PublicKeyCrypto Class

Properties   Methods   Events   Config Settings   Errors  

The PublicKeyCrypto class supports encrypting, decrypting, signing and verifying messages.

Syntax

class secureblackbox.PublicKeyCrypto

Remarks

PublicKeyCrypto allows you to encrypt, decrypt, sign and verify uninterpreted data. It implements low-level, or "raw" cryptographic primitives, such as RSA-PKCS1. The cryptographic primitives are typically used internally in higher-level protocols, such as CMS or PGP.

Cryptographic primitives work on small quantities of data (up to a few kilobytes). If you are looking to encrypt or sign large blobs of data, it is very likely that you need to use higher-level classes, such as MessageEncryptor, CAdESSigner, or PGPWriter.

A code snippet below illustrates the use of PublicKeyCrypto to encrypt (and decrypt) a data piece with OpenSSL-generated RSA keypair. procedure TForm1.HandleKeyPasswordNeeded(Sender: TObject; const NeededFor: String; var Password: String; var Cancel: Boolean); begin Password := 'key-password'; end; procedure TForm1.btnRSAEncryptClick(Sender: TObject); var Crypto : TsbxPublicKeyCrypto; KeyMgr : TsbxCryptoKeyManager; Plaintext, Ciphertext, Decrypted : TBytes; begin // prep Plaintext := TEncoding.UTF8.GetBytes('Hello, World!'); // encryption KeyMgr := TsbxCryptoKeyManager.Create(nil); try KeyMgr.ImportFromFile('public.pem', kffPEM, '', '', '', ktPublic); Crypto := TsbxPublicKeyCrypto.Create(nil); try Crypto.Key := KeyMgr.Key; Ciphertext := Crypto.Encrypt(Plaintext); finally FreeAndNil(Crypto); end; finally FreeAndNil(KeyMgr); end; // decryption KeyMgr := TsbxCryptoKeyManager.Create(nil); try KeyMgr.OnPasswordNeeded := HandleKeyPasswordNeeded; KeyMgr.ImportFromFile('private.pem', kffPEM, '', '', '', ktSecret); Crypto := TsbxPublicKeyCrypto.Create(nil); try Crypto.Key := KeyMgr.Key; Decrypted := Crypto.Decrypt(Ciphertext); finally FreeAndNil(Crypto); end; finally FreeAndNil(KeyMgr); end; ShowMessage(TEncoding.UTF8.GetString(Decrypted)); end;

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

can_encrypt Property

Returns true if the crypto object can be used for encryption.

Syntax

def get_can_encrypt() -> bool: ...

can_encrypt = property(get_can_encrypt, None)

Default Value

FALSE

Remarks

This property returns true if the crypto object can be used for encryption and decryption. This capability depends on the cryptographic algorithm.

This property is read-only.

can_sign Property

Returns true if the crypto object is capable of data signing.

Syntax

def get_can_sign() -> bool: ...

can_sign = property(get_can_sign, None)

Default Value

FALSE

Remarks

This property returns true if the crypto object can be used for signing data and validating signatures. This capability depends on the cryptographic algorithm.

This property is read-only.

fips_mode Property

Reserved.

Syntax

def get_fips_mode() -> bool: ...
def set_fips_mode(value: bool) -> None: ...

fips_mode = property(get_fips_mode, set_fips_mode)

Default Value

FALSE

Remarks

This property is reserved for future use.

hash_algorithm Property

The hash algorithm to be used during the crypto operation.

Syntax

def get_hash_algorithm() -> str: ...
def set_hash_algorithm(value: str) -> None: ...

hash_algorithm = property(get_hash_algorithm, set_hash_algorithm)

Default Value

"SHA256"

Remarks

Use this property to adjust the hash to be used during the cryptographic operation. This typically applies to signing and verification, but can also apply to more complex encryption primitives, such as RSA-OEAP.

input_encoding Property

The encoding to apply to the input data.

Syntax

def get_input_encoding() -> int: ...
def set_input_encoding(value: int) -> None: ...

input_encoding = property(get_input_encoding, set_input_encoding)

Default Value

0

Remarks

Use this property to specify the encoding to apply to the input data.

input_is_hash Property

Indicates whether the input data contains the hash or the actual data.

Syntax

def get_input_is_hash() -> bool: ...
def set_input_is_hash(value: bool) -> None: ...

input_is_hash = property(get_input_is_hash, set_input_is_hash)

Default Value

FALSE

Remarks

Set this property to true to tell the class that the data you are passing to it is the hash of the data, rather than the actual (unhashed) data. If this property is set to false, class will hash the provided data internally if it is assumed by the algorithm.

json_key_header_params Property

Contains key header parameters.

Syntax

def get_json_key_header_params() -> str: ...
def set_json_key_header_params(value: str) -> None: ...

json_key_header_params = property(get_json_key_header_params, set_json_key_header_params)

Default Value

"kid"

Remarks

Contains key header parameters.

json_protected_header Property

Provides access to the header being protected.

Syntax

def get_json_protected_header() -> str: ...
def set_json_protected_header(value: str) -> None: ...

json_protected_header = property(get_json_protected_header, set_json_protected_header)

Default Value

""

Remarks

Provides access to the header being protected.

json_unprotected_header Property

Provides access to the unprotected part of the header.

Syntax

def get_json_unprotected_header() -> str: ...
def set_json_unprotected_header(value: str) -> None: ...

json_unprotected_header = property(get_json_unprotected_header, set_json_unprotected_header)

Default Value

""

Remarks

Provides access to the unprotected part of the header.

json_unprotected_header_params Property

Contains unprotected header parameters.

Syntax

def get_json_unprotected_header_params() -> str: ...
def set_json_unprotected_header_params(value: str) -> None: ...

json_unprotected_header_params = property(get_json_unprotected_header_params, set_json_unprotected_header_params)

Default Value

""

Remarks

Contains unprotected header parameters.

key_algorithm Property

The algorithm of the cryptographic key.

Syntax

def get_key_algorithm() -> str: ...
def set_key_algorithm(value: str) -> None: ...

key_algorithm = property(get_key_algorithm, set_key_algorithm)

Default Value

""

Remarks

The algorithm of the cryptographic key. A cryptokey object may hold either symmetric, MAC, or public key. Public key algorithms: RSA, ECDSA, Elgamal, DH.

key_bits Property

The length of the key in bits.

Syntax

def get_key_bits() -> int: ...

key_bits = property(get_key_bits, None)

Default Value

0

Remarks

The length of the key in bits.

This property is read-only.

key_curve Property

This property specifies the name of the curve the EC key is built on.

Syntax

def get_key_curve() -> str: ...
def set_key_curve(value: str) -> None: ...

key_curve = property(get_key_curve, set_key_curve)

Default Value

""

Remarks

This property specifies the name of the curve the EC key is built on.

key_exportable Property

Returns True if the key is exportable (can be serialized into an array of bytes), and False otherwise.

Syntax

def get_key_exportable() -> bool: ...

key_exportable = property(get_key_exportable, None)

Default Value

FALSE

Remarks

Returns True if the key is exportable (can be serialized into an array of bytes), and False otherwise.

This property is read-only.

key_handle Property

Allows to get or set a 'handle', a unique identifier of the underlying property object.

Syntax

def get_key_handle() -> int: ...
def set_key_handle(value: int) -> None: ...

key_handle = property(get_key_handle, set_key_handle)

Default Value

0

Remarks

Allows to get or set a 'handle', a unique identifier of the underlying property object. Use this property to assign objects of the same type in a quicker manner, without copying them fieldwise.

When you pass a handle of one object to another, the source object is copied to the destination rather than assigned. It is safe to get rid of the original object after such operation. pdfSigner.setSigningCertHandle(certMgr.getCertHandle());

key_id Property

Provides access to a storage-specific key identifier.

Syntax

def get_key_id() -> bytes: ...
def set_key_id(value: bytes) -> None: ...

key_id = property(get_key_id, set_key_id)

Remarks

Provides access to a storage-specific key identifier. Key identifiers are used by cryptographic providers to refer to a particular key and/or distinguish between different keys. They are typically unique within a storage, but there is no guarantee that a particular cryptoprovider will conform to that (or will assign any key IDs at all).

key_iv Property

The initialization vector (IV) of a symmetric key.

Syntax

def get_key_iv() -> bytes: ...
def set_key_iv(value: bytes) -> None: ...

key_iv = property(get_key_iv, set_key_iv)

Remarks

The initialization vector (IV) of a symmetric key. This is normally a public part of a symmetric key, the idea of which is to introduce randomness to the encrypted data and/or serve as a first block in chaining ciphers.

key_key Property

The byte array representation of the key.

Syntax

def get_key_key() -> bytes: ...

key_key = property(get_key_key, None)

Remarks

The byte array representation of the key. This may not be available for non-key_exportable keys.

This property is read-only.

key_nonce Property

A nonce value associated with a key.

Syntax

def get_key_nonce() -> bytes: ...
def set_key_nonce(value: bytes) -> None: ...

key_nonce = property(get_key_nonce, set_key_nonce)

Remarks

A nonce value associated with a key. It is similar to IV, but its only purpose is to introduce randomness.

key_private Property

Returns True if the object hosts a private key, and False otherwise.

Syntax

def get_key_private() -> bool: ...

key_private = property(get_key_private, None)

Default Value

FALSE

Remarks

Returns True if the object hosts a private key, and False otherwise.

This property is read-only.

key_public Property

Returns True if the object hosts a public key, and False otherwise.

Syntax

def get_key_public() -> bool: ...

key_public = property(get_key_public, None)

Default Value

FALSE

Remarks

Returns True if the object hosts a public key, and False otherwise.

This property is read-only.

key_subject Property

Returns the key subject.

Syntax

def get_key_subject() -> bytes: ...
def set_key_subject(value: bytes) -> None: ...

key_subject = property(get_key_subject, set_key_subject)

Remarks

Returns the key subject. This is a cryptoprovider-dependent value, which normally aims to provide some user-friendly insight into the key owner.

key_symmetric Property

Returns True if the object contains a symmetric key, and False otherwise.

Syntax

def get_key_symmetric() -> bool: ...

key_symmetric = property(get_key_symmetric, None)

Default Value

FALSE

Remarks

Returns True if the object contains a symmetric key, and False otherwise.

This property is read-only.

key_valid Property

Returns True if this key is valid.

Syntax

def get_key_valid() -> bool: ...

key_valid = property(get_key_valid, None)

Default Value

FALSE

Remarks

Returns True if this key is valid. The term Valid highly depends on the kind of the key being stored. A symmetric key is considered valid if its length fits the algorithm being set. The validity of an RSA key also ensures that the RSA key elements (primes, exponents, and modulus) are consistent.

This property is read-only.

output_encoding Property

The encoding type to apply to the output data.

Syntax

def get_output_encoding() -> int: ...
def set_output_encoding(value: int) -> None: ...

output_encoding = property(get_output_encoding, set_output_encoding)

Default Value

0

Remarks

Use this property to specify the encoding type to apply to the protected data.

scheme Property

The algorithm scheme to use.

Syntax

def get_scheme() -> str: ...
def set_scheme(value: str) -> None: ...

scheme = property(get_scheme, set_scheme)

Default Value

""

Remarks

Certain asymmetric algorithms are often accompanied with a specific algorithm scheme. Two typical examples are RSA's own OAEP and PSS schemes. Use this property to tune up the scheme to use. Leave it empty to proceed with the standard scheme (such as PKCS#1-v1.5 for RSA). Supported schemes:

RSA: PKCS#1, PSS, OAEP, SSL3

ECDSA: ed25519, ed448, ed25519ph, ed448ph

scheme_params Property

The algorithm scheme parameters to employ.

Syntax

def get_scheme_params() -> str: ...
def set_scheme_params(value: str) -> None: ...

scheme_params = property(get_scheme_params, set_scheme_params)

Default Value

""

Remarks

Use this property to specify the parameters of the algorithm scheme if needed.

signature_validation_result Property

The signature validation result.

Syntax

def get_signature_validation_result() -> int: ...

signature_validation_result = property(get_signature_validation_result, None)

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only.

config Method

Sets or retrieves a configuration setting.

Syntax

def config(configuration_string: str) -> str: ...

Remarks

config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

decrypt Method

Decrypts a buffer.

Syntax

def decrypt(buffer: bytes) -> bytes: ...

Remarks

Use this method to decrypt a byte array and get the encrypted message in another byte array.

Specify the decryption key in key property before calling this method.

decrypt_file Method

Decrypts a file.

Syntax

def decrypt_file(source_file: str, dest_file: str) -> None: ...

Remarks

Use this method to decrypt an encrypted file and save the decrypted data to another file.

Specify the decryption key in key property before calling this method.

do_action Method

Performs an additional action.

Syntax

def do_action(action_id: str, action_params: str) -> str: ...

Remarks

do_action is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

encrypt Method

Encrypts a buffer.

Syntax

def encrypt(buffer: bytes) -> bytes: ...

Remarks

Use this method to encrypt a byte array and get the protected message in another byte array.

Specify the encryption key in the key property before commencing encryption.

encrypt_file Method

Encrypts a file.

Syntax

def encrypt_file(source_file: str, dest_file: str) -> None: ...

Remarks

Use this method to encrypt a file and save the protected message to another file.

Specify the encryption key in key property before commencing encryption.

sign Method

Signs a buffer.

Syntax

def sign(buffer: bytes, detached: bool) -> bytes: ...

Remarks

Use this method to sign a byte array and get the protected message in another byte array. Set the Detached parameter to false to create an enveloped/enveloping, rather than detached signature. Please note that certain signature algorithms/kinds only support detached signing.

Specify the signing key in key property before commencing the signing.

Please note that the key assigned must have a private key part.

sign_file Method

Signs a file.

Syntax

def sign_file(source_file: str, dest_file: str, detached: bool) -> None: ...

Remarks

Use this method to sign a file and save the protected message to another file.

Specify the signing key in key property before the signing. Please make sure the assigned key has a private key associated with it.

Set Detached parameter to false to create an enveloped/enveloping signature. This may not be supported by certain algorithms or encryption modes.

verify Method

Verifies an enveloped or enveloping signature contained in a buffer.

Syntax

def verify(buffer: bytes) -> bytes: ...

Remarks

Use this method to verify an enveloped or enveloping signature contained in a byte array. The method verifies the signature and extracts the original signed content into another byte array.

The validation result is stored in signature_validation_result property.

Use verify_detached to verify detached signatures.

Specify the verification key in the key property before commencing verification.

verify_detached Method

Verifies a detached signature.

Syntax

def verify_detached(signed_data: bytes, signature: bytes) -> None: ...

Remarks

Use this method to verify a detached signature. Pass the original message via the SignedData parameter, and the signature via the Signature parameter.

The validation result is stored in signature_validation_result property.

Provide the verification key in key property before commencing verification.

verify_detached_file Method

Verifies a detached signature.

Syntax

def verify_detached_file(signed_data_file: str, signature_file: str) -> None: ...

Remarks

Use this method to verify a detached signature. Pass the original data via the SignedDataFile parameter, and the signature via the SignatureFile parameter.

The validation result is stored in signature_validation_result property.

Provide the verification key in key property.

verify_file Method

Verifies an enveloped or enveloping signature contained in a file.

Syntax

def verify_file(source_file: str, dest_file: str) -> None: ...

Remarks

Use this method to verify an enveloped or enveloping signature and extract the original signed message to another file.

The validation result is stored in signature_validation_result property.

Specify the public verification key in key property before commencing the validation.

on_error Event

Reports error information during a crypto operation.

Syntax

class PublicKeyCryptoErrorEventParams(object):
  @property
  def error_code() -> int: ...

  @property
  def description() -> str: ...

# In class PublicKeyCrypto:
@property
def on_error() -> Callable[[PublicKeyCryptoErrorEventParams], None]: ...
@on_error.setter
def on_error(event_hook: Callable[[PublicKeyCryptoErrorEventParams], None]) -> None: ...

Remarks

Class fires this event if an error is encountered during a cryptographic operation.

ErrorCode contains an error code and Description contains a textual description of the error that happened.

on_notification Event

This event notifies the application about an underlying control flow event.

Syntax

class PublicKeyCryptoNotificationEventParams(object):
  @property
  def event_id() -> str: ...

  @property
  def event_param() -> str: ...

# In class PublicKeyCrypto:
@property
def on_notification() -> Callable[[PublicKeyCryptoNotificationEventParams], None]: ...
@on_notification.setter
def on_notification(event_hook: Callable[[PublicKeyCryptoNotificationEventParams], None]) -> None: ...

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

PublicKeyCrypto Config Settings

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

PublicKeyCrypto Config Settings

Base Config Settings

PublicKeyCrypto Errors

PublicKeyCrypto Errors

	1048577   Invalid parameter value (SB_ERROR_INVALID_PARAMETER)
	1048578   Class is configured incorrectly (SB_ERROR_INVALID_SETUP)
	1048579   Operation cannot be executed in the current state (SB_ERROR_INVALID_STATE)
	1048580   Attempt to set an invalid value to a property (SB_ERROR_INVALID_VALUE)
	1048581   Certificate does not have its private key loaded (SB_ERROR_NO_PRIVATE_KEY)
	1048581   Cancelled by the user (SB_ERROR_CANCELLED_BY_USER)