Announcement

**John Gleason** · 22 Oct 2009, 01:07 PM

I get ~12500 tix for the set_key call, which would equate to ~125,000,000 tix for a 1GB file. That's only a small fraction of a second for a very big file.

**Greg Turgeon** · 22 Oct 2009, 10:24 PM

Do I have to pass again and again the same password to the encrypt_buffer()?
Within the encrypt_buffer() will always the function Set_Key() called. This costs performance.

See my reply in the thread you refer to. And no. SetKey() is, of course, called once only.

**Bernhard Fomm** · 23 Oct 2009, 04:18 AM

1)
Is the implementation really correct?
Can I encrypt a file as above?
Is there a standard method for AES encryption of large files?

2)
And: Not missing the key-generator SHA256?

**Eddy Van Esch** · 23 Oct 2009, 05:30 AM

Originally posted by Bernhard Fomm View Post

1)
Is there a standard method for AES encryption of large files?

Bernhard, back in 2005 you promised me that you understood ...

Revisit my explanation on ECB, CBC, CFB, OFB, ..
There is not really a standard method. CBC is often used.

Kind regards

**Bernhard Fomm** · 23 Oct 2009, 05:55 PM

Yes. I understood you in 2005.

However, if my doctor says something,
I understand him even theoretically.

And now I have grown old again four years.

I'm not sure with the correct AES implementation for file encryption.

From your point of view If my small sample in order?
I have your HIME functions. Can you give an example?

**Eddy Van Esch** · 25 Oct 2009, 03:54 AM

Bernhard. This is a small demo program using HIME library to encrypt and decrypt a file with AES in CBC mode.
This example assumes that you can load the file into memory as a whole. If the file is too large to load into memory, you can use the technique you used in your program. That is to read the file in parts, encrypt part by part and save the encrypted parts to file.
Except, this time the part size can be very large. It is not limited to AES block size.

Code:

'====================================================================
'============ HIME demo program to show AES encryption and decryption
'====================================================================
#COMPILE EXE
#DIM ALL

'--------------------------------------------------------------------------------
'   ** Includes **
'--------------------------------------------------------------------------------
'Include header file for HIME.dll. 
'Download here: http://www.devotechs.com/HIMEDownloads.html
#INCLUDE "HIME.inc"

FUNCTION PBMAIN()
    LOCAL i           AS LONG       
    LOCAL password$, plain$, cipher$
   '===============================================
    '==== Encrypt data with AES in CBC mode
    '===============================================

    password$=LSET$("super secret password",32)
    KILL "C:\Temp\testfile.crypt"
    OPEN "C:\Temp\testfile.txt" FOR BINARY ACCESS READ AS #1
    OPEN "C:\Temp\testfile.crypt" FOR BINARY ACCESS WRITE AS #2
        
        GET$ #1, LOF(#1), plain$
        
                'Store plaintext in register 1. Plaintext can have any length
        hi_PutReg plain$   , 1
                'Store encryption key in register 2. Key must be exactly 16, 24 or 32 bytes long
        hi_PutReg password$, 2   
                'Set an empty IV in register 3. HIME will create an IV itself
        hi_PutReg ""       , 3
                'Encrypt plaintext. Register 4 contains ciphertext
        hi_Encrypt_AES_CBC 1, 2, 3, 4     
    
        cipher$ = hi_GetReg(4)  'Get ciphertext from HIME register 4 ..
        PUT$ #2, cipher$        '.. and save it to file
    CLOSE #2
    CLOSE #1

    
    '===============================================
    '==== Decrypt data with AES in CBC mode
    '===============================================
    KILL "C:\Temp\testfile2.txt"                                                                                  
    OPEN "C:\Temp\testfile.crypt" FOR BINARY ACCESS READ AS #1
    OPEN "C:\Temp\testfile2.txt" FOR BINARY ACCESS WRITE AS #2
    
        GET$ #1, LOF(#1), cipher$
        
                'Store ciphertext in register 1.
        hi_PutReg cipher$  , 1
                'Store encryption key in register 2. Key must be exactly 16, 24 or 32 bytes long
        hi_PutReg password$, 2   
                'Decrypt ciphertext
        i = hi_Decrypt_AES_CBC(1, 2, 3)   'Register 3 contains decrypted ciphertext (= plaintext)    
        IF i <> 0 THEN 
            MSGBOX "'hi_Decrypt_AES_CBC' returned an error!"
        END IF     
    
        plain$ = hi_GetReg(3)  'Get plaintext from HIME register 3 ..
        PUT$ #2, plain$        '.. and save it to file
    CLOSE #2
    CLOSE #1
                                                                                          
END FUNCTION

Kind regards

**Eddy Van Esch** · 25 Oct 2009, 04:09 AM

If you don't want your passphrase to be limited to the fixed AES key lengths of 16, 24 or 32 bytes, just hash the passphrase.
For example by using SHA-256 like this:

Code:

    password$ = "This is a very long string to be used as AES password. Can be as long as you want!"
    hi_PutReg password$, 1
            'Calculate SHA-256 Hash value
    hi_Hash_SHA_256 1, 2     'Register 2 contains hash value (32 bytes)
    password$ = hi_GetReg(2)

Kind regards

**Bernhard Fomm** · 25 Oct 2009, 04:13 PM

Great! Thanks!

How can processing of very large files?
Is the following implementation correct?

Code:

%BUFFER_LEN = 1000000

FUNCTION PBMAIN () AS LONG
LOCAL password$, plain$, cipher$
LOCAL remainder AS LONG
    password$=LSET$("super secret password",32)
        [SIZE="3"][B]'Store encryption key in register 2. Key must be exactly 16, 24 or 32 bytes long
    hi_PutReg password$, 2   
        'Set an empty IV in register 3. HIME will create an IV itself
    hi_PutReg ""       , 3[/B][/SIZE]
    OPEN "C:\Temp\testfile.txt" FOR BINARY ACCESS READ AS #1
    OPEN "C:\Temp\testfile.crypt" FOR BINARY ACCESS WRITE AS #2
        remainder = LOF(#1)
        WHILE remainder > 0
            IF ( remainder ) > %BUFFER_LEN THEN
                GET$ #1, %BUFFER_LEN, plain$
                remainder = remainder - %BUFFER_LEN
            ELSE
                GET$ #1, remainder, plain$
                remainder = 0
            END IF
                [SIZE="3"][B]'Store plaintext in register 1. Plaintext can have any length
            hi_PutReg plain$   , 1
                'Encrypt plaintext. Register 4 contains ciphertext
            hi_Encrypt_AES_CBC 1, 2, 3, 4
                'Get ciphertext from HIME register 4 ..
            cipher$ = hi_GetReg(4)[/B][/SIZE]
            PUT$ #2, cipher$
        WEND
    CLOSE
END FUNCTION

Or, must be effected refresher of the key?

Code:

%BUFFER_LEN = 1000000

FUNCTION PBMAIN () AS LONG
LOCAL password$, plain$, cipher$
LOCAL remainder AS LONG
    password$=LSET$("super secret password",32)
    OPEN "C:\Temp\testfile.txt" FOR BINARY ACCESS READ AS #1
    OPEN "C:\Temp\testfile.crypt" FOR BINARY ACCESS WRITE AS #2
        remainder = LOF(#1)
        WHILE remainder > 0
            IF ( remainder ) > %BUFFER_LEN THEN
                GET$ #1, %BUFFER_LEN, plain$
                remainder = remainder - %BUFFER_LEN
            ELSE
                GET$ #1, remainder, plain$
                remainder = 0
            END IF
                [SIZE="3"][B]'Store encryption key in register 2. Key must be exactly 16, 24 or 32 bytes long
            hi_PutReg password$, 2   
                'Set an empty IV in register 3. HIME will create an IV itself
            hi_PutReg ""       , 3
                'Store plaintext in register 1. Plaintext can have any length
            hi_PutReg plain$   , 1
                'Encrypt plaintext. Register 4 contains ciphertext
            hi_Encrypt_AES_CBC 1, 2, 3, 4
                'Get ciphertext from HIME register 4 ..
            cipher$ = hi_GetReg(4)[/B][/SIZE]
            PUT$ #2, cipher$
        WEND
    CLOSE
END FUNCTION

**Eddy Van Esch** · 26 Oct 2009, 04:08 AM

Bernhard,
Your first program is good. As long as the registers 2 and 3 (password and IV) are not overwritten, you do not have to refresh them. HIME does not change their contents.

PS. Instead of

Code:

        cipher$ = hi_GetReg(4)  'Get ciphertext from HIME register 4 ..
        PUT$ #2, cipher$        '.. and save it to file

You can also write:

Code:

        PUT$ #2, hi_GetReg(4)  'Get ciphertext from HIME register 4 ..

Kind regards

**Bernhard Fomm** · 26 Oct 2009, 05:07 AM

Must set initialization vector only once?

Code:

[B]    hi_PutReg password$, 2
    hi_PutReg ""       , 3    'IV... HIME will create an IV itself[/B]
    open file1
        encrypt file1
    close file1
    open file2
        encrypt file2
    close file2

Or, must it always reset the initialization-vector?

Code:

[B]    hi_PutReg password$, 2
    hi_PutReg ""       , 3    'IV 1... HIME will create an 1. IV itself[/B]
    open file1
        encrypt file1
    close file1
[B]    hi_PutReg ""       , 3    'IV 2... HIME will create an 2. IV itself ???[/B]
    open file2
        encrypt file2
    close file2

**Eddy Van Esch** · 26 Oct 2009, 05:18 AM

As long as the register contents that contains the IV (can be empty) is not overwritten, you do not have to set it again, as in your first code snippet.

Kind regards

**Bernhard Fomm** · 26 Oct 2009, 06:25 AM

How the IV is formed? By password?

**Eddy Van Esch** · 26 Oct 2009, 06:52 AM

Originally posted by Bernhard Fomm View Post

How the IV is formed? By password?

No. The requirements of an IV (Initial Vector) are very little. It only has to be as long as the block size of the cipher used. For AES, this is 16 bytes.
That's it. It is good if the bytes are (pseudo)random but not required. The IV does not have to be kept secret. Most of the time the IV is sent along with the ciphertext, because it is needed for decryption of the ciphertext.
hi_Encrypt_AES_CBC attaches the IV to the ciphertext automatically.
If you do not provide an IV to HIME, and keep the IV register empty, HIME generates a random series of bytes to serve as IV.

Kind regards

Announcement

AES encryption

AES encryption

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment