DPAPI Class
Properties Methods Events Config Settings Errors
The DPAPI class allows you to protect and unprotect data.
Syntax
DPAPI
Remarks
The class supports the classic Microsoft Windows Data Protection API (DPAPI) or CNG DPAPI implementation. The use of UseCNG determines which implementation is used.
The classic DPAPI functionality protects data on a single system. The CNG DPAPI is designed with modern use cases involved. In many cases, especially with cloud computing, protection and unprotection may be done on different systems. With this in mind the Microsoft CNG DPAPI allows encrypting to a set of principals that can be used to unprotect the data on other systems after authenticating.
Protecting Data
Protect protects the specified data.
The class supports protecting data using either the classic DPAPI or CNG DPAPI implementation. The use of UseCNG determines which implementation is used. The list of applicable properties differs depending on whether CNG DPAPI is being used.
When using classic DPAPI (UseCNG is False), the following optional properties are applicable:
When using CNG DPAPI (UseCNG is True), the following properties are applicable:
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Code Example (Classic DPAPI - UseCNG is False)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Code Example (CNG DPAPI - UseCNG is True)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.ProtectionDescriptor = "LOCAL=user";
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Unprotecting Data
Unprotect unprotects the specified data.
The class supports unprotecting data using either the classic DPAPI or CNG DPAPI implementation. The use of UseCNG determines which implementation is used. The list of applicable properties differs depending on whether CNG DPAPI is being used.
When using classic DPAPI (UseCNG is False), the following optional properties are applicable:
- DataDescription (populated after completion)
- Password
When using CNG DPAPI (UseCNG is True), the following properties are applicable:
- ProtectionDescriptor (populated after completion)
- UseStreamMode
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Code Example (Classic DPAPI - UseCNG is False)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Code Example (CNG DPAPI - UseCNG is True)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.ProtectionDescriptor = "LOCAL=user";
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
DataDescription | The description of data. |
InputFile | The file to process. |
InputMessage | The message to process. |
OutputFile | The output file when encrypting or decrypting. |
OutputMessage | The output message after processing. |
Overwrite | Indicates whether or not the class should overwrite files. |
Password | An optional password to further protect data. |
PromptTitle | The title of the prompt window. |
PromptUser | Whether to display a prompt. |
ProtectionDescriptor | The CNG protection descriptor. |
UseCNG | Whether to use CNG DPAPI. |
UseHex | Whether input or output is hex encoded. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
Config | Sets or retrieves a configuration setting. |
Protect | Protects the data. |
Reset | Resets the class. |
SetInputStream | Sets the stream from which the class will read data to encrypt or decrypt. |
SetOutputStream | Sets the stream to which the class will write encrypted or decrypted data. |
Unprotect | Unprotects the data. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
Error | Fired when information is available about errors during data delivery. |
Progress | Fired as progress is made. |
Config Settings
The following is a list of config settings for the class with short descriptions. Click on the links for further details.
EscapeDescriptor | Whether to escape the protection descriptor. |
ProtectionFlags | Used to specify additional options. |
UseStreamMode | Whether to use the CNG streaming operations. |
BuildInfo | Information about the product's build. |
CodePage | The system code page used for Unicode to Multibyte translations. |
LicenseInfo | Information about the current license. |
MaskSensitive | Whether sensitive data is masked in log messages. |
ProcessIdleEvents | Whether the class uses its internal event loop to process events when the main thread is idle. |
SelectWaitMillis | The length of time in milliseconds the class will wait when DoEvents is called if there are no events to process. |
UseInternalSecurityAPI | Whether or not to use the system security libraries or an internal implementation. |
DataDescription Property (DPAPI Class)
The description of data.
Syntax
ANSI (Cross Platform) char* GetDataDescription();
int SetDataDescription(const char* lpszDataDescription); Unicode (Windows) LPWSTR GetDataDescription();
INT SetDataDescription(LPCWSTR lpszDataDescription);
char* ipworksencrypt_dpapi_getdatadescription(void* lpObj);
int ipworksencrypt_dpapi_setdatadescription(void* lpObj, const char* lpszDataDescription);
QString GetDataDescription();
int SetDataDescription(QString qsDataDescription);
Default Value
""
Remarks
This property specifies an optional description of the protected data.
This may be set before calling Protect. This property will be populated when calling Unprotect.
This setting is not applicable when UseCNG is set to True.
Data Type
String
InputFile Property (DPAPI Class)
The file to process.
Syntax
ANSI (Cross Platform) char* GetInputFile();
int SetInputFile(const char* lpszInputFile); Unicode (Windows) LPWSTR GetInputFile();
INT SetInputFile(LPCWSTR lpszInputFile);
char* ipworksencrypt_dpapi_getinputfile(void* lpObj);
int ipworksencrypt_dpapi_setinputfile(void* lpObj, const char* lpszInputFile);
QString GetInputFile();
int SetInputFile(QString qsInputFile);
Default Value
""
Remarks
This property specifies the file to be processed. Set this property to the full or relative path to the file which will be processed.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Data Type
String
InputMessage Property (DPAPI Class)
The message to process.
Syntax
ANSI (Cross Platform) int GetInputMessage(char* &lpInputMessage, int &lenInputMessage);
int SetInputMessage(const char* lpInputMessage, int lenInputMessage); Unicode (Windows) INT GetInputMessage(LPSTR &lpInputMessage, INT &lenInputMessage);
INT SetInputMessage(LPCSTR lpInputMessage, INT lenInputMessage);
int ipworksencrypt_dpapi_getinputmessage(void* lpObj, char** lpInputMessage, int* lenInputMessage);
int ipworksencrypt_dpapi_setinputmessage(void* lpObj, const char* lpInputMessage, int lenInputMessage);
QByteArray GetInputMessage();
int SetInputMessage(QByteArray qbaInputMessage);
Default Value
""
Remarks
This property specifies the message to be processed.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Data Type
Binary String
OutputFile Property (DPAPI Class)
The output file when encrypting or decrypting.
Syntax
ANSI (Cross Platform) char* GetOutputFile();
int SetOutputFile(const char* lpszOutputFile); Unicode (Windows) LPWSTR GetOutputFile();
INT SetOutputFile(LPCWSTR lpszOutputFile);
char* ipworksencrypt_dpapi_getoutputfile(void* lpObj);
int ipworksencrypt_dpapi_setoutputfile(void* lpObj, const char* lpszOutputFile);
QString GetOutputFile();
int SetOutputFile(QString qsOutputFile);
Default Value
""
Remarks
This property specifies the file to which the output will be written when Encrypt or Decrypt is called. This may be set to an absolute or relative path.
This property is only applicable to Encrypt and Decrypt.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Data Type
String
OutputMessage Property (DPAPI Class)
The output message after processing.
Syntax
ANSI (Cross Platform) int GetOutputMessage(char* &lpOutputMessage, int &lenOutputMessage); Unicode (Windows) INT GetOutputMessage(LPSTR &lpOutputMessage, INT &lenOutputMessage);
int ipworksencrypt_dpapi_getoutputmessage(void* lpObj, char** lpOutputMessage, int* lenOutputMessage);
QByteArray GetOutputMessage();
Default Value
""
Remarks
This property will be populated with the output from the operation if OutputFile is not set.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
This property is read-only and not available at design time.
Data Type
Binary String
Overwrite Property (DPAPI Class)
Indicates whether or not the class should overwrite files.
Syntax
ANSI (Cross Platform) int GetOverwrite();
int SetOverwrite(int bOverwrite); Unicode (Windows) BOOL GetOverwrite();
INT SetOverwrite(BOOL bOverwrite);
int ipworksencrypt_dpapi_getoverwrite(void* lpObj);
int ipworksencrypt_dpapi_setoverwrite(void* lpObj, int bOverwrite);
bool GetOverwrite();
int SetOverwrite(bool bOverwrite);
Default Value
FALSE
Remarks
This property indicates whether or not the class will overwrite OutputFile. If Overwrite is False, an error will be thrown whenever OutputFile exists before an operation. The default value is False.
Data Type
Boolean
Password Property (DPAPI Class)
An optional password to further protect data.
Syntax
ANSI (Cross Platform) char* GetPassword();
int SetPassword(const char* lpszPassword); Unicode (Windows) LPWSTR GetPassword();
INT SetPassword(LPCWSTR lpszPassword);
char* ipworksencrypt_dpapi_getpassword(void* lpObj);
int ipworksencrypt_dpapi_setpassword(void* lpObj, const char* lpszPassword);
QString GetPassword();
int SetPassword(QString qsPassword);
Default Value
""
Remarks
This property may be set to a password to protect the data further.
When protecting data without specifying a password any application running under the same user account can unprotect the data. By specifying a password another piece of information is required to unprotect the data.
This may be set before calling Protect. If a password was specified when protecting data it must be set before calling Unprotect.
This setting is not applicable when UseCNG is set to True.
Data Type
String
PromptTitle Property (DPAPI Class)
The title of the prompt window.
Syntax
ANSI (Cross Platform) char* GetPromptTitle();
int SetPromptTitle(const char* lpszPromptTitle); Unicode (Windows) LPWSTR GetPromptTitle();
INT SetPromptTitle(LPCWSTR lpszPromptTitle);
char* ipworksencrypt_dpapi_getprompttitle(void* lpObj);
int ipworksencrypt_dpapi_setprompttitle(void* lpObj, const char* lpszPromptTitle);
QString GetPromptTitle();
int SetPromptTitle(QString qsPromptTitle);
Default Value
""
Remarks
This property specifies the title of the prompt dialog if PromptUser is True. The default value is empty string.
This setting is not applicable when UseCNG is set to True.
Data Type
String
PromptUser Property (DPAPI Class)
Whether to display a prompt.
Syntax
ANSI (Cross Platform) int GetPromptUser();
int SetPromptUser(int bPromptUser); Unicode (Windows) BOOL GetPromptUser();
INT SetPromptUser(BOOL bPromptUser);
int ipworksencrypt_dpapi_getpromptuser(void* lpObj);
int ipworksencrypt_dpapi_setpromptuser(void* lpObj, int bPromptUser);
bool GetPromptUser();
int SetPromptUser(bool bPromptUser);
Default Value
FALSE
Remarks
This property specifies whether a prompt is displayed when calling Protect. This dialog is created by the system and informs the user of the request action. The user may accept or cancel the request. If the user cancels the request the Protect method fails with an error.
When True the PromptTitle may be set to customize the window title.
This setting is not applicable when UseCNG is set to True. ;
Data Type
Boolean
ProtectionDescriptor Property (DPAPI Class)
The CNG protection descriptor.
Syntax
ANSI (Cross Platform) char* GetProtectionDescriptor();
int SetProtectionDescriptor(const char* lpszProtectionDescriptor); Unicode (Windows) LPWSTR GetProtectionDescriptor();
INT SetProtectionDescriptor(LPCWSTR lpszProtectionDescriptor);
char* ipworksencrypt_dpapi_getprotectiondescriptor(void* lpObj);
int ipworksencrypt_dpapi_setprotectiondescriptor(void* lpObj, const char* lpszProtectionDescriptor);
QString GetProtectionDescriptor();
int SetProtectionDescriptor(QString qsProtectionDescriptor);
Default Value
""
Remarks
This property specifies the protection descriptor rule string. The protection descriptor is used by the system to decide which entities can unprotect the data at a later time. This property must be specified before calling Protect. This property is populated after calling Unprotect.
Protection descriptors can be defined for the following types of authorization:
- A local user or machine
- An account or group in an Active Directory forest
- A set of web credentials
- A certificate in the user's certificate store
A local user or machine may be used for machines that are or are not on a domain. For instance:
- LOCAL=user
- LOCAL=machine
The use of SID and SDDL requires that the machine be part of a domain. For instance:
- SID=S-1-5-21-4392301 AND SID=S-1-5-21-3101812
- SDDL=O:S-1-5-5-0-290724G:SYD:(A;;CCDC;;;S-1-5-5-0-290724)(A;;DC;;;WD)
Certificates may also be used as a descriptor. To decrypt, the certificate with corresponding private key must be present in the user's certificate store. The public certificate can be specified as the SHA1 thumbprint (hash) of the certificate, or the base64 encoded certificate itself. For instance:
- CERTIFICATE=HashID:28ac375635b82ca3e20a1c9422145bc93965dae7
- CERTIFICATE=CertBlob:MIIC7TCCAdWgAw...pgpVgYpppr
The use of AND and OR operators are accepted in order to encrypt data for multiple parties or establish multiple conditions for decryption.
For more details about protection descriptors and accepted formats please refer to the Microsoft Documentation for Protection Descriptors
This setting is only applicable when UseCNG is set to True.
Data Type
String
UseCNG Property (DPAPI Class)
Whether to use CNG DPAPI.
Syntax
ANSI (Cross Platform) int GetUseCNG();
int SetUseCNG(int bUseCNG); Unicode (Windows) BOOL GetUseCNG();
INT SetUseCNG(BOOL bUseCNG);
int ipworksencrypt_dpapi_getusecng(void* lpObj);
int ipworksencrypt_dpapi_setusecng(void* lpObj, int bUseCNG);
bool GetUseCNG();
int SetUseCNG(bool bUseCNG);
Default Value
FALSE
Remarks
The class supports protecting data using either the classic DPAPI or CNG DPAPI implementation. When set to True the CNG DPAPI implementation is sued. When set to False (default) the classic DPAPI implementation is used.
Data Type
Boolean
UseHex Property (DPAPI Class)
Whether input or output is hex encoded.
Syntax
ANSI (Cross Platform) int GetUseHex();
int SetUseHex(int bUseHex); Unicode (Windows) BOOL GetUseHex();
INT SetUseHex(BOOL bUseHex);
int ipworksencrypt_dpapi_getusehex(void* lpObj);
int ipworksencrypt_dpapi_setusehex(void* lpObj, int bUseHex);
bool GetUseHex();
int SetUseHex(bool bUseHex);
Default Value
FALSE
Remarks
This property specifies whether the encrypted data is hex encoded.
If set to True, when Protect is called the class will perform the encryption as normal and then hex encode the output. OutputMessage or OutputFile will hold hex encoded data.
If set to True, when Unprotect is called the class will expect InputMessage or InputFile to hold hex encoded data. The class will then hex decode the data and perform decryption as normal.
Data Type
Boolean
Config Method (DPAPI Class)
Sets or retrieves a configuration setting.
Syntax
ANSI (Cross Platform) char* Config(const char* lpszConfigurationString); Unicode (Windows) LPWSTR Config(LPCWSTR lpszConfigurationString);
char* ipworksencrypt_dpapi_config(void* lpObj, const char* lpszConfigurationString);
QString Config(const QString& qsConfigurationString);
Remarks
Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.
These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.
To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).
To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.
Error Handling (C++)
This method returns a String value; after it returns, call the GetLastErrorCode() method to obtain its result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.
Protect Method (DPAPI Class)
Protects the data.
Syntax
ANSI (Cross Platform) int Protect(); Unicode (Windows) INT Protect();
int ipworksencrypt_dpapi_protect(void* lpObj);
int Protect();
Remarks
Protect protects the specified data.
The class supports protecting data using either the classic DPAPI or CNG DPAPI implementation. The use of UseCNG determines which implementation is used. The list of applicable properties differs depending on whether CNG DPAPI is being used.
When using classic DPAPI (UseCNG is False), the following optional properties are applicable:
When using CNG DPAPI (UseCNG is True), the following properties are applicable:
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Code Example (Classic DPAPI - UseCNG is False)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Code Example (CNG DPAPI - UseCNG is True)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.ProtectionDescriptor = "LOCAL=user";
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Reset Method (DPAPI Class)
Resets the class.
Syntax
ANSI (Cross Platform) int Reset(); Unicode (Windows) INT Reset();
int ipworksencrypt_dpapi_reset(void* lpObj);
int Reset();
Remarks
When called, the class will reset all of its properties to their default values.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
SetInputStream Method (DPAPI Class)
Sets the stream from which the class will read data to encrypt or decrypt.
Syntax
ANSI (Cross Platform) int SetInputStream(IPWorksEncryptStream* sInputStream); Unicode (Windows) INT SetInputStream(IPWorksEncryptStream* sInputStream);
int ipworksencrypt_dpapi_setinputstream(void* lpObj, IPWorksEncryptStream* sInputStream);
int SetInputStream(IPWorksEncryptStream* sInputStream);
Remarks
This method sets the stream from which the class will read data to encrypt or decrypt.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
- SetInputStream
- InputFile
- InputMessage
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
SetOutputStream Method (DPAPI Class)
Sets the stream to which the class will write encrypted or decrypted data.
Syntax
ANSI (Cross Platform) int SetOutputStream(IPWorksEncryptStream* sOutputStream); Unicode (Windows) INT SetOutputStream(IPWorksEncryptStream* sOutputStream);
int ipworksencrypt_dpapi_setoutputstream(void* lpObj, IPWorksEncryptStream* sOutputStream);
int SetOutputStream(IPWorksEncryptStream* sOutputStream);
Remarks
This method sets the stream to which the class will write encrypted or decrypted data.
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Unprotect Method (DPAPI Class)
Unprotects the data.
Syntax
ANSI (Cross Platform) int Unprotect(); Unicode (Windows) INT Unprotect();
int ipworksencrypt_dpapi_unprotect(void* lpObj);
int Unprotect();
Remarks
Unprotect unprotects the specified data.
The class supports unprotecting data using either the classic DPAPI or CNG DPAPI implementation. The use of UseCNG determines which implementation is used. The list of applicable properties differs depending on whether CNG DPAPI is being used.
When using classic DPAPI (UseCNG is False), the following optional properties are applicable:
- DataDescription (populated after completion)
- Password
When using CNG DPAPI (UseCNG is True), the following properties are applicable:
- ProtectionDescriptor (populated after completion)
- UseStreamMode
Input and Output Properties
The class will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Code Example (Classic DPAPI - UseCNG is False)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Code Example (CNG DPAPI - UseCNG is True)
//Protect
Dpapi dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.ProtectionDescriptor = "LOCAL=user";
dpapi.InputMessage = "test";
dpapi.Protect();
byte[] protectedData = dpapi.OutputMessageB;
//Unprotect
dpapi = new Dpapi();
dpapi.UseCNG = true;
dpapi.InputMessageB = protectedData;
dpapi.Unprotect();
Console.WriteLine(dpapi.OutputMessage); //outputs "test"
Error Handling (C++)
This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)
Error Event (DPAPI Class)
Fired when information is available about errors during data delivery.
Syntax
ANSI (Cross Platform) virtual int FireError(DPAPIErrorEventParams *e);
typedef struct {
int ErrorCode;
const char *Description; int reserved; } DPAPIErrorEventParams;
Unicode (Windows) virtual INT FireError(DPAPIErrorEventParams *e);
typedef struct {
INT ErrorCode;
LPCWSTR Description; INT reserved; } DPAPIErrorEventParams;
#define EID_DPAPI_ERROR 1 virtual INT IPWORKSENCRYPT_CALL FireError(INT &iErrorCode, LPSTR &lpszDescription);
class DPAPIErrorEventParams { public: int ErrorCode(); const QString &Description(); int EventRetVal(); void SetEventRetVal(int iRetVal); };
// To handle, connect one or more slots to this signal. void Error(DPAPIErrorEventParams *e);
// Or, subclass DPAPI and override this emitter function. virtual int FireError(DPAPIErrorEventParams *e) {...}
Remarks
The Error event is fired in case of exceptional conditions during message processing. Normally the class fails with an error.
The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.
Progress Event (DPAPI Class)
Fired as progress is made.
Syntax
ANSI (Cross Platform) virtual int FireProgress(DPAPIProgressEventParams *e);
typedef struct {
int64 BytesProcessed;
int PercentProcessed; int reserved; } DPAPIProgressEventParams;
Unicode (Windows) virtual INT FireProgress(DPAPIProgressEventParams *e);
typedef struct {
LONG64 BytesProcessed;
INT PercentProcessed; INT reserved; } DPAPIProgressEventParams;
#define EID_DPAPI_PROGRESS 2 virtual INT IPWORKSENCRYPT_CALL FireProgress(LONG64 &lBytesProcessed, INT &iPercentProcessed);
class DPAPIProgressEventParams { public: qint64 BytesProcessed(); int PercentProcessed(); int EventRetVal(); void SetEventRetVal(int iRetVal); };
// To handle, connect one or more slots to this signal. void Progress(DPAPIProgressEventParams *e);
// Or, subclass DPAPI and override this emitter function. virtual int FireProgress(DPAPIProgressEventParams *e) {...}
Remarks
This event is fired automatically as data is processed by the class.
The PercentProcessed parameter indicates the current status of the operation.
The BytesProcessed parameter holds the total number of bytes processed so far.
IPWorksEncryptStream Type
Syntax
IPWorksEncryptStream (declared in ipworksencrypt.h)
Remarks
The DPAPI class includes one or more API members that take a stream object as a parameter. To use such API members, create a concrete class that implements the IPWorksEncryptStream interface and pass the DPAPI class an instance of that concrete class.
When implementing the IPWorksEncryptStream interface's properties and methods, they must behave as described below. If the concrete class's implementation does not behave as expected, undefined behavior may occur.
Config Settings (DPAPI Class)
The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.DPAPI Config Settings
This setting controls whether the ProtectionDescriptor value is escaped when Protect is called. When set to False (default) the value is passed exactly as provided to the underlying system libraries. When set to True the value is first escaped according to the escaping rules defined by Microsoft.
The default value of EscapeDescriptor is True.
This setting is only applicable when UseCNG is set to True.
Additional options are available to restrict or change the behavior of the protect and unprotect operations.
By default no additional settings are specified (the value is 0). You may set this property to the binary 'OR' of one or more of the following values:
1 (0x1) | CRYPTPROTECT_UI_FORBIDDEN | This flag is used for remote situations where presenting a user interface (UI) is not an option. When this flag is set and a UI is specified for either the protect or unprotect operation, the operation fails. |
4 (0x4) | CRYPTPROTECT_LOCAL_MACHINE | When this flag is set, it associates the data encrypted with the current computer instead of with an individual user. This is only applicable when calling Protect. |
8 (0x8) | CRYPTPROTECT_CRED_SYNC | When this flag is used, no data is actually protected. Instead all MasterKeys are queried from disk, which will cause re-encryption in memory, presumably under a changed password. This is only applicable when calling Protect. |
16 (0x10) | CRYPTPROTECT_AUDIT | This flag causes DPAPI to generate an audit when this data is protected or unprotected. This is only applicable when calling Protect. |
64 (0x40) | CRYPTPROTECT_VERIFY_PROTECTION | If the protected data blob would be better protected under a new call to the internal protect function and this call succeeds, then GetLastError will return a CRYPT_I_NEW_PROTECTION_REQUIRED status code. This is only applicable when calling Unprotect. |
536870912 (0x20000000) | CRYPTPROTECT_SYSTEM | If data was protected with this flag set, then this flag must be set to unprotect the data. |
This setting is not applicable when UseCNG is set to True.
When set to True the class will use the CNG streaming operations when Protect and Unprotect are called. When working with large amounts of data this can reduce the memory overhead during processing. Note that when enabled InputFile and OutputFile should be used for optimal memory usage.
The default value of UseStreamMode is False.
This setting is only applicable when UseCNG is set to True.
Base Config Settings
When queried, this setting will return a string containing information about the product's build.
The default code page is Unicode UTF-8 (65001).
The following is a list of valid code page identifiers:
Identifier | Name |
037 | IBM EBCDIC - U.S./Canada |
437 | OEM - United States |
500 | IBM EBCDIC - International |
708 | Arabic - ASMO 708 |
709 | Arabic - ASMO 449+, BCON V4 |
710 | Arabic - Transparent Arabic |
720 | Arabic - Transparent ASMO |
737 | OEM - Greek (formerly 437G) |
775 | OEM - Baltic |
850 | OEM - Multilingual Latin I |
852 | OEM - Latin II |
855 | OEM - Cyrillic (primarily Russian) |
857 | OEM - Turkish |
858 | OEM - Multilingual Latin I + Euro symbol |
860 | OEM - Portuguese |
861 | OEM - Icelandic |
862 | OEM - Hebrew |
863 | OEM - Canadian-French |
864 | OEM - Arabic |
865 | OEM - Nordic |
866 | OEM - Russian |
869 | OEM - Modern Greek |
870 | IBM EBCDIC - Multilingual/ROECE (Latin-2) |
874 | ANSI/OEM - Thai (same as 28605, ISO 8859-15) |
875 | IBM EBCDIC - Modern Greek |
932 | ANSI/OEM - Japanese, Shift-JIS |
936 | ANSI/OEM - Simplified Chinese (PRC, Singapore) |
949 | ANSI/OEM - Korean (Unified Hangul Code) |
950 | ANSI/OEM - Traditional Chinese (Taiwan; Hong Kong SAR, PRC) |
1026 | IBM EBCDIC - Turkish (Latin-5) |
1047 | IBM EBCDIC - Latin 1/Open System |
1140 | IBM EBCDIC - U.S./Canada (037 + Euro symbol) |
1141 | IBM EBCDIC - Germany (20273 + Euro symbol) |
1142 | IBM EBCDIC - Denmark/Norway (20277 + Euro symbol) |
1143 | IBM EBCDIC - Finland/Sweden (20278 + Euro symbol) |
1144 | IBM EBCDIC - Italy (20280 + Euro symbol) |
1145 | IBM EBCDIC - Latin America/Spain (20284 + Euro symbol) |
1146 | IBM EBCDIC - United Kingdom (20285 + Euro symbol) |
1147 | IBM EBCDIC - France (20297 + Euro symbol) |
1148 | IBM EBCDIC - International (500 + Euro symbol) |
1149 | IBM EBCDIC - Icelandic (20871 + Euro symbol) |
1200 | Unicode UCS-2 Little-Endian (BMP of ISO 10646) |
1201 | Unicode UCS-2 Big-Endian |
1250 | ANSI - Central European |
1251 | ANSI - Cyrillic |
1252 | ANSI - Latin I |
1253 | ANSI - Greek |
1254 | ANSI - Turkish |
1255 | ANSI - Hebrew |
1256 | ANSI - Arabic |
1257 | ANSI - Baltic |
1258 | ANSI/OEM - Vietnamese |
1361 | Korean (Johab) |
10000 | MAC - Roman |
10001 | MAC - Japanese |
10002 | MAC - Traditional Chinese (Big5) |
10003 | MAC - Korean |
10004 | MAC - Arabic |
10005 | MAC - Hebrew |
10006 | MAC - Greek I |
10007 | MAC - Cyrillic |
10008 | MAC - Simplified Chinese (GB 2312) |
10010 | MAC - Romania |
10017 | MAC - Ukraine |
10021 | MAC - Thai |
10029 | MAC - Latin II |
10079 | MAC - Icelandic |
10081 | MAC - Turkish |
10082 | MAC - Croatia |
12000 | Unicode UCS-4 Little-Endian |
12001 | Unicode UCS-4 Big-Endian |
20000 | CNS - Taiwan |
20001 | TCA - Taiwan |
20002 | Eten - Taiwan |
20003 | IBM5550 - Taiwan |
20004 | TeleText - Taiwan |
20005 | Wang - Taiwan |
20105 | IA5 IRV International Alphabet No. 5 (7-bit) |
20106 | IA5 German (7-bit) |
20107 | IA5 Swedish (7-bit) |
20108 | IA5 Norwegian (7-bit) |
20127 | US-ASCII (7-bit) |
20261 | T.61 |
20269 | ISO 6937 Non-Spacing Accent |
20273 | IBM EBCDIC - Germany |
20277 | IBM EBCDIC - Denmark/Norway |
20278 | IBM EBCDIC - Finland/Sweden |
20280 | IBM EBCDIC - Italy |
20284 | IBM EBCDIC - Latin America/Spain |
20285 | IBM EBCDIC - United Kingdom |
20290 | IBM EBCDIC - Japanese Katakana Extended |
20297 | IBM EBCDIC - France |
20420 | IBM EBCDIC - Arabic |
20423 | IBM EBCDIC - Greek |
20424 | IBM EBCDIC - Hebrew |
20833 | IBM EBCDIC - Korean Extended |
20838 | IBM EBCDIC - Thai |
20866 | Russian - KOI8-R |
20871 | IBM EBCDIC - Icelandic |
20880 | IBM EBCDIC - Cyrillic (Russian) |
20905 | IBM EBCDIC - Turkish |
20924 | IBM EBCDIC - Latin-1/Open System (1047 + Euro symbol) |
20932 | JIS X 0208-1990 & 0121-1990 |
20936 | Simplified Chinese (GB2312) |
21025 | IBM EBCDIC - Cyrillic (Serbian, Bulgarian) |
21027 | Extended Alpha Lowercase |
21866 | Ukrainian (KOI8-U) |
28591 | ISO 8859-1 Latin I |
28592 | ISO 8859-2 Central Europe |
28593 | ISO 8859-3 Latin 3 |
28594 | ISO 8859-4 Baltic |
28595 | ISO 8859-5 Cyrillic |
28596 | ISO 8859-6 Arabic |
28597 | ISO 8859-7 Greek |
28598 | ISO 8859-8 Hebrew |
28599 | ISO 8859-9 Latin 5 |
28605 | ISO 8859-15 Latin 9 |
29001 | Europa 3 |
38598 | ISO 8859-8 Hebrew |
50220 | ISO 2022 Japanese with no halfwidth Katakana |
50221 | ISO 2022 Japanese with halfwidth Katakana |
50222 | ISO 2022 Japanese JIS X 0201-1989 |
50225 | ISO 2022 Korean |
50227 | ISO 2022 Simplified Chinese |
50229 | ISO 2022 Traditional Chinese |
50930 | Japanese (Katakana) Extended |
50931 | US/Canada and Japanese |
50933 | Korean Extended and Korean |
50935 | Simplified Chinese Extended and Simplified Chinese |
50936 | Simplified Chinese |
50937 | US/Canada and Traditional Chinese |
50939 | Japanese (Latin) Extended and Japanese |
51932 | EUC - Japanese |
51936 | EUC - Simplified Chinese |
51949 | EUC - Korean |
51950 | EUC - Traditional Chinese |
52936 | HZ-GB2312 Simplified Chinese |
54936 | Windows XP: GB18030 Simplified Chinese (4 Byte) |
57002 | ISCII Devanagari |
57003 | ISCII Bengali |
57004 | ISCII Tamil |
57005 | ISCII Telugu |
57006 | ISCII Assamese |
57007 | ISCII Oriya |
57008 | ISCII Kannada |
57009 | ISCII Malayalam |
57010 | ISCII Gujarati |
57011 | ISCII Punjabi |
65000 | Unicode UTF-7 |
65001 | Unicode UTF-8 |
Identifier | Name |
1 | ASCII |
2 | NEXTSTEP |
3 | JapaneseEUC |
4 | UTF8 |
5 | ISOLatin1 |
6 | Symbol |
7 | NonLossyASCII |
8 | ShiftJIS |
9 | ISOLatin2 |
10 | Unicode |
11 | WindowsCP1251 |
12 | WindowsCP1252 |
13 | WindowsCP1253 |
14 | WindowsCP1254 |
15 | WindowsCP1250 |
21 | ISO2022JP |
30 | MacOSRoman |
10 | UTF16String |
0x90000100 | UTF16BigEndian |
0x94000100 | UTF16LittleEndian |
0x8c000100 | UTF32String |
0x98000100 | UTF32BigEndian |
0x9c000100 | UTF32LittleEndian |
65536 | Proprietary |
When queried, this setting will return a string containing information about the license this instance of a class is using. It will return the following information:
- Product: The product the license is for.
- Product Key: The key the license was generated from.
- License Source: Where the license was found (e.g., RuntimeLicense, License File).
- License Type: The type of license installed (e.g., Royalty Free, Single Server).
- Last Valid Build: The last valid build number for which the license will work.
In certain circumstances it may be beneficial to mask sensitive data, like passwords, in log messages. Set this to true to mask sensitive data. The default is true.
This setting only works on these classes: AS3Receiver, AS3Sender, Atom, Client(3DS), FTP, FTPServer, IMAP, OFTPClient, SSHClient, SCP, Server(3DS), Sexec, SFTP, SFTPServer, SSHServer, TCPClient, TCPServer.
If set to False, the class will not fire internal idle events. Set this to False to use the class in a background thread on Mac OS. By default, this setting is True.
If there are no events to process when DoEvents is called, the class will wait for the amount of time specified here before returning. The default value is 20.
When set to false, the class will use the system security libraries by default to perform cryptographic functions where applicable.
Setting this configuration setting to true tells the class to use the internal implementation instead of using the system security libraries.
On Windows, this setting is set to false by default. On Linux/macOS, this setting is set to true by default.
To use the system security libraries for Linux, OpenSSL support must be enabled. For more information on how to enable OpenSSL, please refer to the OpenSSL Notes section.
Trappable Errors (DPAPI Class)
Error Handling (C++)
Call the GetLastErrorCode() method to obtain the last called method's result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. Known error codes are listed below. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.
DPAPI Errors
104 Cannot read or write file. | |
109 Cannot protect data. | |
110 Cannot unprotect data | |
111 OutputFile already exists and Overwrite is False. | |
304 Cannot write file. | |
305 Cannot read file. | |
306 Cannot create file. |