PublicKeyCrypto Class

Properties   Methods   Events   Config Settings   Errors  

The PublicKeyCrypto class supports encrypting, decrypting, signing and verifying messages.

Syntax

secureblackbox.Publickeycrypto

Remarks

PublicKeyCrypto allows you to encrypt, decrypt, sign and verify uninterpreted data. It implements low-level, or "raw" cryptographic primitives, such as RSA-PKCS1. The cryptographic primitives are typically used internally in higher-level protocols, such as CMS or PGP.

Cryptographic primitives work on small quantities of data (up to a few kilobytes). If you are looking to encrypt or sign large blobs of data, it is very likely that you need to use higher-level classes, such as MessageEncryptor, CAdESSigner, or PGPWriter.

A code snippet below illustrates the use of PublicKeyCrypto to encrypt (and decrypt) a data piece with OpenSSL-generated RSA keypair.

 
 Copy
procedure TForm1.HandleKeyPasswordNeeded(Sender: TObject; const NeededFor: String;
  var Password: String; var Cancel: Boolean);
begin
  Password := 'key-password';
end;

procedure TForm1.btnRSAEncryptClick(Sender: TObject);
var
  Crypto : TsbxPublicKeyCrypto;
  KeyMgr : TsbxCryptoKeyManager;
  Plaintext, Ciphertext, Decrypted : TBytes;
begin
  // prep
  Plaintext := TEncoding.UTF8.GetBytes('Hello, World!');

  // encryption
  KeyMgr := TsbxCryptoKeyManager.Create(nil);
  try
    KeyMgr.ImportFromFile('public.pem', kffPEM, '', '', '', ktPublic);

    Crypto := TsbxPublicKeyCrypto.Create(nil);
    try
      Crypto.Key := KeyMgr.Key;
      Ciphertext := Crypto.Encrypt(Plaintext);
    finally
      FreeAndNil(Crypto);
    end;
  finally
    FreeAndNil(KeyMgr);
  end;

  // decryption
  KeyMgr := TsbxCryptoKeyManager.Create(nil);
  try
    KeyMgr.OnPasswordNeeded := HandleKeyPasswordNeeded;
    KeyMgr.ImportFromFile('private.pem', kffPEM, '', '', '', ktSecret);

    Crypto := TsbxPublicKeyCrypto.Create(nil);
    try
      Crypto.Key := KeyMgr.Key;
      Decrypted := Crypto.Decrypt(Ciphertext);
    finally
      FreeAndNil(Crypto);
    end;
  finally
    FreeAndNil(KeyMgr);
  end;

  ShowMessage(TEncoding.UTF8.GetString(Decrypted));
end;

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

CanEncrypt Property (PublicKeyCrypto Class)

Returns true if the crypto object can be used for encryption.

Syntax

public boolean isCanEncrypt();

Default Value

False

Remarks

This property returns true if the crypto object can be used for encryption and decryption. This capability depends on the cryptographic algorithm.

This property is read-only and not available at design time.

CanSign Property (PublicKeyCrypto Class)

Returns true if the crypto object is capable of data signing.

Syntax

public boolean isCanSign();

Default Value

False

Remarks

This property returns true if the crypto object can be used for signing data and validating signatures. This capability depends on the cryptographic algorithm.

This property is read-only and not available at design time.

FIPSMode Property (PublicKeyCrypto Class)

Reserved.

Syntax

public boolean isFIPSMode();


public void setFIPSMode(boolean FIPSMode);

Default Value

False

Remarks

This property is reserved for future use.

HashAlgorithm Property (PublicKeyCrypto Class)

The hash algorithm to be used during the crypto operation.

Syntax

public String getHashAlgorithm();


public void setHashAlgorithm(String hashAlgorithm);

Default Value

"SHA256"

Remarks

Use this property to adjust the hash to be used during the cryptographic operation. This typically applies to signing and verification, but can also apply to more complex encryption primitives, such as RSA-OEAP.

InputEncoding Property (PublicKeyCrypto Class)

The encoding to apply to the input data.

Syntax

public int getInputEncoding();


public void setInputEncoding(int inputEncoding);


Enumerated values:
  public final static int cetDefault = 0;
  public final static int cetBinary = 1;
  public final static int cetBase64 = 2;
  public final static int cetCompact = 3;
  public final static int cetJSON = 4;

Default Value

0

Remarks

Use this property to specify the encoding to apply to the input data.

InputIsHash Property (PublicKeyCrypto Class)

Indicates whether the input data contains the hash or the actual data.

Syntax

public boolean isInputIsHash();


public void setInputIsHash(boolean inputIsHash);

Default Value

False

Remarks

Set this property to true to tell the class that the data you are passing to it is the hash of the data, rather than the actual (unhashed) data. If this property is set to false, class will hash the provided data internally if it is assumed by the algorithm.

This property is not available at design time.

JsonDetails Property (PublicKeyCrypto Class)

Provides a container for JSON settings.

Syntax

public JWSettings getJsonDetails();

Remarks

Use this property when using JSON Web Encryption/Signature to tune up the JSON parameters.

This property is read-only.

Please refer to the JWSettings type for a complete list of fields.

Key Property (PublicKeyCrypto Class)

The key to employ for the crypto operation.

Syntax

public CryptoKey getKey();


public void setKey(CryptoKey key);

Remarks

Use this property to specify the key to perform the crypto operation with.

Please note that the key assigned should be of a proper type (a public key, not a symmetric key), have a proper set of capabilities (signing and/or encryption), and include its private part for signing and decryption operations.

This property is not available at design time.

Please refer to the CryptoKey type for a complete list of fields.

OutputEncoding Property (PublicKeyCrypto Class)

The encoding type to apply to the output data.

Syntax

public int getOutputEncoding();


public void setOutputEncoding(int outputEncoding);


Enumerated values:
  public final static int cetDefault = 0;
  public final static int cetBinary = 1;
  public final static int cetBase64 = 2;
  public final static int cetCompact = 3;
  public final static int cetJSON = 4;

Default Value

0

Remarks

Use this property to specify the encoding type to apply to the protected data.

Scheme Property (PublicKeyCrypto Class)

The algorithm scheme to use.

Syntax

public String getScheme();


public void setScheme(String scheme);

Default Value

""

Remarks

Certain asymmetric algorithms are often accompanied with a specific algorithm scheme. Two typical examples are RSA's own OAEP and PSS schemes. Use this property to tune up the scheme to use. Leave it empty to proceed with the standard scheme (such as PKCS#1-v1.5 for RSA). Supported schemes:

RSA: PKCS#1, PSS, OAEP, SSL3

ECDSA: ed25519, ed448, ed25519ph, ed448ph

SchemeParams Property (PublicKeyCrypto Class)

The algorithm scheme parameters to employ.

Syntax

public String getSchemeParams();


public void setSchemeParams(String schemeParams);

Default Value

""

Remarks

Use this property to specify the parameters of the algorithm scheme if needed.

SignatureValidationResult Property (PublicKeyCrypto Class)

The signature validation result.

Syntax

public int getSignatureValidationResult();



Enumerated values:
  public final static int svtValid = 0;
  public final static int svtUnknown = 1;
  public final static int svtCorrupted = 2;
  public final static int svtSignerNotFound = 3;
  public final static int svtFailure = 4;

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only and not available at design time.

Config Method (Publickeycrypto Class)

Sets or retrieves a configuration setting.

Syntax

public String config(String configurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

Decrypt Method (Publickeycrypto Class)

Decrypts a buffer.

Syntax

public byte[] decrypt(byte[] buffer);

Remarks

Use this method to decrypt a byte array and get the encrypted message in another byte array.

Specify the decryption key in Key property before calling this method.

DecryptFile Method (Publickeycrypto Class)

Decrypts a file.

Syntax

public void decryptFile(String sourceFile, String destFile);

Remarks

Use this method to decrypt an encrypted file and save the decrypted data to another file.

Specify the decryption key in Key property before calling this method.

DecryptStream Method (Publickeycrypto Class)

Decrypts a stream.

Syntax

public void decryptStream(java.io.InputStream sourceStream, java.io.OutputStream destStream);

Remarks

Use this method to decrypt a stream and save the decrypted message into another stream.

Specify the decryption key in Key property before calling this method.

DoAction Method (Publickeycrypto Class)

Performs an additional action.

Syntax

public String doAction(String actionID, String actionParams);

Remarks

DoAction is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

Encrypt Method (Publickeycrypto Class)

Encrypts a buffer.

Syntax

public byte[] encrypt(byte[] buffer);

Remarks

Use this method to encrypt a byte array and get the protected message in another byte array.

Specify the encryption key in the Key property before commencing encryption.

EncryptFile Method (Publickeycrypto Class)

Encrypts a file.

Syntax

public void encryptFile(String sourceFile, String destFile);

Remarks

Use this method to encrypt a file and save the protected message to another file.

Specify the encryption key in Key property before commencing encryption.

EncryptStream Method (Publickeycrypto Class)

Encrypts a stream.

Syntax

public void encryptStream(java.io.InputStream sourceStream, java.io.OutputStream destStream);

Remarks

Use this method to encrypt a stream and save the protected message into another stream.

Specify the encryption key in Key property before commencing encryption.

Sign Method (Publickeycrypto Class)

Signs a buffer.

Syntax

public byte[] sign(byte[] buffer, boolean detached);

Remarks

Use this method to sign a byte array and get the protected message in another byte array. Set the Detached parameter to false to create an enveloped/enveloping, rather than detached signature. Please note that certain signature algorithms/kinds only support detached signing.

Specify the signing key in Key property before commencing the signing.

Please note that the key assigned must have a private key part.

SignFile Method (Publickeycrypto Class)

Signs a file.

Syntax

public void signFile(String sourceFile, String destFile, boolean detached);

Remarks

Use this method to sign a file and save the protected message to another file.

Specify the signing key in Key property before the signing. Please make sure the assigned key has a private key associated with it.

Set Detached parameter to false to create an enveloped/enveloping signature. This may not be supported by certain algorithms or encryption modes.

SignStream Method (Publickeycrypto Class)

Signs a stream.

Syntax

public void signStream(java.io.InputStream sourceStream, java.io.OutputStream destStream, boolean detached);

Remarks

Use this method to sign a stream and save the protected message to another stream.

Specify the signing key in Key property before commencing the signing. Note that the signing key must come with its private key.

Set Detached parameter to false to produce enveloped/enveloping, and not detached signature. Many encryption algorithms/modes do not support non-detached signatures.

Verify Method (Publickeycrypto Class)

Verifies an enveloped or enveloping signature contained in a buffer.

Syntax

public byte[] verify(byte[] buffer);

Remarks

Use this method to verify an enveloped or enveloping signature contained in a byte array. The method verifies the signature and extracts the original signed content into another byte array.

The validation result is stored in SignatureValidationResult property.

Use VerifyDetached to verify detached signatures.

Specify the verification key in the Key property before commencing verification.

VerifyDetached Method (Publickeycrypto Class)

Verifies a detached signature.

Syntax

public void verifyDetached(byte[] signedData, byte[] signature);

Remarks

Use this method to verify a detached signature. Pass the original message via the SignedData parameter, and the signature via the Signature parameter.

The validation result is stored in SignatureValidationResult property.

Provide the verification key in Key property before commencing verification.

VerifyDetachedFile Method (Publickeycrypto Class)

Verifies a detached signature.

Syntax

public void verifyDetachedFile(String signedDataFile, String signatureFile);

Remarks

Use this method to verify a detached signature. Pass the original data via the SignedDataFile parameter, and the signature via the SignatureFile parameter.

The validation result is stored in SignatureValidationResult property.

Provide the verification key in Key property.

VerifyDetachedStream Method (Publickeycrypto Class)

Verifies a detached signature.

Syntax

public void verifyDetachedStream(java.io.InputStream signedDataStream, java.io.InputStream signatureStream);

Remarks

Use this method to verify a detached signature. Provide the original signed data via the SignedDataStream parameter, and the signature via the SignatureStream parameter.

The validation result will be stored in SignatureValidationResult property.

Specify the verification public key in Key property before commencing validation.

VerifyFile Method (Publickeycrypto Class)

Verifies an enveloped or enveloping signature contained in a file.

Syntax

public void verifyFile(String sourceFile, String destFile);

Remarks

Use this method to verify an enveloped or enveloping signature and extract the original signed message to another file.

The validation result is stored in SignatureValidationResult property.

Specify the public verification key in Key property before commencing the validation.

VerifyStream Method (Publickeycrypto Class)

Verifies an enveloping or enveloped signature contained in a stream.

Syntax

public void verifyStream(java.io.InputStream sourceStream, java.io.OutputStream destStream);

Remarks

Use this method to verify an enveloping or enveloped signature and extract the original data into a stream.

The outcome of the validation is stored in SignatureValidationResult property.

Provide the public verification key via the Key property before commencing the validation.

Error Event (Publickeycrypto Class)

Reports error information during a crypto operation.

Syntax

public class DefaultPublickeycryptoEventListener implements PublickeycryptoEventListener {
  ...
  public void error(PublickeycryptoErrorEvent e) {}
  ...
}

public class PublickeycryptoErrorEvent {
  public int errorCode;
  public String description;
}

Remarks

Class fires this event if an error is encountered during a cryptographic operation.

ErrorCode contains an error code and Description contains a textual description of the error that happened.

Notification Event (Publickeycrypto Class)

This event notifies the application about an underlying control flow event.

Syntax

public class DefaultPublickeycryptoEventListener implements PublickeycryptoEventListener {
  ...
  public void notification(PublickeycryptoNotificationEvent e) {}
  ...
}

public class PublickeycryptoNotificationEvent {
  public String eventID;
  public String eventParam;
}

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

CryptoKey Type

This container represents a cryptographic key.

Remarks

This type is a universal placeholder for cryptographic keys.

Fields

Constructors

public CryptoKey();

Creates an empty crypto key object.

JWSettings Type

This container represents JSON web security settings.

Remarks

This type contains properties specific to JSON Web Security.

Fields

Constructors

public JWSettings();

Creates an json settings object.

Config Settings (Publickeycrypto Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

PublicKeyCrypto Config Settings

Base Config Settings

Trappable Errors (Publickeycrypto Class)

PublicKeyCrypto Errors

	1048577   Invalid parameter value (SB_ERROR_INVALID_PARAMETER)
	1048578   Class is configured incorrectly (SB_ERROR_INVALID_SETUP)
	1048579   Operation cannot be executed in the current state (SB_ERROR_INVALID_STATE)
	1048580   Attempt to set an invalid value to a property (SB_ERROR_INVALID_VALUE)
	1048581   Certificate does not have its private key loaded (SB_ERROR_NO_PRIVATE_KEY)
	1048581   Cancelled by the user (SB_ERROR_CANCELLED_BY_USER)