Struct secureblackbox::PublicKeyCrypto

Properties   Methods   Events   Config Settings   Errors  

The PublicKeyCrypto struct supports encrypting, decrypting, signing and verifying messages.

Syntax

secureblackbox::PublicKeyCrypto

Remarks

PublicKeyCrypto allows you to encrypt, decrypt, sign and verify uninterpreted data. It implements low-level, or "raw" cryptographic primitives, such as RSA-PKCS1. The cryptographic primitives are typically used internally in higher-level protocols, such as CMS or PGP.

Cryptographic primitives work on small quantities of data (up to a few kilobytes). If you are looking to encrypt or sign large blobs of data, it is very likely that you need to use higher-level classes, such as MessageEncryptor, CAdESSigner, or PGPWriter.

A code snippet below illustrates the use of PublicKeyCrypto to encrypt (and decrypt) a data piece with OpenSSL-generated RSA keypair. procedure TForm1.HandleKeyPasswordNeeded(Sender: TObject; const NeededFor: String; var Password: String; var Cancel: Boolean); begin Password := 'key-password'; end; procedure TForm1.btnRSAEncryptClick(Sender: TObject); var Crypto : TsbxPublicKeyCrypto; KeyMgr : TsbxCryptoKeyManager; Plaintext, Ciphertext, Decrypted : TBytes; begin // prep Plaintext := TEncoding.UTF8.GetBytes('Hello, World!'); // encryption KeyMgr := TsbxCryptoKeyManager.Create(nil); try KeyMgr.ImportFromFile('public.pem', kffPEM, '', '', '', ktPublic); Crypto := TsbxPublicKeyCrypto.Create(nil); try Crypto.Key := KeyMgr.Key; Ciphertext := Crypto.Encrypt(Plaintext); finally FreeAndNil(Crypto); end; finally FreeAndNil(KeyMgr); end; // decryption KeyMgr := TsbxCryptoKeyManager.Create(nil); try KeyMgr.OnPasswordNeeded := HandleKeyPasswordNeeded; KeyMgr.ImportFromFile('private.pem', kffPEM, '', '', '', ktSecret); Crypto := TsbxPublicKeyCrypto.Create(nil); try Crypto.Key := KeyMgr.Key; Decrypted := Crypto.Decrypt(Ciphertext); finally FreeAndNil(Crypto); end; finally FreeAndNil(KeyMgr); end; ShowMessage(TEncoding.UTF8.GetString(Decrypted)); end;

Object Lifetime

The new() method returns a mutable reference to a struct instance. The object itself is kept in the global list maintained by SecureBlackbox. Due to this, the PublicKeyCrypto struct cannot be disposed of automatically. Please, call the dispose(&mut self) method of PublicKeyCrypto when you have finished using the instance.

Property List

---

The following is the full list of the properties of the struct with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the struct with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the struct with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the struct with short descriptions. Click on the links for further details.

can_encrypt property (PublicKeyCrypto Struct)

Returns true if the crypto object can be used for encryption.

Syntax

fn can_encrypt(&self ) -> Result<bool, SecureBlackboxError> 

Default Value

false

Remarks

This property returns true if the crypto object can be used for encryption and decryption. This capability depends on the cryptographic algorithm.

For ML-KEM keys, this property returns true, and the encrypt and decrypt methods perform key encapsulation and decapsulation rather than conventional message encryption.

This property is read-only.

Data Type

bool

can_sign property (PublicKeyCrypto Struct)

Returns true if the crypto object is capable of data signing.

Syntax

fn can_sign(&self ) -> Result<bool, SecureBlackboxError> 

Default Value

false

Remarks

This property returns true if the crypto object can be used for signing data and validating signatures. This capability depends on the cryptographic algorithm.

This property is read-only.

Data Type

bool

fips_mode property (PublicKeyCrypto Struct)

Reserved.

Syntax

fn fips_mode(&self ) -> Result<bool, SecureBlackboxError> 
fn set_fips_mode(&self, value : bool) ->  Option<SecureBlackboxError> 

Default Value

false

Remarks

This property is reserved for future use.

Data Type

bool

hash_algorithm property (PublicKeyCrypto Struct)

The hash algorithm to be used during the crypto operation.

Syntax

fn hash_algorithm(&self ) -> Result<String, SecureBlackboxError> 
fn set_hash_algorithm(&self, value : &str) ->  Option<SecureBlackboxError> 
fn set_hash_algorithm_ref(&self, value : &String) ->  Option<SecureBlackboxError> 

Default Value

"SHA256"

Remarks

Use this property to adjust the hash to be used during the cryptographic operation. This typically applies to signing and verification, but can also apply to more complex encryption primitives, such as RSA-OEAP.

Data Type

String

input_encoding property (PublicKeyCrypto Struct)

The encoding to apply to the input data.

Syntax

fn input_encoding(&self ) -> Result<i32, SecureBlackboxError> 
fn set_input_encoding(&self, value : i32) ->  Option<SecureBlackboxError> 

Possible Values

0   // Default
1   // Binary
2   // Base64
3   // Compact
4   // JSON

Default Value

0

Remarks

Use this property to specify the encoding to apply to the input data.

Data Type

i32

input_is_hash property (PublicKeyCrypto Struct)

Indicates whether the input data contains the hash or the actual data.

Syntax

fn input_is_hash(&self ) -> Result<bool, SecureBlackboxError> 
fn set_input_is_hash(&self, value : bool) ->  Option<SecureBlackboxError> 

Default Value

false

Remarks

Set this property to true to tell the struct that the data you are passing to it is the hash of the data, rather than the actual (unhashed) data. If this property is set to false, struct will hash the provided data internally if it is assumed by the algorithm.

Data Type

bool

json_key_header_params property (PublicKeyCrypto Struct)

Contains key header parameters.

Syntax

fn json_key_header_params(&self ) -> Result<String, SecureBlackboxError> 
fn set_json_key_header_params(&self, value : &str) ->  Option<SecureBlackboxError> 
fn set_json_key_header_params_ref(&self, value : &String) ->  Option<SecureBlackboxError> 

Default Value

"kid"

Remarks

Contains key header parameters.

Data Type

String

json_protected_header property (PublicKeyCrypto Struct)

Provides access to the header being protected.

Syntax

fn json_protected_header(&self ) -> Result<String, SecureBlackboxError> 
fn set_json_protected_header(&self, value : &str) ->  Option<SecureBlackboxError> 
fn set_json_protected_header_ref(&self, value : &String) ->  Option<SecureBlackboxError> 

Default Value

""

Remarks

Provides access to the header being protected.

Data Type

String

json_unprotected_header property (PublicKeyCrypto Struct)

Provides access to the unprotected part of the header.

Syntax

fn json_unprotected_header(&self ) -> Result<String, SecureBlackboxError> 
fn set_json_unprotected_header(&self, value : &str) ->  Option<SecureBlackboxError> 
fn set_json_unprotected_header_ref(&self, value : &String) ->  Option<SecureBlackboxError> 

Default Value

""

Remarks

Provides access to the unprotected part of the header.

Data Type

String

json_unprotected_header_params property (PublicKeyCrypto Struct)

Contains unprotected header parameters.

Syntax

fn json_unprotected_header_params(&self ) -> Result<String, SecureBlackboxError> 
fn set_json_unprotected_header_params(&self, value : &str) ->  Option<SecureBlackboxError> 
fn set_json_unprotected_header_params_ref(&self, value : &String) ->  Option<SecureBlackboxError> 

Default Value

""

Remarks

Contains unprotected header parameters.

Data Type

String

key_handle property (PublicKeyCrypto Struct)

Allows to get or set a 'handle', a unique identifier of the underlying property object.

Syntax

fn key_handle(&self ) -> Result<i64, SecureBlackboxError> 
fn set_key_handle(&self, value : i64) ->  Option<SecureBlackboxError> 

Default Value

0

Remarks

Allows to get or set a 'handle', a unique identifier of the underlying property object. Use this property to assign objects of the same type in a quicker manner, without copying them fieldwise.

When you pass a handle of one object to another, the source object is copied to the destination rather than assigned. It is safe to get rid of the original object after such operation. pdfSigner.setSigningCertHandle(certMgr.getCertHandle());

Data Type

i64

output_encoding property (PublicKeyCrypto Struct)

The encoding type to apply to the output data.

Syntax

fn output_encoding(&self ) -> Result<i32, SecureBlackboxError> 
fn set_output_encoding(&self, value : i32) ->  Option<SecureBlackboxError> 

Possible Values

0   // Default
1   // Binary
2   // Base64
3   // Compact
4   // JSON

Default Value

0

Remarks

Use this property to specify the encoding type to apply to the protected data.

Data Type

i32

scheme property (PublicKeyCrypto Struct)

The algorithm scheme to use.

Syntax

fn scheme(&self ) -> Result<String, SecureBlackboxError> 
fn set_scheme(&self, value : &str) ->  Option<SecureBlackboxError> 
fn set_scheme_ref(&self, value : &String) ->  Option<SecureBlackboxError> 

Default Value

""

Remarks

Certain asymmetric algorithms are often accompanied with a specific algorithm scheme. Two typical examples are RSA's own OAEP and PSS schemes. Use this property to tune up the scheme to use. Leave it empty to proceed with the standard scheme (such as PKCS#1-v1.5 for RSA). Supported schemes:

RSA: PKCS#1, PSS, OAEP, SSL3

ECDSA: ed25519, ed448, ed25519ph, ed448ph

ML-DSA: ML-DSA-44, ML-DSA-65, ML-DSA-87

ML-KEM: ML-KEM-512, ML-KEM-768, ML-KEM-1024

Data Type

String

scheme_params property (PublicKeyCrypto Struct)

The algorithm scheme parameters to employ.

Syntax

fn scheme_params(&self ) -> Result<String, SecureBlackboxError> 
fn set_scheme_params(&self, value : &str) ->  Option<SecureBlackboxError> 
fn set_scheme_params_ref(&self, value : &String) ->  Option<SecureBlackboxError> 

Default Value

""

Remarks

Use this property to specify the parameters of the algorithm scheme if needed.

Data Type

String

signature_validation_result property (PublicKeyCrypto Struct)

The signature validation result.

Syntax

fn signature_validation_result(&self ) -> Result<i32, SecureBlackboxError> 

Possible Values

0   // Valid
1   // Unknown
2   // Corrupted
3   // SignerNotFound
4   // Failure
5   // ReferenceCorrupted

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only.

Data Type

i32

config method (PublicKeyCrypto Struct)

Sets or retrieves a configuration setting.

Syntax

fn config(&self, configuration_string : &str) ->  Result<String, SecureBlackboxError>

Remarks

config is a generic method available in every struct. It is used to set and retrieve configuration settings for the struct.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the struct, access to these internal properties is provided through the config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

decrypt method (PublicKeyCrypto Struct)

Decrypts a buffer.

Syntax

fn decrypt(&self, buffer : &[u8]) ->  Result<Vec<u8>, SecureBlackboxError>

Remarks

Use this method to decrypt a byte array and get the encrypted message in another byte array.

Specify the decryption key in key property before calling this method.

When used with an ML-KEM key, this method performs key decapsulation. Pass the encapsulated ciphertext in Buffer; the derived shared secret becomes available through the Config("SharedSecret") setting of the crypto object.

decrypt_file method (PublicKeyCrypto Struct)

Decrypts a file.

Syntax

fn decrypt_file(&self, source_file : &str, dest_file : &str) -> Result<(), SecureBlackboxError>

Remarks

Use this method to decrypt an encrypted file and save the decrypted data to another file.

Specify the decryption key in key property before calling this method.

do_action method (PublicKeyCrypto Struct)

Performs an additional action.

Syntax

fn do_action(&self, action_id : &str, action_params : &str) ->  Result<String, SecureBlackboxError>

Remarks

do_action is a generic method available in every struct. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

Common ActionIDs:

encrypt method (PublicKeyCrypto Struct)

Encrypts a buffer.

Syntax

fn encrypt(&self, buffer : &[u8]) ->  Result<Vec<u8>, SecureBlackboxError>

Remarks

Use this method to encrypt a byte array and get the protected message in another byte array.

Specify the encryption key in the key property before commencing encryption.

When used with an ML-KEM key, this method performs key encapsulation. The returned byte array contains the encapsulated ciphertext, and the derived shared secret becomes available through the Config("SharedSecret") setting of the crypto object.

encrypt_file method (PublicKeyCrypto Struct)

Encrypts a file.

Syntax

fn encrypt_file(&self, source_file : &str, dest_file : &str) -> Result<(), SecureBlackboxError>

Remarks

Use this method to encrypt a file and save the protected message to another file.

Specify the encryption key in key property before commencing encryption.

reset method (PublicKeyCrypto Struct)

Resets the struct settings.

Syntax

fn reset(&self) -> Result<(), SecureBlackboxError>

Remarks

reset is a generic method available in every struct.

sign method (PublicKeyCrypto Struct)

Signs a buffer.

Syntax

fn sign(&self, buffer : &[u8], detached : bool) ->  Result<Vec<u8>, SecureBlackboxError>

Remarks

Use this method to sign a byte array and get the protected message in another byte array. Set the Detached parameter to false to create an enveloped/enveloping, rather than detached signature. Please note that certain signature algorithms/kinds only support detached signing.

Specify the signing key in key property before commencing the signing.

Please note that the key assigned must have a private key part.

sign_file method (PublicKeyCrypto Struct)

Signs a file.

Syntax

fn sign_file(&self, source_file : &str, dest_file : &str, detached : bool) -> Result<(), SecureBlackboxError>

Remarks

Use this method to sign a file and save the protected message to another file.

Specify the signing key in key property before the signing. Please make sure the assigned key has a private key associated with it.

Set Detached parameter to false to create an enveloped/enveloping signature. This may not be supported by certain algorithms or encryption modes.

verify method (PublicKeyCrypto Struct)

Verifies an enveloped or enveloping signature contained in a buffer.

Syntax

fn verify(&self, buffer : &[u8]) ->  Result<Vec<u8>, SecureBlackboxError>

Remarks

Use this method to verify an enveloped or enveloping signature contained in a byte array. The method verifies the signature and extracts the original signed content into another byte array.

The validation result is stored in signature_validation_result property.

Use verify_detached to verify detached signatures.

Specify the verification key in the key property before commencing verification.

verify_detached method (PublicKeyCrypto Struct)

Verifies a detached signature.

Syntax

fn verify_detached(&self, signed_data : &[u8], signature : &[u8]) -> Result<(), SecureBlackboxError>

Remarks

Use this method to verify a detached signature. Pass the original message via the SignedData parameter, and the signature via the Signature parameter.

The validation result is stored in signature_validation_result property.

Provide the verification key in key property before commencing verification.

verify_detached_file method (PublicKeyCrypto Struct)

Verifies a detached signature.

Syntax

fn verify_detached_file(&self, signed_data_file : &str, signature_file : &str) -> Result<(), SecureBlackboxError>

Remarks

Use this method to verify a detached signature. Pass the original data via the SignedDataFile parameter, and the signature via the SignatureFile parameter.

The validation result is stored in signature_validation_result property.

Provide the verification key in key property.

verify_file method (PublicKeyCrypto Struct)

Verifies an enveloped or enveloping signature contained in a file.

Syntax

fn verify_file(&self, source_file : &str, dest_file : &str) -> Result<(), SecureBlackboxError>

Remarks

Use this method to verify an enveloped or enveloping signature and extract the original signed message to another file.

The validation result is stored in signature_validation_result property.

Specify the public verification key in key property before commencing the validation.

on_error event (PublicKeyCrypto Struct)

Reports error information during a crypto operation.

Syntax

// PublicKeyCryptoErrorEventArgs carries the PublicKeyCrypto Error event's parameters.
pub struct PublicKeyCryptoErrorEventArgs {
  fn error_code(&self) -> i32
  fn description(&self) -> &String
}

// PublicKeyCryptoErrorEvent defines the signature of the PublicKeyCrypto Error event's handler function.
pub trait PublicKeyCryptoErrorEvent {
  fn on_error(&self, sender : PublicKeyCrypto, e : &mut PublicKeyCryptoErrorEventArgs);
}

impl <'a> PublicKeyCrypto<'a> {
  pub fn on_error(&self) -> &'a dyn PublicKeyCryptoErrorEvent;
  pub fn set_on_error(&mut self, value : &'a dyn PublicKeyCryptoErrorEvent);
  ...
}

Remarks

Struct fires this event if an error is encountered during a cryptographic operation.

ErrorCode contains an error code and Description contains a textual description of the error that happened.

on_notification event (PublicKeyCrypto Struct)

This event notifies the application about an underlying control flow event.

Syntax

// PublicKeyCryptoNotificationEventArgs carries the PublicKeyCrypto Notification event's parameters.
pub struct PublicKeyCryptoNotificationEventArgs {
  fn event_id(&self) -> &String
  fn event_param(&self) -> &String
}

// PublicKeyCryptoNotificationEvent defines the signature of the PublicKeyCrypto Notification event's handler function.
pub trait PublicKeyCryptoNotificationEvent {
  fn on_notification(&self, sender : PublicKeyCrypto, e : &mut PublicKeyCryptoNotificationEventArgs);
}

impl <'a> PublicKeyCrypto<'a> {
  pub fn on_notification(&self) -> &'a dyn PublicKeyCryptoNotificationEvent;
  pub fn set_on_notification(&mut self, value : &'a dyn PublicKeyCryptoNotificationEvent);
  ...
}

Remarks

The struct fires this event to let the application know about some event, occurrence, or milestone in the struct. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the struct, the exact action it is performing, or the document being processed, one or both may be omitted.

Config Settings (PublicKeyCrypto Struct)

The struct accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the struct, access to these internal properties is provided through the config method.

PublicKeyCrypto Config Settings

Base Config Settings

Trappable Errors (PublicKeyCrypto Struct)

PublicKeyCrypto Errors