---
product: Chilkat
product_version: 11.7.0
language: delphidll
language_label: Delphi DLL
class: Rsa
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/dd_CkRsaRef.html
---
# Chilkat Rsa — Delphi DLL — v11.7.0

> Chilkat 11.7.0 · language=delphidll · class=Rsa
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/Rsa.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/guide.md`.

## Purpose

**Encrypt, decrypt, sign, verify, and generate RSA keys.**

Use `Chilkat.Rsa` when an application needs direct RSA cryptographic operations. It can encrypt data with a public key, decrypt with a private key, create RSA signatures, verify signatures, sign precomputed hashes, verify signed hashes, and generate RSA key pairs. It also works with keys supplied directly as `PrivateKey` or `PublicKey` objects, or indirectly through certificates.

**RSA encryption**

Encrypt data with a public key for workflows where only the matching private key should be able to decrypt the result.

**RSA decryption**

Decrypt RSA-encrypted data using a private key, including keys loaded directly or accessed through a certificate.

**Sign and verify data**

Create and verify RSA signatures over data using the hash algorithm and padding mode required by the application or protocol.

**Sign precomputed hashes**

Sign or verify already-computed message digests when the hashing step is performed separately or by another component.

**Generate RSA keys**

Generate RSA key pairs for applications that need new public/private key material.

**Certificate-backed keys**

Use RSA keys associated with certificates, including non-exportable private keys in smart cards, USB tokens, Windows stores, or Apple Keychain.

**Common pattern:** Load or generate the RSA key material, configure the padding, hash, charset, and encoding options needed by the protocol, then call the method matching the operation: encrypt, decrypt, sign, verify, sign-hash, or verify-hash. Use `Chilkat.Rsa` for direct RSA operations; use higher-level classes such as `Crypt2`, `Jws`, `Jwt`, or `Mime` when the RSA operation is part of a larger format or protocol.

For an extended overview, see [Rsa Class Overview](https://www.chilkatsoft.com/rsa_class_overview.asp).

## Object creation, unlocking and error handling

**Create/Dispose**

```pascal
var
myObject: HCkRsa;

begin
myObject := CkRsa_Create();

// ...

CkRsa_Dispose(myObject);
end;
```

`function CkRsa_Create: HCkRsa; stdcall;`

Creates an instance of the HCkRsa object and returns a handle (i.e. a Pointer). The handle is passed in the 1st argument for the functions listed on this page.

`procedure CkRsa_Dispose(handle: HCkRsa); stdcall;`

Objects created by calling CkRsa_Create must be freed by calling this method. A memory leak occurs if a handle is not disposed by calling this function.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Delphi DLL.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `procedure CkRsa_getDebugLogFilePath(objHandle: HCkRsa; outPropVal: HCkString); stdcall; procedure CkRsa_putDebugLogFilePath(objHandle: HCkRsa; newPropVal: PWideChar); stdcall; function CkRsa__debugLogFilePath(objHandle: HCkRsa): PWideChar; stdcall;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `procedure CkRsa_getLastErrorHtml(objHandle: HCkRsa; outPropVal: HCkString); stdcall; function CkRsa__lastErrorHtml(objHandle: HCkRsa): PWideChar; stdcall;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `procedure CkRsa_getLastErrorText(objHandle: HCkRsa; outPropVal: HCkString); stdcall; function CkRsa__lastErrorText(objHandle: HCkRsa): PWideChar; stdcall;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `procedure CkRsa_getLastErrorXml(objHandle: HCkRsa; outPropVal: HCkString); stdcall; function CkRsa__lastErrorXml(objHandle: HCkRsa): PWideChar; stdcall;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `function CkRsa_getLastMethodSuccess(objHandle: HCkRsa): wordbool; stdcall; procedure CkRsa_putLastMethodSuccess(objHandle: HCkRsa; newPropVal: wordbool); stdcall;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `function CkRsa_getVerboseLogging(objHandle: HCkRsa): wordbool; stdcall; procedure CkRsa_putVerboseLogging(objHandle: HCkRsa; newPropVal: wordbool); stdcall;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `procedure CkRsa_getVersion(objHandle: HCkRsa; outPropVal: HCkString); stdcall; function CkRsa__version(objHandle: HCkRsa): PWideChar; stdcall;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `Charset` | property, read/write | `procedure CkRsa_getCharset(objHandle: HCkRsa; outPropVal: HCkString); stdcall; procedure CkRsa_putCharset(objHandle: HCkRsa; newPropVal: PWideChar); stdcall; function CkRsa__charset(objHandle: HCkRsa): PWideChar; stdcall;` |
| `EncodingMode` | property, read/write | `procedure CkRsa_getEncodingMode(objHandle: HCkRsa; outPropVal: HCkString); stdcall; procedure CkRsa_putEncodingMode(objHandle: HCkRsa; newPropVal: PWideChar); stdcall; function CkRsa__encodingMode(objHandle: HCkRsa): PWideChar; stdcall;` |
| `LittleEndian` | property, read/write | `function CkRsa_getLittleEndian(objHandle: HCkRsa): wordbool; stdcall; procedure CkRsa_putLittleEndian(objHandle: HCkRsa; newPropVal: wordbool); stdcall;` |
| `NoUnpad` | property, read/write | `function CkRsa_getNoUnpad(objHandle: HCkRsa): wordbool; stdcall; procedure CkRsa_putNoUnpad(objHandle: HCkRsa; newPropVal: wordbool); stdcall;` |
| `NumBits` | property, read-only | `function CkRsa_getNumBits(objHandle: HCkRsa): Integer; stdcall;` |
| `OaepHash` | property, read/write | `procedure CkRsa_getOaepHash(objHandle: HCkRsa; outPropVal: HCkString); stdcall; procedure CkRsa_putOaepHash(objHandle: HCkRsa; newPropVal: PWideChar); stdcall; function CkRsa__oaepHash(objHandle: HCkRsa): PWideChar; stdcall;` |
| `OaepLabel` | property, read/write | `procedure CkRsa_getOaepLabel(objHandle: HCkRsa; outPropVal: HCkString); stdcall; procedure CkRsa_putOaepLabel(objHandle: HCkRsa; newPropVal: PWideChar); stdcall; function CkRsa__oaepLabel(objHandle: HCkRsa): PWideChar; stdcall;` |
| `OaepMgfHash` | property, read/write | `procedure CkRsa_getOaepMgfHash(objHandle: HCkRsa; outPropVal: HCkString); stdcall; procedure CkRsa_putOaepMgfHash(objHandle: HCkRsa; newPropVal: PWideChar); stdcall; function CkRsa__oaepMgfHash(objHandle: HCkRsa): PWideChar; stdcall;` |
| `PkcsPadding` | property, read/write | `function CkRsa_getPkcsPadding(objHandle: HCkRsa): wordbool; stdcall; procedure CkRsa_putPkcsPadding(objHandle: HCkRsa; newPropVal: wordbool); stdcall;` |
| `PssSaltLen` | property, read/write | `function CkRsa_getPssSaltLen(objHandle: HCkRsa): Integer; stdcall; procedure CkRsa_putPssSaltLen(objHandle: HCkRsa; newPropVal: Integer); stdcall;` |
| `UncommonOptions` | property, read/write | `procedure CkRsa_getUncommonOptions(objHandle: HCkRsa; outPropVal: HCkString); stdcall; procedure CkRsa_putUncommonOptions(objHandle: HCkRsa; newPropVal: PWideChar); stdcall; function CkRsa__uncommonOptions(objHandle: HCkRsa): PWideChar; stdcall;` |
| `DecryptBd` | method | `function CkRsa_DecryptBd(objHandle: HCkRsa;     bd: HCkBinData;     usePrivateKey: wordbool): wordbool; stdcall;` |
| `DecryptStringENC` | method | `function CkRsa_DecryptStringENC(objHandle: HCkRsa;     str: PWideChar;     usePrivateKey: wordbool;     outStr: HCkString): wordbool; stdcall; function CkRsa__decryptStringENC(objHandle: HCkRsa;     str: PWideChar;     usePrivateKey: wordbool): PWideChar; stdcall;` |
| `EncryptBd` | method | `function CkRsa_EncryptBd(objHandle: HCkRsa;     bd: HCkBinData;     usePrivateKey: wordbool): wordbool; stdcall;` |
| `EncryptStringENC` | method | `function CkRsa_EncryptStringENC(objHandle: HCkRsa;     str: PWideChar;     bUsePrivateKey: wordbool;     outStr: HCkString): wordbool; stdcall; function CkRsa__encryptStringENC(objHandle: HCkRsa;     str: PWideChar;     bUsePrivateKey: wordbool): PWideChar; stdcall;` |
| `GenKey` | method | `function CkRsa_GenKey(objHandle: HCkRsa;     numBits: Integer;     privKey: HCkPrivateKey): wordbool; stdcall;` |
| `SetX509Cert` | method | `function CkRsa_SetX509Cert(objHandle: HCkRsa;     cert: HCkCert;     usePrivateKey: wordbool): wordbool; stdcall;` |
| `SignBd` | method | `function CkRsa_SignBd(objHandle: HCkRsa;     bdData: HCkBinData;     hashAlgorithm: PWideChar;     bdSig: HCkBinData): wordbool; stdcall;` |
| `SignHashENC` | method | `function CkRsa_SignHashENC(objHandle: HCkRsa;     encodedHash: PWideChar;     hashAlg: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkRsa__signHashENC(objHandle: HCkRsa;     encodedHash: PWideChar;     hashAlg: PWideChar): PWideChar; stdcall;` |
| `SignRawBd` | method | `function CkRsa_SignRawBd(objHandle: HCkRsa;     bd: HCkBinData): wordbool; stdcall;` |
| `SignStringENC` | method | `function CkRsa_SignStringENC(objHandle: HCkRsa;     strToBeHashed: PWideChar;     hashAlgorithm: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkRsa__signStringENC(objHandle: HCkRsa;     strToBeHashed: PWideChar;     hashAlgorithm: PWideChar): PWideChar; stdcall;` |
| `SnkToXml` | method | `function CkRsa_SnkToXml(objHandle: HCkRsa;     filename: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkRsa__snkToXml(objHandle: HCkRsa;     filename: PWideChar): PWideChar; stdcall;` |
| `UsePrivateKey` | method | `function CkRsa_UsePrivateKey(objHandle: HCkRsa;     privKey: HCkPrivateKey): wordbool; stdcall;` |
| `UsePublicKey` | method | `function CkRsa_UsePublicKey(objHandle: HCkRsa;     pubKey: HCkPublicKey): wordbool; stdcall;` |
| `VerifyBd` | method | `function CkRsa_VerifyBd(objHandle: HCkRsa;     bdData: HCkBinData;     hashAlgorithm: PWideChar;     bdSig: HCkBinData): wordbool; stdcall;` |
| `VerifyHashENC` | method | `function CkRsa_VerifyHashENC(objHandle: HCkRsa;     encodedHash: PWideChar;     hashAlg: PWideChar;     encodedSig: PWideChar): wordbool; stdcall;` |
| `VerifyRawBd` | method | `function CkRsa_VerifyRawBd(objHandle: HCkRsa;     bd: HCkBinData): wordbool; stdcall;` |
| `VerifyStringENC` | method | `function CkRsa_VerifyStringENC(objHandle: HCkRsa;     originalString: PWideChar;     hashAlgorithm: PWideChar;     encodedSig: PWideChar): wordbool; stdcall;` |

Deprecated members are listed at the end of this file with their replacements; do not use them in new code.

## Properties

### Rsa.Charset

`Chilkat 11.7.0 · delphidll · Rsa · Charset · property · read/write`

```pascal
procedure CkRsa_getCharset(objHandle: HCkRsa; outPropVal: HCkString); stdcall;
procedure CkRsa_putCharset(objHandle: HCkRsa; newPropVal: PWideChar); stdcall;
function CkRsa__charset(objHandle: HCkRsa): PWideChar; stdcall;
```

**Full documentation for this property (same in every language):** [How Charset Affects RSA](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/how_charset_affects_rsa.md) · [ANSI Charset Explained](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/ansi_charset_explained.md)

This property specifies the character encoding used to represent text as bytes for encryption, decryption, signing, and signature validation. By default, it uses the computer's `ANSI` charset, such as Windows-1252 for locales like the United States, United Kingdom, Western Europe, Australia, and New Zealand.

Most applications are advised to set this property to `UTF-8`. Chilkat plans to change its default to UTF-8 in a future major version to align with current standards. The current default of ANSI stems from a time when UTF-8 was not widely adopted.

### Rsa.EncodingMode

`Chilkat 11.7.0 · delphidll · Rsa · EncodingMode · property · read/write`

```pascal
procedure CkRsa_getEncodingMode(objHandle: HCkRsa; outPropVal: HCkString); stdcall;
procedure CkRsa_putEncodingMode(objHandle: HCkRsa; newPropVal: PWideChar); stdcall;
function CkRsa__encodingMode(objHandle: HCkRsa): PWideChar; stdcall;
```

This property defines the encoding for methods ending in `ENC`, such as EncryptStringENC. Valid modes include `base64`, `hex`, `hex_lower`, and more. The encoding mode applies to signatures, encrypted data, and hashes used in or returned by a method.

### Rsa.LittleEndian

`Chilkat 11.7.0 · delphidll · Rsa · LittleEndian · property · read/write`

```pascal
function CkRsa_getLittleEndian(objHandle: HCkRsa): wordbool; stdcall;
procedure CkRsa_putLittleEndian(objHandle: HCkRsa; newPropVal: wordbool); stdcall;
```

When creating RSA signatures, this property determines the endianness: set it to `True` for little-endian signatures and `False` for big-endian signatures.

See also:

- [RSA Signatures and Endianness](https://cknotes.com/rsa-signatures-and-endianness/)

### Rsa.NoUnpad

`Chilkat 11.7.0 · delphidll · Rsa · NoUnpad · property · read/write`

```pascal
function CkRsa_getNoUnpad(objHandle: HCkRsa): wordbool; stdcall;
procedure CkRsa_putNoUnpad(objHandle: HCkRsa; newPropVal: wordbool); stdcall;
```

If `True`, skips unpadding when decrypting. The default is `False`. This property value is typically left unchanged.

### Rsa.NumBits

`Chilkat 11.7.0 · delphidll · Rsa · NumBits · property · read-only`

```pascal
function CkRsa_getNumBits(objHandle: HCkRsa): Integer; stdcall;
```

The bit length, such as 2048, of the imported or generated RSA key.

### Rsa.OaepHash

`Chilkat 11.7.0 · delphidll · Rsa · OaepHash · property · read/write · since 9.5.0.48`

```pascal
procedure CkRsa_getOaepHash(objHandle: HCkRsa; outPropVal: HCkString); stdcall;
procedure CkRsa_putOaepHash(objHandle: HCkRsa; newPropVal: PWideChar); stdcall;
function CkRsa__oaepHash(objHandle: HCkRsa): PWideChar; stdcall;
```

Selects the hash algorithm for use within OAEP padding for encryption. The valid choices are `sha256`, `sha384`, `sha512`, or `sha1`.

The default is SHA1. You'll likely want to change this to to SHA256. The next major version of Chilkat (11.0.0) will change the default to SHA256.

See also:

- [More Information about RSA OAEP Padding for Encryption](https://cknotes.com/more-information-about-rsa-oaep-padding-for-encryption/)

### Rsa.OaepLabel

`Chilkat 11.7.0 · delphidll · Rsa · OaepLabel · property · read/write · since 9.5.0.95`

```pascal
procedure CkRsa_getOaepLabel(objHandle: HCkRsa; outPropVal: HCkString); stdcall;
procedure CkRsa_putOaepLabel(objHandle: HCkRsa; newPropVal: PWideChar); stdcall;
function CkRsa__oaepLabel(objHandle: HCkRsa): PWideChar; stdcall;
```

The optional RSA encryption OAEP label is a hex representation of the label bytes used for encrypting with OAEP padding. Typically, this is left empty (0 bytes) unless there's a specific requirement to set it.

See also:

- [More Information about RSA OAEP Padding for Encryption](https://cknotes.com/more-information-about-rsa-oaep-padding-for-encryption/)

### Rsa.OaepMgfHash

`Chilkat 11.7.0 · delphidll · Rsa · OaepMgfHash · property · read/write · since 9.5.0.71`

```pascal
procedure CkRsa_getOaepMgfHash(objHandle: HCkRsa; outPropVal: HCkString); stdcall;
procedure CkRsa_putOaepMgfHash(objHandle: HCkRsa; newPropVal: PWideChar); stdcall;
function CkRsa__oaepMgfHash(objHandle: HCkRsa): PWideChar; stdcall;
```

Selects the MGF (mask generation) hash algorithm for use within OAEP padding for encryption. The valid choices are `sha256`, `sha384`, `sha512`, or `sha1`.

Note: This property should typically be set to the same value as the OaepHash property. Many software implementations are not able to handle cases where the MGF hash is different than the OAEP hash.

The default is SHA1. You'll likely want to change this to to SHA256. The next major version of Chilkat (11.0.0) will change the default to SHA256.

See also:

- [More Information about RSA OAEP Padding for Encryption](https://cknotes.com/more-information-about-rsa-oaep-padding-for-encryption/)

### Rsa.PkcsPadding

`Chilkat 11.7.0 · delphidll · Rsa · PkcsPadding · property · read/write · since 11.0.0`

```pascal
function CkRsa_getPkcsPadding(objHandle: HCkRsa): wordbool; stdcall;
procedure CkRsa_putPkcsPadding(objHandle: HCkRsa; newPropVal: wordbool); stdcall;
```

This property controls padding for both signing and encryption. The default value is true, which is to use PKCS#1 v1.5 padding. If set to false, then PSS padding is used for signatures and OAEP padding is used for encryption.

This property replaces the deprecated `OaepPadding` property. Until the OaepPadding property is removed, setting this property will automatically set OaepPadding to the opposite, and vice-versa. This is to maintain backward compatibility until applications can switch to using this new property.

### Rsa.PssSaltLen

`Chilkat 11.7.0 · delphidll · Rsa · PssSaltLen · property · read/write · since 9.5.0.80`

```pascal
function CkRsa_getPssSaltLen(objHandle: HCkRsa): Integer; stdcall;
procedure CkRsa_putPssSaltLen(objHandle: HCkRsa; newPropVal: Integer); stdcall;
```

When using RSASSA-PSS padding for signatures, you can choose the PSS salt length. By default, the salt length is set to -1, which uses the length of the hash function. For instance, with the SHA256 hash function, the salt length will be 32 bytes. You can specify a different salt length, like 20 bytes, if needed, but it's generally recommended to keep the default setting.

### Rsa.UncommonOptions

`Chilkat 11.7.0 · delphidll · Rsa · UncommonOptions · property · read/write · since 10.1.0`

```pascal
procedure CkRsa_getUncommonOptions(objHandle: HCkRsa; outPropVal: HCkString); stdcall;
procedure CkRsa_putUncommonOptions(objHandle: HCkRsa; newPropVal: PWideChar); stdcall;
function CkRsa__uncommonOptions(objHandle: HCkRsa): PWideChar; stdcall;
```

This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty.

## Methods

### Rsa.DecryptBd

`Chilkat 11.7.0 · delphidll · Rsa · DecryptBd · method · since 9.5.0.76`

```pascal
function CkRsa_DecryptBd(objHandle: HCkRsa;
    bd: HCkBinData;
    usePrivateKey: wordbool): wordbool; stdcall;
```

RSA decrypts the contents of `bd`. `usePrivateKey` should be set to `True` if the private key is to be used for decrypting. Otherwise it should be set to `False` if (in rare cases) the public key is to be used for decrypting.

**Important:** If trying to match OpenSSL results, set the LittleEndian property = `False`.

Returns True for success, False for failure.

See also:

- [RSA Encryption Maximum Number of Bytes](https://cknotes.com/rsa-encryption-maximum-number-of-bytes/)

### Rsa.DecryptStringENC

`Chilkat 11.7.0 · delphidll · Rsa · DecryptStringENC · method`

```pascal
function CkRsa_DecryptStringENC(objHandle: HCkRsa;
    str: PWideChar;
    usePrivateKey: wordbool;
    outStr: HCkString): wordbool; stdcall;
function CkRsa__decryptStringENC(objHandle: HCkRsa;
    str: PWideChar;
    usePrivateKey: wordbool): PWideChar; stdcall;
```

Decrypts `str` with the RSA algorithm. `str` is the encoded form of the encrypted binary data. The EncodingMode property defines `str`'s encoding. The Charset property specifies the byte representation for interpreting the decrypted text. Set `usePrivateKey` to `True` to use the private key for decryption; otherwise, set `usePrivateKey` to `False` to use the public key (used rarely). Returns the decrypted string.

**Important:** If trying to match OpenSSL results, set the LittleEndian property = `False`.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Rsa.EncryptBd

`Chilkat 11.7.0 · delphidll · Rsa · EncryptBd · method · since 9.5.0.76`

```pascal
function CkRsa_EncryptBd(objHandle: HCkRsa;
    bd: HCkBinData;
    usePrivateKey: wordbool): wordbool; stdcall;
```

RSA encrypts the contents of `bd`. Set `usePrivateKey` to `False` to use the public key for encrypting; otherwise, set it to `True` to use the private key (in rare cases).

**Important:** If trying to match OpenSSL results, set the LittleEndian property = `False`.

**Note:** The public key's role is to make encryption accessible to anyone while ensuring that only the private key holder can decrypt the messages. The public key is designed to be widely distributed so anyone can use it to encrypt messages intended for the owner of the private key.

Returns True for success, False for failure.

See also:

- [RSA Encryption Maximum Number of Bytes](https://cknotes.com/rsa-encryption-maximum-number-of-bytes/)

### Rsa.EncryptStringENC

`Chilkat 11.7.0 · delphidll · Rsa · EncryptStringENC · method`

```pascal
function CkRsa_EncryptStringENC(objHandle: HCkRsa;
    str: PWideChar;
    bUsePrivateKey: wordbool;
    outStr: HCkString): wordbool; stdcall;
function CkRsa__encryptStringENC(objHandle: HCkRsa;
    str: PWideChar;
    bUsePrivateKey: wordbool): PWideChar; stdcall;
```

Encrypts `str` with the RSA algorithm. The Charset property specifies the byte representation of the string that is encrypted. Set `bUsePrivateKey` to `False` to use the public key for encrypting; otherwise, set it to `True` to use the private key (in rare cases). The encrypted data is returned in the format specified by the EncodingMode property.

**Important:** If trying to match OpenSSL results, set the LittleEndian property = `False`.

**Note:** The public key's role is to make encryption accessible to anyone while ensuring that only the private key holder can decrypt the messages. The public key is designed to be widely distributed so anyone can use it to encrypt messages intended for the owner of the private key.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Rsa.GenKey

`Chilkat 11.7.0 · delphidll · Rsa · GenKey · method · since 11.0.0`

```pascal
function CkRsa_GenKey(objHandle: HCkRsa;
    numBits: Integer;
    privKey: HCkPrivateKey): wordbool; stdcall;
```

Generates a new RSA key and stores it in `privKey`. `numBits` specifies the key length, which can range from 512 to 8192 bits. Common key lengths are 1024, 2048, or 4096 bits.

Note: Generating an 8192-bit key may take a significant amount of time. The method does not support event callbacks or progress monitoring and will block the thread until completion.

Returns True for success, False for failure.

### Rsa.SetX509Cert

`Chilkat 11.7.0 · delphidll · Rsa · SetX509Cert · method · since 9.5.0.73`

```pascal
function CkRsa_SetX509Cert(objHandle: HCkRsa;
    cert: HCkCert;
    usePrivateKey: wordbool): wordbool; stdcall;
```

Provides the private or public key indirectly through a certificate. This method is used when the private key is inaccessible, such as when stored on a smart card, USB token, in the Windows registry (marked as non-exportable), or in the Apple Keychain.

Returns True for success, False for failure.

### Rsa.SignBd

`Chilkat 11.7.0 · delphidll · Rsa · SignBd · method · since 9.5.0.77`

```pascal
function CkRsa_SignBd(objHandle: HCkRsa;
    bdData: HCkBinData;
    hashAlgorithm: PWideChar;
    bdSig: HCkBinData): wordbool; stdcall;
```

Generates an RSA digital signature by first hashing the contents of `bdData` with the hash algorithm specified by `hashAlgorithm`, which can be `sha256`, `sha384`, `sha512`, or `sha1`. The resulting signature is written to `bdSig`.

Note: It is important to be aware of endianness. Make sure the LittleEndian property is set according to your specific needs.

Returns True for success, False for failure.

### Rsa.SignHashENC

`Chilkat 11.7.0 · delphidll · Rsa · SignHashENC · method`

```pascal
function CkRsa_SignHashENC(objHandle: HCkRsa;
    encodedHash: PWideChar;
    hashAlg: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkRsa__signHashENC(objHandle: HCkRsa;
    encodedHash: PWideChar;
    hashAlg: PWideChar): PWideChar; stdcall;
```

This function creates an RSA digital signature for the hash provided in `encodedHash`, which should be encoded according to the EncodingMode setting (e.g., base64 if EncodingMode = `base64`). `hashAlg` specifies the hash algorithm and can be `sha256`, `sha384`, `sha512`, or `sha1`. The function returns the signature encoded as specified by EncodingMode.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Rsa.SignRawBd

`Chilkat 11.7.0 · delphidll · Rsa · SignRawBd · method · since 11.0.0`

```pascal
function CkRsa_SignRawBd(objHandle: HCkRsa;
    bd: HCkBinData): wordbool; stdcall;
```

This is legacy low-level raw RSA that duplicates the (now deprecated) `OpenSSL` `rsautl` utility. It directly signs raw data rather than signing a hash of the data. PKCS#1 v1.5 padding is always used. The data to be signed is passed in `bd`, and on return the content of `bd` is replaced with the RSA signed data.

Note: It is possible to validate and recover the original data by calling `VerifyRawBd`.

Returns True for success, False for failure.

### Rsa.SignStringENC

`Chilkat 11.7.0 · delphidll · Rsa · SignStringENC · method`

```pascal
function CkRsa_SignStringENC(objHandle: HCkRsa;
    strToBeHashed: PWideChar;
    hashAlgorithm: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkRsa__signStringENC(objHandle: HCkRsa;
    strToBeHashed: PWideChar;
    hashAlgorithm: PWideChar): PWideChar; stdcall;
```

Generates an RSA digital signature by first hashing `strToBeHashed` with the hash algorithm specified by `hashAlgorithm`, which can be `sha256`, `sha384`, `sha512`, or `sha1`. Returns the signature encoded based on the EncodingMode property.

**Note:** It is important to be aware of endianness. Make sure the LittleEndian property is set according to your specific needs.

**Note:** It is recommended to set the Charset property equal to `utf-8` before signing strings.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Rsa.SnkToXml

`Chilkat 11.7.0 · delphidll · Rsa · SnkToXml · method`

```pascal
function CkRsa_SnkToXml(objHandle: HCkRsa;
    filename: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkRsa__snkToXml(objHandle: HCkRsa;
    filename: PWideChar): PWideChar; stdcall;
```

Imports a .snk file to an XML document that can be imported via the ImportPrivateKey method.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Rsa.UsePrivateKey

`Chilkat 11.7.0 · delphidll · Rsa · UsePrivateKey · method · since 11.0.0`

```pascal
function CkRsa_UsePrivateKey(objHandle: HCkRsa;
    privKey: HCkPrivateKey): wordbool; stdcall;
```

Imports a private key from `privKey` to use for signing or decrypting.

Returns True for success, False for failure.

### Rsa.UsePublicKey

`Chilkat 11.7.0 · delphidll · Rsa · UsePublicKey · method · since 11.0.0`

```pascal
function CkRsa_UsePublicKey(objHandle: HCkRsa;
    pubKey: HCkPublicKey): wordbool; stdcall;
```

Imports a public key from `pubKey` to use for encrypting or signature verification.

Returns True for success, False for failure.

### Rsa.VerifyBd

`Chilkat 11.7.0 · delphidll · Rsa · VerifyBd · method · since 9.5.0.77`

```pascal
function CkRsa_VerifyBd(objHandle: HCkRsa;
    bdData: HCkBinData;
    hashAlgorithm: PWideChar;
    bdSig: HCkBinData): wordbool; stdcall;
```

Verifies the RSA signature passed in `bdSig` against the original data passed in `bdData`. The original data passed in `bdData` is hashed using the hash algorithm passed in `hashAlgorithm` (such as `sha256`, `sha384`, `sha512`, or `sha1`). Returns `True` if the signature is validated, and `False` if not.

Note: Knowing the exact hash algorithm used to create the signature is not required. If the signature is not validated using the hash algorithm specified in `hashAlgorithm`, Chilkat will automatically try validating using the other supported algorithms and return success if any validate.

Returns True for success, False for failure.

### Rsa.VerifyHashENC

`Chilkat 11.7.0 · delphidll · Rsa · VerifyHashENC · method`

```pascal
function CkRsa_VerifyHashENC(objHandle: HCkRsa;
    encodedHash: PWideChar;
    hashAlg: PWideChar;
    encodedSig: PWideChar): wordbool; stdcall;
```

Validates an RSA signature provided in `encodedSig` against the hash of the original data in `encodedHash`. Returns `True` if validation is successful, otherwise returns `False`. `hashAlg` specifies the hash algorithm used for `encodedHash`, such as `sha256`, `sha384`, `sha512`, or `sha1`. Ensure the hash's size (e.g., 32 bytes for sha256, 48 bytes for sha384, 64 bytes for sha512, 20 bytes for sha1) matches that of `encodedHash`.

Both `encodedHash` and `encodedSig` should be encoded according to the EncodingMode property (e.g., base64 if EncodingMode = `base64`)

Returns True for success, False for failure.

### Rsa.VerifyRawBd

`Chilkat 11.7.0 · delphidll · Rsa · VerifyRawBd · method · since 11.0.0`

```pascal
function CkRsa_VerifyRawBd(objHandle: HCkRsa;
    bd: HCkBinData): wordbool; stdcall;
```

This is legacy low-level raw RSA that duplicates the (now deprecated) `OpenSSL` `rsautl` utility. It validates signed raw data and recovers the original data. The RSA signature to be verified is passed in `bd`, and on return the content of `bd` is replaced with the original data.

Returns True for success, False for failure.

### Rsa.VerifyStringENC

`Chilkat 11.7.0 · delphidll · Rsa · VerifyStringENC · method`

```pascal
function CkRsa_VerifyStringENC(objHandle: HCkRsa;
    originalString: PWideChar;
    hashAlgorithm: PWideChar;
    encodedSig: PWideChar): wordbool; stdcall;
```

Verifies the encoded RSA signature passed in `encodedSig` against the original data passed in `originalString`. The original data passed in `originalString` is hashed using the hash algorithm passed in `hashAlgorithm` (such as `sha256`, `sha384`, `sha512`, or `sha1`). Returns `True` if the signature is validated, and `False` if not.

The signature passed in `encodedSig` should be encoded according to the EncodingMode property (e.g., base64 if EncodingMode = `base64`)

Note: Knowing the exact hash algorithm used to create the signature is not required. If the signature is not validated using the hash algorithm specified in `hashAlgorithm`, Chilkat will automatically try validating using the other supported algorithms and return success if any validate.

Returns True for success, False for failure.

## Deprecated members — do not use in new code

| Member | Kind | Deprecated in | Use instead |
|---|---|---|---|
| `OaepPadding` | property | before 11.6.1 | — |
| `DecryptBytes` | method | before 11.6.1 | — |
| `DecryptBytesENC` | method | before 11.6.1 | — |
| `DecryptString` | method | before 11.6.1 | — |
| `EncryptBytes` | method | before 11.6.1 | — |
| `EncryptBytesENC` | method | before 11.6.1 | — |
| `EncryptString` | method | before 11.6.1 | — |
| `ExportPrivateKey` | method | before 11.6.1 | — |
| `ExportPrivateKeyObj` | method | before 11.6.1 | — |
| `ExportPublicKey` | method | before 11.6.1 | — |
| `ExportPublicKeyObj` | method | before 11.6.1 | — |
| `GenerateKey` | method | before 11.6.1 | `GenKey` |
| `ImportPrivateKey` | method | before 11.6.1 | `UsePrivateKey` |
| `ImportPrivateKeyObj` | method | before 11.6.1 | `UsePrivateKey` |
| `ImportPublicKey` | method | before 11.6.1 | `UsePublicKey` |
| `ImportPublicKeyObj` | method | before 11.6.1 | `UsePublicKey` |
| `OpenSslSignBd` | method | before 11.6.1 | `SignRawBd` |
| `OpenSslSignBytes` | method | before 11.6.1 | `SignRawBd` |
| `OpenSslSignBytesENC` | method | before 11.6.1 | `SignRawBd` |
| `OpenSslSignString` | method | before 11.6.1 | `SignRawBd` |
| `OpenSslSignStringENC` | method | before 11.6.1 | `SignRawBd` |
| `OpenSslVerifyBd` | method | before 11.6.1 | `VerifyRawBd` |
| `OpenSslVerifyBytes` | method | before 11.6.1 | `VerifyRawBd` |
| `OpenSslVerifyBytesENC` | method | before 11.6.1 | `VerifyRawBd` |
| `OpenSslVerifyString` | method | before 11.6.1 | `VerifyRawBd` |
| `OpenSslVerifyStringENC` | method | before 11.6.1 | `VerifyRawBd` |
| `SignBytes` | method | before 11.6.1 | — |
| `SignBytesENC` | method | before 11.6.1 | — |
| `SignHash` | method | before 11.6.1 | — |
| `SignString` | method | before 11.6.1 | — |
| `VerifyBytes` | method | before 11.6.1 | — |
| `VerifyBytesENC` | method | before 11.6.1 | — |
| `VerifyHash` | method | before 11.6.1 | — |
| `VerifyString` | method | before 11.6.1 | — |

## Related classes

[`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/Cert.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/PublicKey.md)