Procedure RSAEncrypt

Code (Delphi)

procedure RSAEncrypt(

const AKey: TRSAKey;

const AData: Pointer;

out AEncryptedData: Pointer;

var ADataSize: Cardinal

); overload;

function RSAEncrypt(

const AKey: TRSAKey;

const AData: RawByteString

): RawByteString; overload;

procedure RSAEncrypt(

const AKey: TRSAKey;

var AInPlaceData: TEncryptBuffer

); overload;

Important!

Asymmetric chipers are slow. Therefore, they are not designed to encrypt/decrypt large amount of data. The usual approach is to use asymmetric chiper to encrypt/decrypt another key - a key for some symmetric cipher, and then use (fast) symmetric cipher to encrypt/decrypt large amounts of data.

Tip

You always use public key for encryption and private key for decryption with asymmetric cipher - and not the other way around. You should use digital signing and verification for reversed order. I.e. you sign data by using your private key and verify signature by using your public key.

Code (Delphi)

var

// (Random) symmetric key to encrypt file

TEAKey: TTEAKey;

// Asymmetric key to encrypt symmetric key

RSAKey: TRSAKey;

// Encrypted symmetric key

EncryptedKey: Pointer; DataSize: Cardinal;

// File/data to encrypt

Data: TMemoryStream;

// Wrapper for "in place" encryption

DataToEncrypt: TEncryptBuffer;

// Stream to save final result

FS: TFileStream;

begin

// Create strong random session key

// It is best to use cryptographic-quality random generator

// This key will be used to encrypt file

TEAKey := TEAInitSessionKey;

try

// First, encrypt symmetric key with asymmetric key

// FS is used twice:

// 1). To write encrypted symmetric key

// 2). To write encrypted file/data itself

FS := nil;

try

// Load public key from file

RSAKey := RSALoadPublicKey('C:\Test\Public.pem', rsText);

try

 // Encrypt the TEAKey key into EncryptedKey buffer

 DataSize := SizeOf(TEAKey);

 EEncrypt.RSAEncrypt(RSAKey, @TEAKey, EncryptedKey, DataSize);

 try

 // Once symmetric key is encrypted - we no longer need asymmetric key

 RSADestroyKey(RSAKey);

 // Now EncryptedKey of DataSize bytes holds the encrypted symmetric key

 // Simply store encrypted key in the encrypted file itself

 FS := TFileStream.Create('C:\Text.bin', fmCreate or fmShareExclusive);

 FS.WriteBuffer(DataSize, SizeOf(DataSize));

 FS.WriteBuffer(EncryptedKey^, DataSize);

 // We did not finished writing into FS yet...

 finally

 SecureFree(EncryptedKey, DataSize);

 end;

finally

 RSADestroyKey(RSAKey);

end;

// Next, encrypt the file itself

Data := TMemoryStream.Create;

try

 // Load C:\Text.txt file into Data

 Data.LoadFromFile('C:\Text.txt');

 // Encrypt Data in place

 DataToEncrypt.pbData := Data.Memory;

 DataToEncrypt.cbData := Data.Size;

 // This does not alter Data.Memory and Data.Size

 // It simply changes content of Data.Memory^

 TEAEncrypt(TEAKey, DataToEncrypt);

 // Data is encrypted, so save it to C:\Text.bin

 FS.CopyFrom(Data, Data.Size);

finally

 // Wipe memory and release stream object

 SecureFree(Data);

end;

finally

FreeAndNil(FS);

end;

// Now C:\Text.bin is ready

// It contains encrypted (random) symmetric key and encrypted data itself

// It can only be decrypted by the one having private RSA key

// See code example for RSADecrypt

finally

TEADestroyKey(TEAKey); // - same as SecureFree(TEAKey);

end;

end;