets the tweak value such that the first 8 bytes are composed of the little-endian 64-bit data unit number, followed by 8 zero bytes.

(Unfortunately, Chilkat cannot use 64-bit integers in method arguments because many older programming environments, such as ActiveX, do not support it. Chilkat must present an identical and uniform API across all programming languages.)

Sets the XTS-AES mode tweak key from an encoded string. The encoding argument can be set to any of the following strings: base64, hex, quoted-printable, ascii, or url. The tweak key should be equal in size to the encryption key. For example, to do 256-bit AES-XTS, the encryption key is 256-bits, and the tweak key is also 256-bits.

Sets the XTS-AES mode tweak value from an encoded string. The encoding argument can be set to any of the following strings: base64, hex, quoted-printable, ascii, or url.

The tweak value must be 16 bytes in length. An application can set the initial tweak value by calling this method, or by calling XtsSetDataUnitNumber (but not both).

Provides the opportunity for a method call to be aborted. The AbortCheck event is fired periodically based on the value of the HeartbeatMs property. If HeartbeatMs is 0, then no AbortCheck events will fire. As an example, to fire 5 AbortCheck events per second, set the HeartbeatMs property equal to 200.

Provides the percentage completed for any method that involves network communications or time-consuming processing (assuming it is a method where a percentage completion can be measured). This event is only fired when it is possible to know a percentage completion, and when it makes sense to express the operation as a percentage completed. The pctDone argument will have a value from 1 to 100. For operations (Chilkat method calls) that complete very quickly, the number of PercentDone callbacks will vary, but the final callback should have a value of 100. For long running operations, no more than one callback per percentage point will occur (for example: 1, 2, 3, ... 98, 99, 100).

The PercentDone callback counts as an AbortCheck event. For method calls that complete quickly such that PercentDone events fire, it may be that AbortCheck events don't fire because the opportunity to abort is already provided in the PercentDone callback. For time consuming operations, where the amount of time between PercentDone callbacks are long, AbortCheck callbacks may be used to allow for the operation to be aborted in a more responsive manner.

The abort output argument provides a means for aborting the operation. Setting it to true will cause the method to abort and return a failed status (or whatever return value indicates failure).

A general name/value event that provides information about what is happening during a method call. To find out what information is available, write code to handle this event and log the name/value pairs. Most are self-explanatory.

Called in the background thread when an asynchronous task completes.

Adds a PFX file to the object's list of sources for locating certificates and private keys during public-key decryption or signing. To add multiple PFX sources, call this method multiple times. pfxBytes should contain the bytes of a PFX file (also known as PKCS12 or .p12).

Returns true for success, false for failure.

Calculates a CRC for byte data in memory using the CRC algorithm specified by crcAlg. Possible algorithms are:

• crc-32 - This is the CRC used in the Zip file format.
• crc8

Applications should instead call BinData.AppendEncoded to append binary encoded data (such as base64) to a BinData object. The decoded binary bytes can then be obtained from the BinData object.

Decode binary data from an encoded string. The encoding can be set to any of the following strings: base64, hex, quoted-printable, url, base32, Q, B, url_rc1738, url_rfc2396, url_rfc3986, url_oauth, uu, modBase64, or html (for HTML entity encoding).

Returns true for success, false for failure.

Decrypts a byte array and returns the unencrypted byte array. The property settings used when encrypting the data must match the settings when decrypting. Specifically, the CryptAlgorithm, CipherMode, PaddingScheme, KeyLength, IV, and SecretKey properties must match.

Returns true for success, false for failure.

The same as DecryptBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Decrypts string-encoded encrypted data and returns the unencrypted byte array. Data encrypted with EncryptBytesENC can be decrypted with this method. The property settings used when encrypting the data must match the settings when decrypting. Specifically, the EncodingMode, CryptAlgorithm, CipherMode, PaddingScheme, KeyLength, IV, and SecretKey properties must match.

Returns true for success, false for failure.

This method is deprecated. Applications should implement streaming decryption by using the FirstChunk and LastChunk properties.

Returns true for success, false for failure.

Creates an asynchronous task to call the DecryptStream method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Decrypts a previously encrypted string, using the Charset property to interpret the decrypted bytes as characters.

Returns true for success, false for failure.

Encode binary data to base64, hex, quoted-printable, or URL-encoding. The encoding can be set to any of the following strings: base64, hex, quoted-printable (or qp), url, base32, Q, B, url_rc1738, url_rfc2396, url_rfc3986, url_oauth, uu, modBase64, or html (for HTML entity encoding).

Returns true for success, false for failure.

Encrypts a byte array. The minimal set of properties that should be set before encrypting are: CryptAlgorithm, SecretKey. Other properties that control encryption are: CipherMode, PaddingScheme, KeyLength, IV. When decrypting, all property settings must match otherwise garbled data is returned.

Returns true for success, false for failure.

The same as EncryptBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Encrypts a byte array and returns the encrypted data as an encoded (printable) string. The minimal set of properties that should be set before encrypting are: CryptAlgorithm, SecretKey, EncodingMode. Other properties that control encryption are: CipherMode, PaddingScheme, KeyLength, IV. When decrypting, all property settings must match otherwise garbled data is returned. The encoding of the string that is returned is controlled by the EncodingMode property, which can be set to Base64, QP, or Hex.

Returns true for success, false for failure.

This method is deprecated. Applications should implement streaming encryption or decryption by using the FirstChunk and LastChunk properties.

Returns true for success, false for failure.

Creates an asynchronous task to call the EncryptStream method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Encrypts a string and returns the result as bytes, with the Charset property determining the specific byte encoding of what gets encrypted.

Returns true for success, false for failure.

This method is deprecated and should be avoided because it transforms the password into a binary secret key using a transformation that is undocumented and specific to this Chilkat method. PBKDF2 is a standard and more secure method of generating a binary secret key from a password.

Returns true for success, false for failure.

This method is deprecated and should be avoided because it transforms the password into a binary secret key using a transformation that is undocumented and specific to this Chilkat method. PBKDF2 is a standard and more secure method of generating a binary secret key from a password. An example using PBKDF2 is shown below.

This method converts a string into a byte array matching the bit length of the KeyLength property. For instance, if KeyLength is 128 bits, the resulting array will be 16 bytes. This byte array can be assigned to the SecretKey property. For decryption to work, the SecretKey must match exactly. To use password-based encryption, pass the password to this method to generate an appropriate binary secret key for the SecretKey property.

IMPORTANT: Do not use this method to decrypt data if another party has provided you with the secret key. It is intended to transform a password of any length into a correctly sized binary secret key.

Returns true for success, false for failure.

This method is deprecated. Application should instead call LastDecryptCert

Returns the last certificate used for public-key decryption.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

This method retrieves the authenticated additional data (AAD) set by the application during the last call to SetEncodedAad. However, using this method is redundant (and therefore deprecated), as the application can store and retrieve the AAD independently after calling SetEncodedAad.

Returns true for success, false for failure.

This method retrieves the symmetric encryption secret key set by the application during the last call to SetEncodedKey or RandomizeKey. However, using this method is redundant (and therefore deprecated), as the application can store and retrieve the key independently after calling SetEncodedKey.

Returns true for success, false for failure.

This method retrieves the password-based encryption (PBE) salt set by the application during the last call to SetEncodedSalt. However, using this method is redundant (and therefore deprecated), as the application can store and retrieve the salt independently after calling SetEncodedSalt.

Returns true for success, false for failure.

This method is deprecated. Application should instead call LastSignerCert

Gets the Nth certificate used for signing. This method can be called after verifying a digital signature to get the signer certs. The 1st certificate is at index 0. The NumSignerCerts property contains the total number of signing certificates. (Typically, a single certificate is used in creating a digital signature.)

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

This method is deprecated. Applications can get the cert chain by calling LastSignerCert to get the certificate object, and then get the certificate chain from the certificate object.

Returns the full certificate chain for the Nth certificate used to for signing. Indexing begins at 0.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

To hash binary data in chunks, start by hashing the first chunk using this method. For additional chunks, use the HashMoreBytes method as needed. Complete the process with HashFinal or HashFinalENC to obtain the hash result. The hash algorithm used is determined by the HashAlgorithm property setting.

Returns true for success, false for failure.

Hashes a byte array using the algorithm specified by the HashAlgorithm property.

Returns true for success, false for failure.

The same as HashBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Hashes a byte array and returns the hash as a binary encoded string.

The hash algorithm is specified by the HashAlgorithm property, The encoding is controlled by the EncodingMode property, which can be set to base64, hex, base64url, or any of the encodings listed at the link below.

Returns true for success, false for failure.

Hashes a file using the specified HashAlgorithm and returns the hash bytes. The file is processed in streaming mode, allowing any file size to be hashed efficiently while minimizing memory usage.

Returns true for success, false for failure.

Creates an asynchronous task to call the HashFile method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Finalizes a multi-step hash computation and returns the hash bytes.

Returns true for success, false for failure.

Adds more bytes to the hash currently under computation. (See HashBeginBytes)

Returns true for success, false for failure.

Hashes a string using the Charset property to determine the bytes and returns the hash.

Returns true for success, false for failure.

This method is deprecated. Please use GetLastJsonData instead. GetLastJsonData provides details about the most recently executed method. While many methods don't provide additional information, some do, such as after verifying a signature. In such cases, LastJsonData will return JSON with details like the algorithms used in the verification process.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Computes a Message Authentication Code using the algorithm defined in the MacAlgorithm property. The HashAlgorithm property setting determines the hash algorithm used internally. (A MAC algorithm like HMAC uses a hash function such as SHA-256 internally, along with a secret key, to create a secure and verifiable digest.)

Returns true for success, false for failure.

The same as MacBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Computes a Message Authentication Code using the MAC algorithm specified in the MacAlgorithm property. The result is encoded to a string using the encoding (base64, hex, etc.) specified by the EncodingMode property.

Returns true for success, false for failure.

Computes a Message Authentication Code using the specified MacAlgorithm property. The Charset property determines the actual bytes presented to the MAC algorithm. The HashAlgorithm property setting determines the hash algorithm used internally. (A MAC algorithm like HMAC uses a hash function such as SHA-256 internally, along with a secret key, to create a secure and verifiable digest.)

Returns true for success, false for failure.

Digitally signs a binary data and returns the signature in PKCS#7 signed-data format, which embeds the original data within the signature. Ensure a certificate is set using SetSigningCert before invoking this method. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the OpaqueSignBytes method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

The same as OpaqueSignBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Digitally signs a binary data and returns a PKCS#7 signed-data signature binary-encoded as a string. The returned signature embeds the original data. Ensure to set a certificate by calling SetSigningCert beforehand. The EncodingMode property determines the output encoding such as base64, hex, base64_mime, etc. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the OpaqueSignBytesENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Digitally signs a string and returns PKCS#7 signed-data. The Charset property determines the actual bytes that are hashed and signed. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the OpaqueSignString method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Verifies a PKCS#7 signed-data signature and returns the original data. If the signature fails verification, the returned data will be empty. Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

The same as OpaqueVerifyBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Verifies a PKCS#7 signed-data signature and returns the original data. If the signature fails verification, the returned data will be empty. The p7m is a binary-encoded string, using the encoding set by the EncodingMode property. Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

This function verifies a PKCS#7 signed-data signature and returns the original text data. If the signature does not verify successfully, it returns an empty string. The Charset property specifies how the original data bytes are converted to characters. You can obtain signer certificates using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.

Sets the secret key to a random value. This method should be replaced by calling GenRandomBytesENC followed by SetEncodedKey .

Sets the MAC key to be used for one of the Mac methods.

Returns true for success, false for failure.

This method, created over 15 years ago, is cryptographically insecure. Applications should use PBKDF2 for generating secret keys, as demonstrated below.

This method accepts a password string to generate a binary secret key of the necessary bit length, setting the SecretKey property. It should only be used when using Chilkat for both encryption and decryption, as the password-to-secret-key algorithm must match to ensure compatibility.

There is no restriction on password length. The password is converted into a binary secret key by generating an MD5 digest of the UTF-8 encoded password, producing 16 bytes. If the required KeyLength exceeds 16 bytes, the MD5 digest of the Base64 encoded UTF-8 password is appended, generating up to 32 bytes of key material. This is then truncated to meet the necessary KeyLength. Below is an example of how to replicate this computation manually.

Digitally signs binary data and returns the binary detached signature (PKCS#7 signed-data). The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the SignBytes method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

The same as SignBytes except the binary data is passed via a pointer and length.

Returns true for success, false for failure.

Digitally signs binary data and returns a detached signature (PKCS#7 signed-data) as a binary-encoded string. The EncodingMode property determines the binary-encoding. Possible encodings include base64, base64_mime, hex, and hex_lower. The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing.

Returns true for success, false for failure.

Creates an asynchronous task to call the SignBytesENC method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Digitally signs a string and returns a the binary detached signature (PKCS#7 signed-data). The HashAlgorithm property specifies the hash algorithm for creating the data's hash during signing. The Charset property determines the actual bytes that are hashed and signed.

Returns true for success, false for failure.

Creates an asynchronous task to call the SignString method with the arguments provided.

Note: Async method event callbacks happen in the background thread. Accessing and updating UI elements existing in the main thread may require special considerations.

Note: The application is responsible for deleting (via the C++ delete operator) the object returned by this method.

Returns NULL on failure

Verifies a detached digital signature against the original binary data. Returns true if the signature is verified.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Verifies a detached digital signature against the original binary data. Returns true if the signature is verified. The encodedSig holds a binary-encoded PKCS#7 signed-data detached signature. The type of binary encoding, such as base64, hex, or base64_mime, is determined by the EncodingMode property.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

This method is the same as VerifyP7S. Applications should instead call VerifyP7S.

Verifies a detached digital signature against the original text in str. Returns true if the signature is verified. The sig holds a binary PKCS#7 signed-data detached signature. The Charset property determines how the text in str is converted to bytes for signature validation.

Afterwards, you can retrieve signer certificates by using the NumSignerCerts property and the LastSignerCert method.

Returns true for success, false for failure.