--- product: Chilkat product_version: 11.7.0 language: pascal language_label: Lazarus Pascal class: Crypt2 license: bundle deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/pascal_Crypt2Ref.html --- # Chilkat Crypt2 — Lazarus Pascal — v11.7.0 > Chilkat 11.7.0 · language=pascal · class=Crypt2 > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/Crypt2.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`. ## Purpose **Encrypt, decrypt, hash, sign, verify, encode, and authenticate data.** `Chilkat.Crypt2` is a broad cryptographic utility class for applications that need symmetric encryption, decryption, hashing, HMACs, key derivation, random data generation, one-time passwords, binary encoding, PKCS#7/CMS signatures, CAdES options, and certificate-based public-key encryption and decryption. It works with strings, files, byte data, `BinData`, and `StringBuilder` objects, making it useful for both small in-memory operations and file-based cryptographic workflows. **Encryption and decryption** Encrypt and decrypt strings, files, byte arrays, and Chilkat buffer objects using configurable algorithms, modes, keys, IVs, padding, and encodings. **Hashes and HMACs** Compute message digests and keyed message authentication codes for text, files, byte data, and in-memory buffers. **PKCS#7 / CMS signatures** Create and verify signed data, detached signatures, opaque signatures, and certificate-based signature formats used in many security workflows. **CAdES support** Use CAdES-related options when advanced CMS signature profiles are required for compliance or interoperability. **Key and random utilities** Derive keys, generate random bytes, create one-time passwords, and prepare keying material for cryptographic operations. **Encoding and data conversion** Encode and decode binary data using formats such as Base64, hex, URL encoding, and other supported binary encodings. **Common pattern:** Choose the cryptographic operation, set the algorithm and related options, provide keys, certificates, passwords, IVs, or encoding settings as needed, then call the method matching the data form: string, file, bytes, `BinData`, or `StringBuilder`. Check `LastErrorText` when diagnosing algorithm, key, certificate, signature, or encoding issues. For an extended overview, see [Crypt2 Class Overview](https://www.chilkatsoft.com/crypt2_class_overview.asp). ## Object creation, unlocking and error handling **Create / Free** ```pascal uses Chilkat.Crypt2; var obj: TCrypt2; begin obj := TCrypt2.Create; try if not obj.IsValid then raise Exception.Create('Failed to create a TCrypt2 instance.'); // ... use obj ... finally obj.Free; end; end; ``` `constructor Create;` Allocates the underlying CkCrypt2 object and returns a new TCrypt2 instance. Simply adding **Chilkat.Crypt2** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed). `destructor Destroy; override;` Every TCrypt2 created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkCrypt2 handle. A native (unmanaged) memory leak occurs if the object is never freed. Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. | | `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `AbortCurrent` | property, read/write | `property AbortCurrent: Boolean read GetAbortCurrent write SetAbortCurrent;` | | `BCryptWorkFactor` | property, read/write | `property BCryptWorkFactor: Integer read GetBCryptWorkFactor write SetBCryptWorkFactor;` | | `BlockSize` | property, read-only | `property BlockSize: Integer read GetBlockSize;` | | `CadesEnabled` | property, read/write | `property CadesEnabled: Boolean read GetCadesEnabled write SetCadesEnabled;` | | `CadesSigPolicyHash` | property, read/write | `property CadesSigPolicyHash: string read GetCadesSigPolicyHash write SetCadesSigPolicyHash;` | | `CadesSigPolicyId` | property, read/write | `property CadesSigPolicyId: string read GetCadesSigPolicyId write SetCadesSigPolicyId;` | | `CadesSigPolicyUri` | property, read/write | `property CadesSigPolicyUri: string read GetCadesSigPolicyUri write SetCadesSigPolicyUri;` | | `Charset` | property, read/write | `property Charset: string read GetCharset write SetCharset;` | | `CipherMode` | property, read/write | `property CipherMode: string read GetCipherMode write SetCipherMode;` | | `CmsOptions` | property, read/write | `property CmsOptions: string read GetCmsOptions write SetCmsOptions;` | | `CryptAlgorithm` | property, read/write | `property CryptAlgorithm: string read GetCryptAlgorithm write SetCryptAlgorithm;` | | `EncodingMode` | property, read/write | `property EncodingMode: string read GetEncodingMode write SetEncodingMode;` | | `FirstChunk` | property, read/write | `property FirstChunk: Boolean read GetFirstChunk write SetFirstChunk;` | | `HashAlgorithm` | property, read/write | `property HashAlgorithm: string read GetHashAlgorithm write SetHashAlgorithm;` | | `HavalRounds` | property, read/write | `property HavalRounds: Integer read GetHavalRounds write SetHavalRounds;` | | `HeartbeatMs` | property, read/write | `property HeartbeatMs: Integer read GetHeartbeatMs write SetHeartbeatMs;` | | `IncludeCertChain` | property, read/write | `property IncludeCertChain: Boolean read GetIncludeCertChain write SetIncludeCertChain;` | | `InitialCount` | property, read/write | `property InitialCount: Integer read GetInitialCount write SetInitialCount;` | | `IterationCount` | property, read/write | `property IterationCount: Integer read GetIterationCount write SetIterationCount;` | | `KeyLength` | property, read/write | `property KeyLength: Integer read GetKeyLength write SetKeyLength;` | | `LastChunk` | property, read/write | `property LastChunk: Boolean read GetLastChunk write SetLastChunk;` | | `MacAlgorithm` | property, read/write | `property MacAlgorithm: string read GetMacAlgorithm write SetMacAlgorithm;` | | `NumSignerCerts` | property, read-only | `property NumSignerCerts: Integer read GetNumSignerCerts;` | | `OaepHash` | property, read/write | `property OaepHash: string read GetOaepHash write SetOaepHash;` | | `OaepMgfHash` | property, read/write | `property OaepMgfHash: string read GetOaepMgfHash write SetOaepMgfHash;` | | `OaepPadding` | property, read/write | `property OaepPadding: Boolean read GetOaepPadding write SetOaepPadding;` | | `PaddingScheme` | property, read/write | `property PaddingScheme: Integer read GetPaddingScheme write SetPaddingScheme;` | | `PbesAlgorithm` | property, read/write | `property PbesAlgorithm: string read GetPbesAlgorithm write SetPbesAlgorithm;` | | `PbesPassword` | property, read/write | `property PbesPassword: string read GetPbesPassword write SetPbesPassword;` | | `Pkcs7CryptAlg` | property, read/write | `property Pkcs7CryptAlg: string read GetPkcs7CryptAlg write SetPkcs7CryptAlg;` | | `Rc2EffectiveKeyLength` | property, read/write | `property Rc2EffectiveKeyLength: Integer read GetRc2EffectiveKeyLength write SetRc2EffectiveKeyLength;` | | `SigningAlg` | property, read/write | `property SigningAlg: string read GetSigningAlg write SetSigningAlg;` | | `SigningAttributes` | property, read/write | `property SigningAttributes: string read GetSigningAttributes write SetSigningAttributes;` | | `UncommonOptions` | property, read/write | `property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;` | | `UuFilename` | property, read/write | `property UuFilename: string read GetUuFilename write SetUuFilename;` | | `UuMode` | property, read/write | `property UuMode: string read GetUuMode write SetUuMode;` | | `AddEncryptCert` | method | `// cert is a TCert object. procedure AddEncryptCert(cert: TChilkatBase);` | | `AddPfxSourceBd` | method | `// bd is a TBinData object. function AddPfxSourceBd(bd: TChilkatBase;     const password: string): Boolean;` | | `AddPfxSourceFile` | method | `function AddPfxSourceFile(const pfxFilePath: string;     const pfxPassword: string): Boolean;` | | `AddSigningCert` | method | `// cert is a TCert object. function AddSigningCert(cert: TChilkatBase): Boolean;` | | `AesKeyUnwrap` | method | `function AesKeyUnwrap(const kek: string;     const wrappedKeyData: string;     const encoding: string): string;` | | `AesKeyUnwrapWithPadding` | method | `function AesKeyUnwrapWithPadding(const kek: string;     const wrappedKeyData: string;     const encoding: string): string;` | | `AesKeyWrap` | method | `function AesKeyWrap(const kek: string;     const keyData: string;     const encoding: string): string;` | | `AesKeyWrapWithPadding` | method | `function AesKeyWrapWithPadding(const kek: string;     const keyData: string;     const encoding: string): string;` | | `Argon2DeriveKey` | method | `// bdKey is a TBinData object. function Argon2DeriveKey(const password: string;     const json: string;     bdKey: TChilkatBase): Boolean;` | | `Argon2HashPassword` | method | `function Argon2HashPassword(const password: string;     const json: string): string;` | | `Argon2VerifyPassword` | method | `function Argon2VerifyPassword(const password: string;     const json: string;     const phcHash: string): Integer;` | | `BCryptHash` | method | `function BCryptHash(const password: string): string;` | | `BCryptVerify` | method | `function BCryptVerify(const password: string;     const bcryptHash: string): Boolean;` | | `CkDecryptFile` | method | `function CkDecryptFile(const srcFile: string;     const destFile: string): Boolean;` | | `CkEncryptFile` | method | `function CkEncryptFile(const srcFile: string;     const destFile: string): Boolean;` | | `ClearEncryptCerts` | method | `procedure ClearEncryptCerts;` | | `ClearSigningCerts` | method | `procedure ClearSigningCerts;` | | `CoSign` | method | `// bdIn is a TBinData object. // cert is a TCert object. // bdOut is a TBinData object. function CoSign(bdIn: TChilkatBase;     cert: TChilkatBase;     bdOut: TChilkatBase): Boolean;` | | `CrcBd` | method | `// bd is a TBinData object. function CrcBd(const crcAlg: string;     bd: TChilkatBase): LongWord;` | | `CrcFile` | method | `function CrcFile(const crcAlg: string;     const path: string): LongWord;` | | `CreateP7M` | method | `function CreateP7M(const inFilename: string;     const p7mPath: string): Boolean;` | | `CreateP7S` | method | `function CreateP7S(const inFilename: string;     const p7sPath: string): Boolean;` | | `DecodeString` | method | `function DecodeString(const inStr: string;     const charset: string;     const encoding: string): string;` | | `DecryptBd` | method | `// bd is a TBinData object. function DecryptBd(bd: TChilkatBase): Boolean;` | | `DecryptEncoded` | method | `function DecryptEncoded(const encodedEncryptedData: string): string;` | | `DecryptSb` | method | `// bdIn is a TBinData object. // sbOut is a TStringBuilder object. function DecryptSb(bdIn: TChilkatBase;     sbOut: TChilkatBase): Boolean;` | | `DecryptSecureENC` | method | `// secureStr is a TSecureString object. function DecryptSecureENC(const cipherText: string;     secureStr: TChilkatBase): Boolean;` | | `DecryptStringENC` | method | `function DecryptStringENC(const str: string): string;` | | `EncodeInt` | method | `function EncodeInt(value: Integer;     numBytes: Integer;     littleEndian: Boolean;     const encoding: string): string;` | | `EncodeString` | method | `function EncodeString(const strToEncode: string;     const charsetName: string;     const toEncodingName: string): string;` | | `EncryptBd` | method | `// bd is a TBinData object. function EncryptBd(bd: TChilkatBase): Boolean;` | | `EncryptEncoded` | method | `function EncryptEncoded(const str: string): string;` | | `EncryptSb` | method | `// sbIn is a TStringBuilder object. // bdOut is a TBinData object. function EncryptSb(sbIn: TChilkatBase;     bdOut: TChilkatBase): Boolean;` | | `EncryptSecureENC` | method | `// secureStr is a TSecureString object. function EncryptSecureENC(secureStr: TChilkatBase): string;` | | `EncryptStringENC` | method | `function EncryptStringENC(const str: string): string;` | | `GenerateUuid` | method | `function GenerateUuid: string;` | | `GenRandomBytesENC` | method | `function GenRandomBytesENC(numBytes: Integer): string;` | | `GetEncodedAuthTag` | method | `function GetEncodedAuthTag(const encoding: string): string;` | | `GetEncodedIV` | method | `function GetEncodedIV(const encoding: string): string;` | | `GetLastJsonData` | method | `// json is a TJsonObject object. procedure GetLastJsonData(json: TChilkatBase);` | | `GetSignatureSigningTimeStr` | method | `function GetSignatureSigningTimeStr(index: Integer): string;` | | `GetSignedAttributes` | method | `// pkcs7Der is a TBinData object. // sbJson is a TStringBuilder object. function GetSignedAttributes(signerIndex: Integer;     pkcs7Der: TChilkatBase;     sbJson: TChilkatBase): Boolean;` | | `HashBdENC` | method | `// bd is a TBinData object. function HashBdENC(bd: TChilkatBase): string;` | | `HashBeginString` | method | `function HashBeginString(const strData: string): Boolean;` | | `HashChunkBd` | method | `// bd is a TBinData object. function HashChunkBd(firstChunk: Boolean;     bd: TChilkatBase): Boolean;` | | `HashFileENC` | method | `function HashFileENC(const path: string): string;` | | `HashFinalENC` | method | `function HashFinalENC: string;` | | `HashMoreString` | method | `function HashMoreString(const strData: string): Boolean;` | | `HashStringENC` | method | `function HashStringENC(const str: string): string;` | | `HasSignatureSigningTime` | method | `function HasSignatureSigningTime(index: Integer): Boolean;` | | `Hotp` | method | `function Hotp(const secret: string;     const secretEnc: string;     const counterHex: string;     numDigits: Integer;     truncOffset: Integer;     const hashAlg: string): string;` | | `LastDecryptCert` | method | `// cert is a TCert object. function LastDecryptCert(cert: TChilkatBase): Boolean;` | | `LastSignerCert` | method | `// cert is a TCert object. function LastSignerCert(index: Integer;     cert: TChilkatBase): Boolean;` | | `LoadTaskCaller` | method | `// task is a TTask object. function LoadTaskCaller(task: TChilkatBase): Boolean;` | | `MacBdENC` | method | `// bd is a TBinData object. function MacBdENC(bd: TChilkatBase): string;` | | `MacStringENC` | method | `function MacStringENC(const inText: string): string;` | | `MySqlAesDecrypt` | method | `function MySqlAesDecrypt(const strEncryptedHex: string;     const strPassword: string): string;` | | `MySqlAesEncrypt` | method | `function MySqlAesEncrypt(const strData: string;     const strPassword: string): string;` | | `OpaqueSignBd` | method | `// bd is a TBinData object. function OpaqueSignBd(bd: TChilkatBase): Boolean;` | | `OpaqueSignStringENC` | method | `function OpaqueSignStringENC(const str: string): string;` | | `OpaqueVerifyBd` | method | `// bd is a TBinData object. function OpaqueVerifyBd(bd: TChilkatBase): Boolean;` | | `OpaqueVerifyStringENC` | method | `function OpaqueVerifyStringENC(const p7m: string): string;` | | `Pbkdf1` | method | `function Pbkdf1(const password: string;     const charset: string;     const hashAlg: string;     const salt: string;     iterationCount: Integer;     outputKeyBitLen: Integer;     const encoding: string): string;` | | `Pbkdf2` | method | `function Pbkdf2(const password: string;     const charset: string;     const hashAlg: string;     const salt: string;     iterationCount: Integer;     outputKeyBitLen: Integer;     const encoding: string): string;` | | `RandomizeIV` | method | `procedure RandomizeIV;` | | `ReEncode` | method | `function ReEncode(const encodedData: string;     const fromEncoding: string;     const toEncoding: string): string;` | | `SetDecryptCert` | method | `// cert is a TCert object. function SetDecryptCert(cert: TChilkatBase): Boolean;` | | `SetDecryptCert2` | method | `// cert is a TCert object. // key is a TPrivateKey object. function SetDecryptCert2(cert: TChilkatBase;     key: TChilkatBase): Boolean;` | | `SetEncodedAad` | method | `function SetEncodedAad(const aadStr: string;     const encoding: string): Boolean;` | | `SetEncodedAuthTag` | method | `function SetEncodedAuthTag(const authTagStr: string;     const encoding: string): Boolean;` | | `SetEncodedIV` | method | `procedure SetEncodedIV(const ivStr: string;     const encoding: string);` | | `SetEncodedKey` | method | `procedure SetEncodedKey(const keyStr: string;     const encoding: string);` | | `SetEncodedSalt` | method | `procedure SetEncodedSalt(const saltStr: string;     const encoding: string);` | | `SetEncryptCert` | method | `// cert is a TCert object. function SetEncryptCert(cert: TChilkatBase): Boolean;` | | `SetMacKeyEncoded` | method | `function SetMacKeyEncoded(const key: string;     const encoding: string): Boolean;` | | `SetMacKeyString` | method | `function SetMacKeyString(const key: string): Boolean;` | | `SetSigningCert` | method | `// cert is a TCert object. function SetSigningCert(cert: TChilkatBase): Boolean;` | | `SetSigningCert2` | method | `// cert is a TCert object. // privateKey is a TPrivateKey object. function SetSigningCert2(cert: TChilkatBase;     privateKey: TChilkatBase): Boolean;` | | `SetTsaHttpObj` | method | `// http is a THttp object. procedure SetTsaHttpObj(http: TChilkatBase);` | | `SetVerifyCert` | method | `// cert is a TCert object. function SetVerifyCert(cert: TChilkatBase): Boolean;` | | `SignBdENC` | method | `// dataToSign is a TBinData object. function SignBdENC(dataToSign: TChilkatBase): string;` | | `SignHashENC` | method | `function SignHashENC(const encodedHash: string;     const hashAlg: string;     const hashEncoding: string): string;` | | `SignSbENC` | method | `// sb is a TStringBuilder object. function SignSbENC(sb: TChilkatBase): string;` | | `SignStringENC` | method | `function SignStringENC(const str: string): string;` | | `Totp` | method | `function Totp(const secret: string;     const secretEnc: string;     const t0: string;     const tNow: string;     tStep: Integer;     numDigits: Integer;     truncOffset: Integer;     const hashAlg: string): string;` | | `UseCertVault` | method | `// vault is a TXmlCertVault object. function UseCertVault(vault: TChilkatBase): Boolean;` | | `VerifyBdENC` | method | `// data is a TBinData object. function VerifyBdENC(data: TChilkatBase;     const encodedSig: string): Boolean;` | | `VerifyP7M` | method | `function VerifyP7M(const p7mPath: string;     const destPath: string): Boolean;` | | `VerifyP7S` | method | `function VerifyP7S(const originalDataPath: string;     const p7sPath: string): Boolean;` | | `VerifySbENC` | method | `// sb is a TStringBuilder object. function VerifySbENC(sb: TChilkatBase;     const encodedSig: string): Boolean;` | | `VerifyStringENC` | method | `function VerifyStringENC(const str: string;     const encodedSig: string): Boolean;` | | `XtsSetDataUnitNumber` | method | `procedure XtsSetDataUnitNumber(loUint32: LongWord;     hiUint32: LongWord);` | | `XtsSetEncodedTweakKey` | method | `procedure XtsSetEncodedTweakKey(const key: string;     const encoding: string);` | | `XtsSetEncodedTweakValue` | method | `procedure XtsSetEncodedTweakValue(const tweak: string;     const encoding: string);` | ## Properties ### Crypt2.AbortCurrent `Chilkat 11.7.0 · pascal · Crypt2 · AbortCurrent · property · read/write · since 9.5.0.58` ```pascal property AbortCurrent: Boolean read GetAbortCurrent write SetAbortCurrent; ``` Setting this property to `True` will abort the current method, but only for those methods having an `Async` alternative. The property automatically resets to `False` at the start of each method and after an abort. Both synchronous and asynchronous methods can be aborted; synchronous methods require setting this property from another thread. ### Crypt2.BCryptWorkFactor `Chilkat 11.7.0 · pascal · Crypt2 · BCryptWorkFactor · property · read/write · since 9.5.0.65` ```pascal property BCryptWorkFactor: Integer read GetBCryptWorkFactor write SetBCryptWorkFactor; ``` The BCrypt work factor determines the computational cost of `BCryptHash` and `BCryptVerify` . It represents the base-2 logarithm of the number of hashing rounds. For instance, a work factor of 12 corresponds to 2^12 hashing rounds. This cost factor is designed to make computations challenging enough to deter brute-force attacks. The work factor must be set between 4 and 31, inclusive, with a `default value of 10`. ### Crypt2.BlockSize `Chilkat 11.7.0 · pascal · Crypt2 · BlockSize · property · read-only` ```pascal property BlockSize: Integer read GetBlockSize; ``` This property indicates the block size in bytes for the chosen encryption algorithm. For instance, if the `CryptAlgorithm` is set to `AES`, the BlockSize is automatically set to 16 bytes. In contrast, the block size for the `ChaCha20` streaming algorithm is 1 byte. ### Crypt2.CadesEnabled `Chilkat 11.7.0 · pascal · Crypt2 · CadesEnabled · property · read/write` ```pascal property CadesEnabled: Boolean read GetCadesEnabled write SetCadesEnabled; ``` **Full documentation for this property (same in every language):** [Explaining CAdES-BES Signatures](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/explaining_cades_bes.md) This property applies to all `PKCS7` signature creation methods. When set to `True`, it ensures the inclusion of required attributes (such as `content-type`, `message-digest`, and `signing-certificate-v2`) to qualify the signature as at least a `CAdES-BES` signature. By default, this property is set to `False`. ### Crypt2.CadesSigPolicyHash `Chilkat 11.7.0 · pascal · Crypt2 · CadesSigPolicyHash · property · read/write` ```pascal property CadesSigPolicyHash: string read GetCadesSigPolicyHash write SetCadesSigPolicyHash; ``` **Full documentation for this property (same in every language):** [CAdES Signature Policy - Meaning and Purpose](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/cades_signature_policy.md) This property is for PKCS7 CMS signatures that wish to include CAdES `signature policy attributes`. Set it to the `base64`-encoded hash of the policy document at the `CadesSigPolicyUri` using either `SHA256` or `SHA1`. See also: - [Online Tool to Hash a Document at a URL](https://tools.chilkat.io/hashFileAtUrl.cshtml) ### Crypt2.CadesSigPolicyId `Chilkat 11.7.0 · pascal · Crypt2 · CadesSigPolicyId · property · read/write` ```pascal property CadesSigPolicyId: string read GetCadesSigPolicyId write SetCadesSigPolicyId; ``` **Full documentation for this property (same in every language):** [CAdES Signature Policy - Meaning and Purpose](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/cades_signature_policy.md) This property is for PKCS7 CMS signatures that wish to include CAdES `signature policy attributes`. The `CAdES Signature Policy ID` is an object identifier (`OID`) included in a CAdES signature that specifies the exact signature policy the signer followed. It is the OID associated with the policy URL. An example OID would look like this: `2.16.840.1.101.3.2.1.48.1` An application that wishes to include signature policy attributes should set all three properties: `CadesSigPolicyHash` , `CadesSigPolicyUri` , and `CadesSigPolicyId` . ### Crypt2.CadesSigPolicyUri `Chilkat 11.7.0 · pascal · Crypt2 · CadesSigPolicyUri · property · read/write` ```pascal property CadesSigPolicyUri: string read GetCadesSigPolicyUri write SetCadesSigPolicyUri; ``` **Full documentation for this property (same in every language):** [CAdES Signature Policy - Meaning and Purpose](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/cades_signature_policy.md) This property is for PKCS7 CMS signatures that wish to include CAdES `signature policy attributes`. The `signature policy URI` in a `CAdES` digital signature is a link that points to a document describing the rules and conditions under which the signature was created. Typically the Signature Policy URI in a CAdES signature points to a `.der` file, not a PDF or human-readable document. For example: `http://example.com/policies/my-policy.der` ### Crypt2.Charset `Chilkat 11.7.0 · pascal · Crypt2 · Charset · property · read/write` ```pascal property Charset: string read GetCharset write SetCharset; ``` **Full documentation for this property (same in every language):** [Charset Matters when Encrypting Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_when_encrypting_text.md) · [Charset Matters when Hashing Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/hashing_text.md) · [Character Encodings (Charsets) Supported by Chilkat](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charsets_supported_by_chilkat.md) · [ANSI Charset Explained](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/ansi_charset_explained.md) This property specifies the character encoding used to represent text as bytes for encryption and hashing. By default, it uses the computer's `ANSI` charset, such as `Windows-1252` for locales like the United States, United Kingdom, Western Europe, Australia, and New Zealand. Most applications are **advised to set this property** to `UTF-8`. Chilkat plans to change its default to UTF-8 in a future major version to align with current standards. The current default of ANSI stems from a time when UTF-8 was not widely adopted. ### Crypt2.CipherMode `Chilkat 11.7.0 · pascal · Crypt2 · CipherMode · property · read/write` ```pascal property CipherMode: string read GetCipherMode write SetCipherMode; ``` **Full documentation for this property (same in every language):** [More About Block Encryption Cipher Modes](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/block_encryption_cipher_modes.md) Sets the `cipher mode` for **block encryption algorithms** (AES, Blowfish,TwoFish, DES, 3DES, RC2). Possible values are `CBC` (the default) , `ECB`, `CTR`, `OFB`, `GCM`, and `CFB`. These acronyms have the following meanings: - `CBC`: Cipher Block Chaining, - `ECB`: Electronic CookBook - `CTR`: Counter Mode - `CFB`: Cipher Feedback - `OFB`: Output Feedback - `GCM`: Galois/Counter Mode - `XTS`: AES-XTS (starting in Chilkat v9.5.0.91, only works with AES encryption) The `GCM` (Galois/Counter Mode) is available with any cipher having a 16-byte block size, such as AES. The CFB, OFB, CTR, and GCM modes convert block ciphers into stream ciphers. In these modes of operation, the `PaddingScheme` property is unused because no padding occurs. **Starting in v9.5.0.91** Chilkat supports `AES-XTS` mode. XTS mode additionally uses a tweak key and tweak value, which are set via the `XtsSetEncodedTweakKey`, `XtsSetEncodedTweakValue`, and `XtsSetDataUnitNumber`. (The latter two functions provide alternative means of setting the tweak value.) Chilkat fully supports AES-XTS mode with `ciphertext-stealing`, which means it will correctly encrypt/decrypt data with size not divisible by the block size (i.e. divisible by 16 bytes). ### Crypt2.CmsOptions `Chilkat 11.7.0 · pascal · Crypt2 · CmsOptions · property · read/write · since 9.5.0.78` ```pascal property CmsOptions: string read GetCmsOptions write SetCmsOptions; ``` **Full documentation for this property (same in every language):** [Algorithm Identifier ASN.1 Structure](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/algorithm_identifier_asn1.md) · [CMS (PKCS7) signed-data Constructed Octets](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/cms_signed_data_constructed_octets.md) · [Egypt ITIDA CMS Signatures with JSON Canonicalization](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/egypt_itida_cms_signatures.md) A JSON string to manage additional CMS (PKCS7) signature and validation options. Possible options are: - boolean `OmitAlgorithmIdNull`: Set this JSON member to `true` to omit the explicit NULL within an AlgorithmIdentifier ASN.1 within the PKCS7. This should almost never be used, but helps for rare cases where a validator dislikes the explicit NULL being present. - boolean `ValidateTimestampTokens`: Tells Chilkat to also validate the timestamp tokens when validating a signature that includes a timestamp. - boolean `ConstructedOctets`: When set to `true`, tells Chilkat to use the `ASN.1 constructed octets` format for the data contained in the CMS (PKCS7) signed-data. - boolean `CanonicalizeITIDA`: This applies to `Egypt ITIDA`, which requires signed documents in a CAdES-BES CMS format, using ITIDA’s JSON canonicalization (for JSON payloads), with only the Base64‑encoded signature attached - not the original data itself. When set to `true`, Chilkat will `automatically do the special ITIDA JSON canonicalization`. ### Crypt2.CryptAlgorithm `Chilkat 11.7.0 · pascal · Crypt2 · CryptAlgorithm · property · read/write` ```pascal property CryptAlgorithm: string read GetCryptAlgorithm write SetCryptAlgorithm; ``` **Full documentation for this property (same in every language):** [Explaining PBES2 Encryption](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/explaining_pbes2_encryption.md) Selects the encryption algorithm for encrypting and decrypting. Possible values are: | Algorithm | Type | Symmetric? | Key Size(s) | Block/Stream | Mode of Operation | Notes | | --- | --- | --- | --- | --- | --- | --- | | `aes` | Block cipher | ✔ Yes | 128, 192, 256 bits | Block (128-bit) | CBC, CTR, GCM, etc. | Widely used, FIPS-approved | | `pki` (Public-Key Encryption) | Asymmetric | ✗ No | 1024–4096+ bits | N/A | N/A | Used for key exchange, not bulk data | | `chacha20` | Stream cipher | ✔ Yes | 256 bits | Stream | N/A | High speed, secure, designed for simplicity | | `des` | Block cipher | ✔ Yes | 56 bits | Block (64-bit) | ECB, CBC, etc. | Deprecated, insecure | | `3des` | Block cipher | ✔ Yes | 112 or 168 bits | Block (64-bit) | ECB, CBC, etc. | Legacy use, weak by modern standards | | `rc2` | Block cipher | ✔ Yes | 40–128 bits (variable) | Block (64-bit) | ECB, CBC, etc. | Obsolete, variable strength | | `blowfish2` (Blowfish) | Block cipher | ✔ Yes | 32–448 bits (variable) | Block (64-bit) | ECB, CBC, etc. | Fast, but 64-bit block size is a limitation | | `twofish` | Block cipher | ✔ Yes | Up to 256 bits | Block (128-bit) | ECB, CBC, etc. | AES finalist, secure and flexible | | `pbes1` | Key derivation | ✔ Yes | Based on underlying cipher | Block (varies) | PKCS#5 v1.5 | Obsolete, uses DES/RC2 | | `pbes2` | Key derivation | ✔ Yes | Based on underlying cipher | Block (varies) | PKCS#5 v2.0 | Modern, supports AES, SHA, etc. | | `arc4` (RC4) | Stream cipher | ✔ Yes | 40–2048 bits (variable) | Stream | N/A | Deprecated, insecure due to biases | See also: - [Explaining PCKS7/CMS Encryption vs RSA Encryption](https://cknotes.com/pkcs7-cms-encryption-vs-rsa-encryption/) ### Crypt2.EncodingMode `Chilkat 11.7.0 · pascal · Crypt2 · EncodingMode · property · read/write` ```pascal property EncodingMode: string read GetEncodingMode write SetEncodingMode; ``` **Full documentation for this property (same in every language):** [Binary Encodings Supported by Chilkat](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) The EncodingMode property specifies the `binary encoding` format (e.g., `base64`, `hex`, `base58`, `base64url`) used by functions ending in `"ENC"`, like `EncryptStringENC` and `DecryptStringENC`. For encryption functions, EncodingMode determines the encoding of the output. For decryption functions, it specifies the encoding of the input data. A `list of supported binary encodings` is available at the link below. The default value is `base64` ### Crypt2.FirstChunk `Chilkat 11.7.0 · pascal · Crypt2 · FirstChunk · property · read/write` ```pascal property FirstChunk: Boolean read GetFirstChunk write SetFirstChunk; ``` Using the `FirstChunk` and `LastChunk` properties is the way to do streaming encryption or decryption with Chilkat. By default, both FirstChunk and LastChunk are set to `True`, indicating that the data passed to the encryption or decryption method is the full amount. To process data in multiple chunks, adjust these settings as follows: 1\. For the first chunk, set FirstChunk = `True` and LastChunk = `False`. 2\. For intermediate chunks, set both FirstChunk = `False` and LastChunk = `False`. 3\. For the final chunk, set FirstChunk = `False` and LastChunk = `True`. You can feed data chunks of any size, regardless of the encryption algorithm's block size (e.g., 16 bytes for AES). Chilkat will handle buffering and, upon receiving the final chunk, pad the output to the appropriate block size according to the selected `PaddingScheme`. ### Crypt2.HashAlgorithm `Chilkat 11.7.0 · pascal · Crypt2 · HashAlgorithm · property · read/write` ```pascal property HashAlgorithm: string read GetHashAlgorithm write SetHashAlgorithm; ``` Selects the hash algorithm used by methods that create hashes. The valid choices are `sha256`, `sha384`, `sha512`, `sha3-224`, `sha3-256`, `sha3-384`, `sha3-512`, `sha1`, `md2`, `md5`, `haval`, `ripemd128`, `ripemd160`,`ripemd256`, or `ripemd320`. (Chilkat supports `SHA-2` because it includes the SHA-256, SHA-384, and SHA-512 hash functions.) **The default value is `sha256`.** Note: The HAVAL hash algorithm is affected by two other properties: `HavalRounds` and `KeyLength` . - The HavalRounds may have values of 3, 4, or 5. - For HAVAL hashing, the KeyLength can be 128, 160, 192, 224, or 256. ### Crypt2.HavalRounds `Chilkat 11.7.0 · pascal · Crypt2 · HavalRounds · property · read/write` ```pascal property HavalRounds: Integer read GetHavalRounds write SetHavalRounds; ``` Applies to the HAVAL hash algorithm only and must be set to the integer value 3, 4, or 5. The default value is 3. ### Crypt2.HeartbeatMs `Chilkat 11.7.0 · pascal · Crypt2 · HeartbeatMs · property · read/write` ```pascal property HeartbeatMs: Integer read GetHeartbeatMs write SetHeartbeatMs; ``` **Full documentation for this property (same in every language):** [Event Callback Examples](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/event_callback_examples.md) The interval in milliseconds between each `AbortCheck` event callback, which enables an application to abort certain method calls before they complete. **By default, HeartbeatMs is set to** `0`**, meaning no AbortCheck event callbacks will trigger.** Methods with event callbacks include: `CkDecryptFile` , `CkEncryptFile` , `HashFile` , and `HashFileENC` . ### Crypt2.IncludeCertChain `Chilkat 11.7.0 · pascal · Crypt2 · IncludeCertChain · property · read/write` ```pascal property IncludeCertChain: Boolean read GetIncludeCertChain write SetIncludeCertChain; ``` This applies only to creating digital signatures. By default (`True`), any additional certificates in the authentication chain are included in the PKCS7 digital signature. ### Crypt2.InitialCount `Chilkat 11.7.0 · pascal · Crypt2 · InitialCount · property · read/write · since 9.5.0.55` ```pascal property InitialCount: Integer read GetInitialCount write SetInitialCount; ``` The initial counter for the `ChaCha20` encryption algorithm, which has a default value of 0, is pre-agreed by both the encryptor and decryptor. ### Crypt2.IterationCount `Chilkat 11.7.0 · pascal · Crypt2 · IterationCount · property · read/write` ```pascal property IterationCount: Integer read GetIterationCount write SetIterationCount; ``` The iteration count in password-based encryption (PBE) establishes the computational difficulty for encryption and decryption, thereby enhancing resistance to exhaustive search attacks. The default iteration count is `1024`, which is considered low, so it is recommended that applications increase this number when using `pbes2` encryption. **PBES2 Iteration Count Recommendation**s Aim for a **100–200 ms** derive time on your target hardware. - Server/Desktop: `100000 – 1000000+` - Mobile/Embedded: `50000 - 100000` Benchmark annually and increase iterations as hardware improves. ### Crypt2.KeyLength `Chilkat 11.7.0 · pascal · Crypt2 · KeyLength · property · read/write` ```pascal property KeyLength: Integer read GetKeyLength write SetKeyLength; ``` The key length `in bits` for symmetric encryption algorithms. The default value is `256`. ### Crypt2.LastChunk `Chilkat 11.7.0 · pascal · Crypt2 · LastChunk · property · read/write` ```pascal property LastChunk: Boolean read GetLastChunk write SetLastChunk; ``` See the documentation for the `FirstChunk` property. ### Crypt2.MacAlgorithm `Chilkat 11.7.0 · pascal · Crypt2 · MacAlgorithm · property · read/write · since 9.5.0.55` ```pascal property MacAlgorithm: string read GetMacAlgorithm write SetMacAlgorithm; ``` Selects the MAC algorithm to be used for any of the Mac methods, such as MacStringENC, MacBytes, etc. The default value is `hmac`. Possible values are `hmac` and `poly1305`. ### Crypt2.NumSignerCerts `Chilkat 11.7.0 · pascal · Crypt2 · NumSignerCerts · property · read-only` ```pascal property NumSignerCerts: Integer read GetNumSignerCerts; ``` This property is set upon verifying a digital signature and indicates the number of signer certificates. You can retrieve each signing certificate using the `LastSignerCert` method with an index ranging from `0` to `NumSignerCerts`-1. ### Crypt2.OaepHash `Chilkat 11.7.0 · pascal · Crypt2 · OaepHash · property · read/write · since 9.5.0.67` ```pascal property OaepHash: string read GetOaepHash write SetOaepHash; ``` Selects the hash algorithm for use within OAEP padding when encrypting using `pki` with RSAES-OAEP. The valid choices are `sha1`, `sha256`, `sha384`, `sha512`, The default value is `sha256` ### Crypt2.OaepMgfHash `Chilkat 11.7.0 · pascal · Crypt2 · OaepMgfHash · property · read/write · since 9.5.0.71` ```pascal property OaepMgfHash: string read GetOaepMgfHash write SetOaepMgfHash; ``` Selects the MGF hash algorithm for use within OAEP padding when encrypting using `pki` with RSAES-OAEP. The valid choices are `sha1`, `sha256`, `sha384`, `sha512`, The default is `sha256`. ### Crypt2.OaepPadding `Chilkat 11.7.0 · pascal · Crypt2 · OaepPadding · property · read/write · since 9.5.0.67` ```pascal property OaepPadding: Boolean read GetOaepPadding write SetOaepPadding; ``` Selects the RSA encryption scheme when encrypting using `pki` (with a certificate and private key). The default value is `False`, which selects RSAES_PKCS1-V1_5. If set to `True`, then RSAES_OAEP is used. ### Crypt2.PaddingScheme `Chilkat 11.7.0 · pascal · Crypt2 · PaddingScheme · property · read/write` ```pascal property PaddingScheme: Integer read GetPaddingScheme write SetPaddingScheme; ``` **Full documentation for this property (same in every language):** [Debugging Symmetric Encryption such as AES](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/tweet_debug_symmetric_encryption_aes.md) This property defines the padding scheme Chilkat uses for adding padding to input data during encryption and removing it during decryption. It is applicable only to symmetric block ciphers, such as AES, Blowfish, and Twofish, which require input sizes matching their exact block size. Padding ensures the last block is completely filled. The possible values are: 0. **PKCS#5/PKCS#7 (RFC 1423)** `default` *Each pad byte = number of padding bytes.* Block size: 8 Data: "HELLO" (5 bytes) Padding: 0x03 0x03 0x03 1. **FIPS 81** *Last byte = count; others = random.* Block size: 8 Data: "HELLO" Padding: 0xA4 0x2F 0x9C 0x03 2. **Random** *All pad bytes random; decryptor must know original length.* Block size: 8 Data: "HELLO" Padding: 0x7D 0x20 0xCB 0x81 3. **Null (0x00)** *Pad with zeros; no padding if already exact.* Block size: 8 Data: "HEL" (3 bytes) Padding: 0x00 0x00 0x00 0x00 0x00 4. **Space (0x20)** *Pad with spaces; no padding if already exact.* Block size: 8 Data: "HEL" (3 bytes) Padding: 0x20 0x20 0x20 0x20 0x20 ### Crypt2.PbesAlgorithm `Chilkat 11.7.0 · pascal · Crypt2 · PbesAlgorithm · property · read/write` ```pascal property PbesAlgorithm: string read GetPbesAlgorithm write SetPbesAlgorithm; ``` If the `CryptAlgorithm` property is set to `pbes1` or `pbes2`, this property defines the symmetric encryption algorithm to be used for password-based encryption (PBE). The default is `"des"`. Applications should set this property equal to `"aes"`. ### Crypt2.PbesPassword `Chilkat 11.7.0 · pascal · Crypt2 · PbesPassword · property · read/write` ```pascal property PbesPassword: string read GetPbesPassword write SetPbesPassword; ``` The password to be used when the `CryptAlgorithm` is `"pbes1"` or `"pbes2"`. ### Crypt2.Pkcs7CryptAlg `Chilkat 11.7.0 · pascal · Crypt2 · Pkcs7CryptAlg · property · read/write` ```pascal property Pkcs7CryptAlg: string read GetPkcs7CryptAlg write SetPkcs7CryptAlg; ``` This property determines the underlying symmetric encryption algorithm when the `CryptAlgorithm` property is set to `pki` for selecting PKCS7 public-key encryption. The default is `aes`. ### Crypt2.Rc2EffectiveKeyLength `Chilkat 11.7.0 · pascal · Crypt2 · Rc2EffectiveKeyLength · property · read/write` ```pascal property Rc2EffectiveKeyLength: Integer read GetRc2EffectiveKeyLength write SetRc2EffectiveKeyLength; ``` The effective key length (in bits) for the `RC2` encryption algorithm. When using RC2, set both the `KeyLength` and Rc2EffectiveKeyLength properties to values between 8 and 1024, inclusive. The default setting for both is 128. The default value is `128` RC2 is an old symmetric encryption algorithm, now considered insecure due to its small key size and vulnerability to cryptanalysis. Modern algorithms like AES are recommended instead. ### Crypt2.SigningAlg `Chilkat 11.7.0 · pascal · Crypt2 · SigningAlg · property · read/write · since 9.5.0.67` ```pascal property SigningAlg: string read GetSigningAlg write SetSigningAlg; ``` This property applies when creating RSA signatures. It defines the `RSA signature scheme`. The default is `PKCS1-v1_5`. You can change it to `RSASSA-PSS` (or `pss`) to use the RSASSA-PSS signature scheme. 1. **PKCS#1 v1.5** *Older, deterministic scheme.* \- Simple padding. \- Vulnerable to certain attacks if not used carefully. \- Still widely used for compatibility. 2. **RSASSA-PSS** *Newer, probabilistic scheme (recommended by modern standards).* \- Adds random salt for each signature. \- More secure against chosen-plaintext and padding oracle attacks. \- Recommended by modern standards like PKCS#1 v2.1 and FIPS. ### Crypt2.SigningAttributes `Chilkat 11.7.0 · pascal · Crypt2 · SigningAttributes · property · read/write · since 9.5.0.75` ```pascal property SigningAttributes: string read GetSigningAttributes write SetSigningAttributes; ``` Contains JSON to specify the authenticated (signed) attributes or unauthenticated (unsigned) attributes that are to be included in CMS signatures. The default value is: ``` { "contentType": true, "signingTime": true, "messageDigest": true } ``` ### Crypt2.UncommonOptions `Chilkat 11.7.0 · pascal · Crypt2 · UncommonOptions · property · read/write · since 9.5.0.83` ```pascal property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions; ``` This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty. Can be set to a list of the following comma separated keywords: - `UseConstructedOctets` - Introduced in v9.5.0.83. When creating opaque CMS signatures (signatures that embed the data being signed), will use the `constructed octets` form of the ASN.1 that holds the data. This is to satify some validators that are brittle/fragile/picky and require a particular format, such as for the ICP-Brazil Digital Signature Standard. ### Crypt2.UuFilename `Chilkat 11.7.0 · pascal · Crypt2 · UuFilename · property · read/write` ```pascal property UuFilename: string read GetUuFilename write SetUuFilename; ``` When UU encoding, this is the filename to be embedded in UU encoded output. The default is `file.dat`. When UU decoding, this is the filename found in the UU encoded input. ### Crypt2.UuMode `Chilkat 11.7.0 · pascal · Crypt2 · UuMode · property · read/write` ```pascal property UuMode: string read GetUuMode write SetUuMode; ``` When UU encoding, this is the file permissions mode to be embedded in UU encoded output. The default is `644`. When UU decoding, this property is set to the mode found in the UU encoded input. ## Methods ### Crypt2.AddEncryptCert `Chilkat 11.7.0 · pascal · Crypt2 · AddEncryptCert · method` ```pascal // cert is a TCert object. procedure AddEncryptCert(cert: TChilkatBase); ``` **Full documentation for this method (same in every language):** [Public Key Encryption to Multiple Recipients](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/public_key_encryption_to_multiple_recipients.md) · [Explaining PKCS#7 Enveloped Data](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_enveloped_data.md) Adds a certificate for public-key encryption. To enable public-key encryption with digital certificates, set the `CryptAlgorithm` property to `pki`. Call `AddEncryptCert` separately for each certificate you wish to use for encryption. Any of the `Encrypt*` methods will do `RSA public-key encryption` when the `CryptAlgorithm` is set to the keyword `pki`. The output is a `PKCS#7 enveloped-data` secure container. ### Crypt2.AddPfxSourceBd `Chilkat 11.7.0 · pascal · Crypt2 · AddPfxSourceBd · method · since 11.0.0` ```pascal // bd is a TBinData object. function AddPfxSourceBd(bd: TChilkatBase;     const password: string): Boolean; ``` Adds a `PFX` file to the object's list of sources for locating certificates and private keys during public-key decryption or signing. To add multiple PFX sources, call this method multiple times. `bd` should contain the bytes of a PFX file (also known as `PKCS12` or `.p12`). **Note:** Information about the certificate(s) needed for `public-key decryption` are included in the `PKCS#7 enveloped-data`. Chilkat will automatically find a usable certificate and private key from sources like Windows certificate stores, the Apple keychain, or other sources provided by the application. Returns True for success, False for failure. ### Crypt2.AddPfxSourceFile `Chilkat 11.7.0 · pascal · Crypt2 · AddPfxSourceFile · method` ```pascal function AddPfxSourceFile(const pfxFilePath: string;     const pfxPassword: string): Boolean; ``` Adds a `PFX` file to the object's list of sources for locating certificates and private keys during public-key decryption or signing. To add multiple PFX sources, call this method multiple times. **Note:** Information about the certificate(s) needed for `public-key decryption` are included in the `PKCS#7 enveloped-data`. Chilkat will automatically find a usable certificate and private key from sources like Windows certificate stores, the Apple keychain, or other sources provided by the application. Returns True for success, False for failure. ### Crypt2.AddSigningCert `Chilkat 11.7.0 · pascal · Crypt2 · AddSigningCert · method · since 9.5.0.83` ```pascal // cert is a TCert object. function AddSigningCert(cert: TChilkatBase): Boolean; ``` **Full documentation for this method (same in every language):** [PKCS#7 signed-data with Multiple Signers](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_multiple_signers.md) Call this method once per certificate to add `multiple certificates for signing`. If signing with a single certificate, then the `SetSigningCert` or `SetSigningCert2` methods can be used instead. Returns True for success, False for failure. ### Crypt2.AesKeyUnwrap `Chilkat 11.7.0 · pascal · Crypt2 · AesKeyUnwrap · method · since 9.5.0.66` ```pascal function AesKeyUnwrap(const kek: string;     const wrappedKeyData: string;     const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Explaining AES Key Wrap With Padding vs Without Padding](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/aes_key_wrap_with_padding_vs_no_padding.md) Implements the `AES Key Wrap Algorithm` (RFC 3394) for unwrapping. The `kek` is the `Key Encryption Key` (the AES key used to unwrap the `wrappedKeyData`). The arguments and return value are binary encoded strings using the encoding specified by `encoding` (which can be `base64`, `hex`, `base64url`, etc.) The full list of supported encodings is available at the link below. The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex). The `wrappedKeyData` contains the data to be unwrapped. The result, if decoded, is 8 bytes less than the wrapped key data. For example, if a 256-bit AES key (32 bytes) is wrapped, the size of the wrapped key data is 40 bytes. Unwrapping restores it to the original 32 bytes. Returns True for success, False for failure. ### Crypt2.AesKeyUnwrapWithPadding `Chilkat 11.7.0 · pascal · Crypt2 · AesKeyUnwrapWithPadding · method · since 9.5.0.96` ```pascal function AesKeyUnwrapWithPadding(const kek: string;     const wrappedKeyData: string;     const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Explaining AES Key Wrap With Padding vs Without Padding](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/aes_key_wrap_with_padding_vs_no_padding.md) Implements the `AES Key Wrap with Padding Algorithm` (RFC 5649) for unwrapping. The `kek` is the `Key Encryption Key` (the AES key used to unwrap the `wrappedKeyData`). The arguments and return value are binary encoded strings using the encoding specified by `encoding` (which can be `base64`, `hex`, `base64url`, etc.) The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex). The `wrappedKeyData` contains the data to be unwrapped. The unwrapped key is returned as an encoded string (using the encoding specified in `encoding`). Returns True for success, False for failure. ### Crypt2.AesKeyWrap `Chilkat 11.7.0 · pascal · Crypt2 · AesKeyWrap · method · since 9.5.0.66` ```pascal function AesKeyWrap(const kek: string;     const keyData: string;     const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Explaining AES Key Wrap With Padding vs Without Padding](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/aes_key_wrap_with_padding_vs_no_padding.md) Implements the `AES Key Wrap Algorithm` (RFC 3394). The `kek` is the `Key Encryption Key` (the AES key used to encrypt the `keyData`). The arguments and return value are binary encoded strings using the encoding specified by `encoding` (which can be `base64`, `hex`, `base64url`, etc.) The full list of supported encodings is available at the link below. The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex). The `keyData` contains the data to be key wrapped. It must be a multiple of 64-bits in length. In other words, if the `keyData` is decoded to binary, it should be a number of bytes that is a multiple of 8. The return string, if decoded to binary bytes, is equal to the size of the key data + 8 additional bytes. Returns True for success, False for failure. ### Crypt2.AesKeyWrapWithPadding `Chilkat 11.7.0 · pascal · Crypt2 · AesKeyWrapWithPadding · method · since 9.5.0.96` ```pascal function AesKeyWrapWithPadding(const kek: string;     const keyData: string;     const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Explaining AES Key Wrap With Padding vs Without Padding](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/aes_key_wrap_with_padding_vs_no_padding.md) Implements the `AES Key Wrap with Padding Algorithm` (RFC 5649). The `kek` is the `Key Encryption Key` (the AES key used to encrypt the `keyData`). The arguments and return value are binary encoded strings using the encoding specified by `encoding` (which can be `base64`, `hex`, `base64url`, etc.) The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192- bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex). The `keyData` contains the data to be key wrapped. Returns the wrapped key using the encoding specified in `encoding`. Returns True for success, False for failure. ### Crypt2.Argon2DeriveKey `Chilkat 11.7.0 · pascal · Crypt2 · Argon2DeriveKey · method · since 11.6.0` ```pascal // bdKey is a TBinData object. function Argon2DeriveKey(const password: string;     const json: string;     bdKey: TChilkatBase): Boolean; ``` Derives a key from a password using **Argon2**, the memory-hard key derivation function specified in RFC 9106. Argon2 is deliberately expensive in both CPU time and memory, which is what makes a brute-force search of the password space costly. `password` is the password. `json` is a JSON string containing the Argon2 options (described below). The derived key is returned in `bdKey`, which is cleared before the derived key is stored in it. A `salt` member is **required** in `json`. There is no default, because a key derivation salt is chosen and stored by the application. Use `GenRandomBytesENC` to generate one. Every other member is optional. Passing an empty string for `json` is the same as passing `{}` and would fail only because no salt was given. The JSON is validated strictly before it is used, so malformed JSON is rejected rather than partially applied. It must be a single JSON object, and every member value must be a simple value (string, number, `true`, `false` or `null`) -- no Argon2 member takes an object or an array. Member names are matched exactly, and any member not listed below is an **error** rather than something ignored. A member given twice, or a member given together with its short alias, is also an error, because which one would win is ambiguous. All of this is deliberate. A misspelled name such as `iteration`, a miscapitalized one such as `memoryCostKB`, or a single missing comma would otherwise be discarded in silence and the default used in its place. For a cost parameter that is a silent downgrade, and it produces a hash that looks perfectly valid, so nothing downstream would catch it. The specific problem is reported in the `LastErrorText`. - `variant` - `argon2id` (the default), `argon2i`, or `argon2d`. Use `argon2id` unless there is a specific reason not to: it combines Argon2i's resistance to side-channel attacks with Argon2d's resistance to time-memory tradeoff attacks. - `version` - `19` (the default, 0x13) or `16` (0x10). Only set `16` to reproduce a hash made by an old implementation. - `iterations` - the number of passes over memory, called `t` in RFC 9106. Must be at least 1. Defaults to `3`. - `memoryCostKb` - the amount of memory used, in KB, called `m` in RFC 9106. Must be at least 8 times `parallelism`. Defaults to `65536` (64 MB). This is the parameter that does the most to make an attack expensive. - `parallelism` - the number of lanes, called `p` in RFC 9106. Defaults to `1`. Changing it changes the derived key. Chilkat computes all lanes on the calling thread, so raising it does not make the computation faster. - `keyLen` - the length of the derived key in bytes. Must be between 4 and 1048576. Defaults to `32`. - `salt` - the salt, which must be at least 8 bytes. 16 random bytes is the usual choice. - `secret` - the optional secret value `K` of RFC 9106, often called a `pepper`: a key held by the application and **not** stored alongside the hash, so that a stolen database of hashes cannot be attacked without it. - `ad` - the optional associated data `X` of RFC 9106: additional non-secret data bound into the derivation. - `encoding` - how the `salt`, `secret` and `ad` members are encoded. Defaults to `base64`. May be any encoding Chilkat supports, such as `hex`, or `utf-8` to use the characters of the member itself as the bytes. - `saltEncoding`, `secretEncoding`, `adEncoding` - override `encoding` for one member. - `passwordCharset` - the character encoding the password is converted to before use. Defaults to `utf-8`. If set to `hex` or `base64`, `password` is instead treated as encoded binary and decoded, exactly as for the charset argument of `Pbkdf2`. - `maxMemoryKb` - refuses to allocate more than this many KB. This is not an Argon2 parameter; it is a guard so that an unreasonable `memoryCostKb` cannot exhaust memory. Defaults to `2097152` (2 GB). The short names used in RFC 9106 and in PHC hash strings are accepted as aliases: `t` for `iterations`, `m` for `memoryCostKb`, `p` for `parallelism`, and `v` for `version`. This means the parameters of an existing hash string such as `$argon2id$v=19$m=65536,t=3,p=1$...` can be transcribed directly. For example, to derive a 32-byte key: `{ "iterations": 3, "memoryCostKb": 65536, "parallelism": 1, "keyLen": 32, "salt": "cmFuZG9tc2FsdDEyMzQ=" }` To hash a password for storage, use `Argon2HashPassword` instead, which generates a random salt and returns a self-describing string. Returns True for success, False for failure. ### Crypt2.Argon2HashPassword `Chilkat 11.7.0 · pascal · Crypt2 · Argon2HashPassword · method · since 11.6.0` ```pascal function Argon2HashPassword(const password: string;     const json: string): string; ``` Hashes a password using **Argon2** (RFC 9106) and returns the result as a PHC format string, such as `$argon2id$v=19$m=65536,t=3,p=1$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM` The string records the variant, version, memory cost, iterations, parallelism, salt and hash, so it is everything needed to verify the password later with `Argon2VerifyPassword`. Store the whole string. `password` is the password. `json` is a JSON string containing the Argon2 options, which are the same members documented for `Argon2DeriveKey`, with one difference: **the salt is optional here**. As with all of the Argon2 methods, an unrecognized member name is an error. When no `salt` member is present, a cryptographically random salt is generated for this hash, which is what should normally happen. A `saltLen` member (default `16`, allowed range 8 to 1024) sets how many random bytes to generate. Passing an empty string for `json` uses all defaults: Argon2id, version 19, 3 iterations, 64 MB of memory, 1 lane, a 32-byte hash and a 16-byte random salt. Note that if a `secret` (pepper) or `ad` is used, it is **not** stored in the returned string. The same value must be supplied to `Argon2VerifyPassword` for the password to verify. Returns True for success, False for failure. ### Crypt2.Argon2VerifyPassword `Chilkat 11.7.0 · pascal · Crypt2 · Argon2VerifyPassword · method · since 11.6.0` ```pascal function Argon2VerifyPassword(const password: string;     const json: string;     const phcHash: string): Integer; ``` Verifies `password` against a PHC format Argon2 hash string previously produced by `Argon2HashPassword` (or by any other RFC 9106 implementation). Returns one of three values: - `1` - the password matched. - `0` - the password did not match. - `-1` - the verification could not be performed at all: `phcHash` was not a valid Argon2 hash string, its parameters were out of range, or an internal failure occurred. The reason is written to the `LastErrorText`. Test for a match with `== 1`, never for `!= 0`, so that an unusable hash string is not mistaken for a successful login. The variant, version, memory cost, iterations, parallelism, salt and hash length are all read from `phcHash`, so none of the Argon2 cost options need to be supplied. Pass an empty string for `json` unless the hash was created with a `secret` (pepper) or `ad`, in which case `json` must contain the same values that were used to create it. Only the `secret`, `ad`, `encoding`, `passwordCharset` and `maxMemoryKb` members of `json` are used; everything else is ignored. The other documented members are still accepted here, so that one JSON string can be shared between hashing and verifying, but an unrecognized member name is an error. A return of `0` and a return of `-1` call for different handling. `0` is a normal failed login attempt. `-1` means the stored hash itself is unusable, which is a data or configuration problem rather than a bad password, and is worth logging or alerting on separately. The `maxMemoryKb` member is worth setting when the hash strings come from an untrusted source. The memory cost is taken from `phcHash`, so a hash claiming an enormous `m` would otherwise cause a very large allocation. It defaults to 2 GB and is checked before any memory is allocated. ### Crypt2.BCryptHash `Chilkat 11.7.0 · pascal · Crypt2 · BCryptHash · method · since 9.5.0.65` ```pascal function BCryptHash(const password: string): string; ``` Computes and returns a bcrypt hash of the `password`. The number of rounds of hashing is determined by the `BCryptWorkFactor` property. Starting in v9.5.0.76, if the `password` is prefixed with `$2b$` then the output will use the $2b version of bcrypt. For example, to create a `$2b$` bcrypt has for the password `secret`, pass in the string `$2b$secret` for `password`. Returns True for success, False for failure. ### Crypt2.BCryptVerify `Chilkat 11.7.0 · pascal · Crypt2 · BCryptVerify · method · since 9.5.0.65` ```pascal function BCryptVerify(const password: string;     const bcryptHash: string): Boolean; ``` Verifies the `password` against a previously computed BCrypt hash. Returns `True` if the password matches the `bcryptHash`. Returns `False` if the password does not match. Returns True for success, False for failure. ### Crypt2.CkDecryptFile `Chilkat 11.7.0 · pascal · Crypt2 · CkDecryptFile · method` ```pascal function CkDecryptFile(const srcFile: string;     const destFile: string): Boolean; ``` File-to-file decryption that supports files of any size by using internal streaming mode. Returns True for success, False for failure. ### Crypt2.CkEncryptFile `Chilkat 11.7.0 · pascal · Crypt2 · CkEncryptFile · method` ```pascal function CkEncryptFile(const srcFile: string;     const destFile: string): Boolean; ``` Encrypts a file to another file using streaming mode, allowing files of virtually any size to be processed without loading the entire file into memory. The exception is when the `CryptAlgorithm` property is set to `"pki"`, in which case the entire input file must reside in memory because public-key encryption is performed in-memory rather than as a streaming operation. Returns True for success, False for failure. ### Crypt2.ClearEncryptCerts `Chilkat 11.7.0 · pascal · Crypt2 · ClearEncryptCerts · method` ```pascal procedure ClearEncryptCerts; ``` Clears the internal list of digital certificates to be used for public-key encryption. ### Crypt2.ClearSigningCerts `Chilkat 11.7.0 · pascal · Crypt2 · ClearSigningCerts · method · since 9.5.0.83` ```pascal procedure ClearSigningCerts; ``` Clears the set of certificates to be used in signing. ### Crypt2.CoSign `Chilkat 11.7.0 · pascal · Crypt2 · CoSign · method · since 9.5.0.89` ```pascal // bdIn is a TBinData object. // cert is a TCert object. // bdOut is a TBinData object. function CoSign(bdIn: TChilkatBase;     cert: TChilkatBase;     bdOut: TChilkatBase): Boolean; ``` Co-sign's an existing CMS signature. `bdIn` contains the existing CMS signature. If successful, `cert` is the output co-signed CMS signature. Returns True for success, False for failure. ### Crypt2.CrcBd `Chilkat 11.7.0 · pascal · Crypt2 · CrcBd · method · since 11.0.0` ```pascal // bd is a TBinData object. function CrcBd(const crcAlg: string;     bd: TChilkatBase): LongWord; ``` Computes a CRC for data contained in `crcAlg`, which can be either `crc-32` used in the Zip file format, or `crc8` for the CRC8 algorithm. ### Crypt2.CrcFile `Chilkat 11.7.0 · pascal · Crypt2 · CrcFile · method · since 9.5.0.38` ```pascal function CrcFile(const crcAlg: string;     const path: string): LongWord; ``` Calculates the CRC for a file's contents using the CRC algorithm specified by `crcAlg`. Possible algorithms are: - `crc-32` - This is the CRC used in the Zip file format. - `crc8` ### Crypt2.CreateP7M `Chilkat 11.7.0 · pascal · Crypt2 · CreateP7M · method` ```pascal function CreateP7M(const inFilename: string;     const p7mPath: string): Boolean; ``` **Full documentation for this method (same in every language):** [What is an Enveloping PKCS7 CMS Signature?](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/explain_pkcs7_enveloping_cms_signature.md) · [.p7s vs .p7m](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/p7s_vs_p7m.md) Signs the contents of `inFilename` and writes the enveloping (i.e. opaque) `PKCS7` signature (`.p7m`) to `p7mPath`. In a **PKCS#7/CMS signature**, the signer computes a **cryptographic hash** (e.g. SHA-256) of the data, then uses their **private key** to sign that hash. The signature = `Sign( Hash(data) )` This signed hash is what gets stored in the signature file. For enveloping/opaque signatures, the signed data is also stored in the signature file. Set the `HashAlgorithm` property to specify the hash algorithmg. The valid options are `sha256`, `sha1`, `sha384`, and `sha512`. Returns True for success, False for failure. See also: - [Online Tool to Examine a .p7m and Generate Code that Duplicates the .p7m](https://tools.chilkat.io/generateP7M) ### Crypt2.CreateP7S `Chilkat 11.7.0 · pascal · Crypt2 · CreateP7S · method` ```pascal function CreateP7S(const inFilename: string;     const p7sPath: string): Boolean; ``` **Full documentation for this method (same in every language):** [What is a Detached PKCS7 CMS Signature?](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/explain_pkcs7_detached_cms_signature.md) Signs the contents of `inFilename` and writes the detached `PKCS7` signature (`.p7s`) to `p7sPath`. In a **PKCS#7/CMS detached signature**, the signer computes a **cryptographic hash** (e.g. SHA-256) of the data, then uses their **private key** to sign that hash. The signature = `Sign( Hash(data) )` This signed hash is what gets stored in the signature file. Set the `HashAlgorithm` property to specify the hash algorithmg. The valid options are `sha256`, `sha1`, `sha384`, and `sha512`. Returns True for success, False for failure. ### Crypt2.DecodeString `Chilkat 11.7.0 · pascal · Crypt2 · DecodeString · method` ```pascal function DecodeString(const inStr: string;     const charset: string;     const encoding: string): string; ``` Decodes from an encoding back to the original string. The `encoding` can be set to any of the following strings: `base64`, `hex`, `quoted-printable`, `url`, `base32`, `Q`, `B`, `url_rc1738`, `url_rfc2396`, `url_rfc3986`, `url_oauth`, `uu`, `modBase64`, or `html` (for HTML entity encoding). Returns True for success, False for failure. ### Crypt2.DecryptBd `Chilkat 11.7.0 · pascal · Crypt2 · DecryptBd · method · since 9.5.0.67` ```pascal // bd is a TBinData object. function DecryptBd(bd: TChilkatBase): Boolean; ``` Decrypts the contents of `bd`. This method can do either `symmetric key decryption` or `CMS public key decryption` (e.g., `PKCS#7 EnvelopedData`). Before calling this method for `symmetric key decryption` (e.g., `AES`, `ChaCha20`, `Blowfish`, etc.), ensure the following setup: 1. Define the encryption algorithm using the `CryptAlgorithm` property. 2. Specify the encryption key length with the `KeyLength` property. 3. Establish the cipher mode through the `CipherMode` property. 4. Use the `SetEncodedIV` method to set the IV, if needed by the cipher mode. 5. Set the encryption key with the `SetEncodedKey` method. 6. Ensure the `PaddingScheme` property matches the encryptor's value. When calling this method for `public key decryption` (i.e. decrypting a `PKCS7 CMS message`), the following setup is required: 1. The `CryptAlgorithm` property should be set to the string `"pki"`. 2. Optionally specify the certificate to be used for decryption by calling `SetDecryptCert`. If SetDecryptCert is not called, then Chilkat will automatically search certificate sources (`Windows certificate stores`, `Apple keychain`, etc.) for the required certificate. Returns True for success, False for failure. ### Crypt2.DecryptEncoded `Chilkat 11.7.0 · pascal · Crypt2 · DecryptEncoded · method` ```pascal function DecryptEncoded(const encodedEncryptedData: string): string; ``` Decrypts encoded encrypted data, and returns the decrypted data as a binary encoded string. For example: **Input** → **Decode** `EncodingMode` → **Decrypt** → **Encode** `EncodingMode` → **Output** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. This method supports `symmetric key` and `public key` decryption. For more information on **properties that affect decryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `DecryptBd` method documentation. Returns True for success, False for failure. ### Crypt2.DecryptSb `Chilkat 11.7.0 · pascal · Crypt2 · DecryptSb · method · since 9.5.0.67` ```pascal // bdIn is a TBinData object. // sbOut is a TStringBuilder object. function DecryptSb(bdIn: TChilkatBase;     sbOut: TChilkatBase): Boolean; ``` **Full documentation for this method (same in every language):** [Importance of Charset when Encrypting or Decrypting Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_when_encrypting_text.md) This function is intended for use when the **expected decrypted output is text**. It decrypts the contents of `bdIn` and appends the resulting string to `sbOut`. Ensure that the `Charset` property, such as `utf-8,` matches the one used during encryption to interpret the decrypted bytes correctly as characters. **Input** → **Decrypt** → **Interpret Bytes according to** `Charset` → **Append to StringBuilder** This method supports `symmetric key` and `public key` decryption. For more information on **properties that affect decryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `DecryptBd` method documentation. Returns True for success, False for failure. ### Crypt2.DecryptSecureENC `Chilkat 11.7.0 · pascal · Crypt2 · DecryptSecureENC · method · since 9.5.0.71` ```pascal // secureStr is a TSecureString object. function DecryptSecureENC(const cipherText: string;     secureStr: TChilkatBase): Boolean; ``` This function is intended for use when the **expected decrypted output is text**. It decrypts binary encoded encrypted bytes passed in `cipherText` and appends the resulting string to `secureStr`. Ensure that the `Charset` property, such as `utf-8,` matches the one used during encryption to interpret the decrypted bytes correctly as characters. **Input** → **Decode using** `EncodingMode` → **Decrypt** → **Interpret Bytes according to** `Charset` → **Append to Secure String** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. This method supports `symmetric key` and `public key` decryption. For more information on **properties that affect decryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `DecryptBd` method documentation. Returns True for success, False for failure. ### Crypt2.DecryptStringENC `Chilkat 11.7.0 · pascal · Crypt2 · DecryptStringENC · method` ```pascal function DecryptStringENC(const str: string): string; ``` **Full documentation for this method (same in every language):** [Explaining the Importance of the Charset](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_when_encrypting_text.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) This function is intended for use when the **expected decrypted output is text**. It decrypts binary encoded encrypted bytes passed in `str` and appends the resulting string to ARG2. Ensure that the `Charset` property, such as `utf-8,` matches the one used during encryption to interpret the decrypted bytes correctly as characters. **Input** → **Decode using** `EncodingMode` → **Decrypt** → **Interpret Bytes according to** `Charset` → **Output** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. This method supports `symmetric key` and `public key` decryption. For more information on **properties that affect decryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `DecryptBd` method documentation. Returns True for success, False for failure. ### Crypt2.EncodeInt `Chilkat 11.7.0 · pascal · Crypt2 · EncodeInt · method · since 9.5.0.77` ```pascal function EncodeInt(value: Integer;     numBytes: Integer;     littleEndian: Boolean;     const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Encodes an integer to N bytes and returns in the specified encoding. If `littleEndian` is `True`, then `little-endian` byte ordering is used. Otherwise `big-endian` byte order is used. Returns True for success, False for failure. ### Crypt2.EncodeString `Chilkat 11.7.0 · pascal · Crypt2 · EncodeString · method` ```pascal function EncodeString(const strToEncode: string;     const charsetName: string;     const toEncodingName: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · [Charset Supported by Chilkat](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charsets_supported_by_chilkat.md) Binary encodes a string. The `toEncodingName` can be set to **any of the binary encodings supported by Chilkat**, such as `base64`, `hex`, etc. (see the link below for the full list of encodings). The `charsetName`, such as `"utf-8"`, determines the bytes that are encoded. The `toEncodingName` can also be set to the value `html` for HTML entity encoding. Returns True for success, False for failure. ### Crypt2.EncryptBd `Chilkat 11.7.0 · pascal · Crypt2 · EncryptBd · method · since 9.5.0.67` ```pascal // bd is a TBinData object. function EncryptBd(bd: TChilkatBase): Boolean; ``` Encrypts the contents of `bd`. This method can do either `symmetric key encryption` or `CMS public key encryption` (e.g., `PKCS#7 EnvelopedData`). Before calling this method for `symmetric key encryption` (e.g., `AES`, `ChaCha20`, `Blowfish`, etc.), ensure the following setup: 1. Define the encryption algorithm using the `CryptAlgorithm` property. 2. Specify the encryption key length with the `KeyLength` property. 3. Establish the cipher mode through the `CipherMode` property. 4. Use the `SetEncodedIV` method to set the IV, if needed by the cipher mode. 5. Set the encryption key with the `SetEncodedKey` method. 6. Set the `PaddingScheme` property if needing something different than the default. When calling this method for `public key encryption` (i.e. creating a `PKCS7 CMS message`), the following setup is required: 1. The `CryptAlgorithm` property should be set to the string `"pki"`. 2. To specify the encryption certificate, use `SetEncryptCert`. For multiple certificates, call `AddEncryptCert` for each one. Returns True for success, False for failure. ### Crypt2.EncryptEncoded `Chilkat 11.7.0 · pascal · Crypt2 · EncryptEncoded · method` ```pascal function EncryptEncoded(const str: string): string; ``` Encrypts binary-encoded data and returns it as a binary-encoded string. For example: **Input** → **Decode** `EncodingMode` → **Encrypt** → **Encode** `EncodingMode` → **Output** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. This method supports `symmetric key` and `public key` decryption. For more information on **properties that affect decryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `method documentation.` Returns True for success, False for failure. ### Crypt2.EncryptSb `Chilkat 11.7.0 · pascal · Crypt2 · EncryptSb · method · since 9.5.0.67` ```pascal // sbIn is a TStringBuilder object. // bdOut is a TBinData object. function EncryptSb(sbIn: TChilkatBase;     bdOut: TChilkatBase): Boolean; ``` **Full documentation for this method (same in every language):** [Importance of Charset when Encrypting or Decrypting Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_when_encrypting_text.md) Encrypts text and appends the encrypted bytes in `bdOut`. The `Charset` property, such as `utf-8`, determines the actual bytes that are encrypted. `StringBuilder` → **Get bytes according to** `Charset` → **Encrypt** → **Append to** `BinData` This method supports `symmetric key` and `public key` encryption. For more information on **properties that affect encryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `EncryptBd` method documentation. Returns True for success, False for failure. ### Crypt2.EncryptSecureENC `Chilkat 11.7.0 · pascal · Crypt2 · EncryptSecureENC · method · since 9.5.0.71` ```pascal // secureStr is a TSecureString object. function EncryptSecureENC(secureStr: TChilkatBase): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · [Importance of Charset when Encrypting or Decrypting Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_when_encrypting_text.md) Encrypts the secure string and returns the encrypted bytes as a binary encoded string. The `Charset` property determines the actual bytes that are encrypted. `SecureString` → **Get bytes according to** `Charset` → **Encrypt** → **Encode using** `EncodingMode` → **Output** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. This method supports `symmetric key` and `public key` encryption. For more information on **properties that affect encryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `EncryptBd` method documentation. Returns True for success, False for failure. ### Crypt2.EncryptStringENC `Chilkat 11.7.0 · pascal · Crypt2 · EncryptStringENC · method` ```pascal function EncryptStringENC(const str: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · [Importance of Charset when Encrypting or Decrypting Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_when_encrypting_text.md) Encrypts the `str` and returns the encrypted bytes as a binary encoded string. The `Charset` property determines the actual bytes that are encrypted. **Input** → **Get bytes according to** `Charset` → **Encrypt** → **Encode using** `EncodingMode` → **Output** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. This method supports `symmetric key` and `public key` encryption. For more information on **properties that affect encryption**, such as `CryptAlgorithm`, `CipherMode`, etc., refer to the `EncryptBd` method documentation. Returns True for success, False for failure. ### Crypt2.GenerateUuid `Chilkat 11.7.0 · pascal · Crypt2 · GenerateUuid · method · since 9.5.0.55` ```pascal function GenerateUuid: string; ``` Generates a random UUID string having standard UUID format, such as `de305d54-75b4-431b-adb2-eb6b9e546014`. Note: This generates a `version 4 UUID` using random byte values. See RFC 4122. Returns True for success, False for failure. ### Crypt2.GenRandomBytesENC `Chilkat 11.7.0 · pascal · Crypt2 · GenRandomBytesENC · method` ```pascal function GenRandomBytesENC(numBytes: Integer): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Generates `numBytes` random bytes and returns them as an encoded string. The encoding format (e.g., base64, hex) is determined by the `EncodingMode` property. It utilizes the `Fortuna` cryptographically secure random number generator, auto-seeded by an OS-dependent secure entropy source. Returns True for success, False for failure. ### Crypt2.GetEncodedAuthTag `Chilkat 11.7.0 · pascal · Crypt2 · GetEncodedAuthTag · method · since 9.5.0.55` ```pascal function GetEncodedAuthTag(const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Explaining the AES-GCM Authentication Tag](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/gcm_authentication_tag.md) · [AES-GCM Overview](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/aes_gcm_overview.md) · [Explaining Authenticated Encryption, such as AES-GCM](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/authenticated_encryption_gcm.md) When encrypting in `GCM` mode, Chilkat generates the `GCM authentication tag`. The application can then use this method to retrieve the tag, which should be sent to the decrypting party along with the encrypted data. For further details on GCM authenticated encryption, please refer to the web pages linked below. Returns True for success, False for failure. ### Crypt2.GetEncodedIV `Chilkat 11.7.0 · pascal · Crypt2 · GetEncodedIV · method` ```pascal function GetEncodedIV(const encoding: string): string; ``` This method retrieves the IV set by the application during the last call to `SetEncodedIV` or `RandomizeIV`. Returns True for success, False for failure. ### Crypt2.GetLastJsonData `Chilkat 11.7.0 · pascal · Crypt2 · GetLastJsonData · method · since 11.0.0` ```pascal // json is a TJsonObject object. procedure GetLastJsonData(json: TChilkatBase); ``` Offers details on the last method executed. While many methods provide no information, some do through GetLastJsonData. For instance, after invoking a signature verification method, GetLastJsonData will return JSON detailing the algorithms used. ### Crypt2.GetSignatureSigningTimeStr `Chilkat 11.7.0 · pascal · Crypt2 · GetSignatureSigningTimeStr · method` ```pascal function GetSignatureSigningTimeStr(index: Integer): string; ``` This method retrieves the signing time of the Nth certificate in a digital signature after verification. The signing time for the first certificate is at index 0. The `NumSignerCerts` property indicates the total number of signing certificates, although typically only one is used. Note: Before accessing the signing time, use the `HasSignatureSigningTime` method to verify its availability, and skip indices lacking a signing time. The signing time is returned in `RFC822 string format`. Returns True for success, False for failure. See also: - [Explaining the Signing Time Authenticated Attribute in PKCS7 Signatures](https://cknotes.com/explaining-the-signingtime-authenticated-attribute-in-pkcs7-signatures/) ### Crypt2.GetSignedAttributes `Chilkat 11.7.0 · pascal · Crypt2 · GetSignedAttributes · method · since 9.5.0.75` ```pascal // pkcs7Der is a TBinData object. // sbJson is a TStringBuilder object. function GetSignedAttributes(signerIndex: Integer;     pkcs7Der: TChilkatBase;     sbJson: TChilkatBase): Boolean; ``` Extracts the signed (authenticated) attributes for the Nth signer, where `signerIndex` is typically 0, as most signatures have only one signer. Provide the binary PKCS7 in `pkcs7Der`. If successful, `sbJson` will hold the signed attributes in JSON format. Sample JSON output: ``` { "signedAttributes": [ { "oid": "1.2.840.113549.1.9.3", "name": "Content Type" }, { "oid": "1.2.840.113549.1.9.5", "name": "Signing Time" }, { "oid": "1.2.840.113549.1.9.4" "name": "Message Digest" }, { "oid": "1.2.840.113549.1.9.16.2.47", "name": "Signing Certificate V2" } ] } ``` Returns True for success, False for failure. ### Crypt2.HashBdENC `Chilkat 11.7.0 · pascal · Crypt2 · HashBdENC · method · since 9.5.0.66` ```pascal // bd is a TBinData object. function HashBdENC(bd: TChilkatBase): string; ``` **Full documentation for this method (same in every language):** [Binary Encodings Supported by Chilkat](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Hashes the bytes in `bd` and returns the hash as a binary-encoded string. The hash algorithm is determined by the `HashAlgorithm` property, while the encoding is specified by the `EncodingMode` property. Encoding options include `base64`, `hex`, `base64url`, or others listed at the link below. Returns True for success, False for failure. ### Crypt2.HashBeginString `Chilkat 11.7.0 · pascal · Crypt2 · HashBeginString · method` ```pascal function HashBeginString(const strData: string): Boolean; ``` **Full documentation for this method (same in every language):** [Importance of Charset when Hashing Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/hashing_text.md) To hash a large amount of text, start by processing the first chunk using this method. For subsequent chunks, use the `HashMoreString` method as needed. Conclude by calling `HashFinalENC` to obtain the final result. The hash algorithm is determined by the `HashAlgorithm` property setting. Returns True for success, False for failure. ### Crypt2.HashChunkBd `Chilkat 11.7.0 · pascal · Crypt2 · HashChunkBd · method · since 11.1.0` ```pascal // bd is a TBinData object. function HashChunkBd(firstChunk: Boolean;     bd: TChilkatBase): Boolean; ``` Start or continue hashing data in chunks. Set `firstChunk` to `True` for the first chunk, and `False` for subsequent chunks. Finish by calling `HashFinalENC` to obtain the result. The hash algorithm used is determined by the `HashAlgorithm` property. Returns True for success, False for failure. ### Crypt2.HashFileENC `Chilkat 11.7.0 · pascal · Crypt2 · HashFileENC · method` ```pascal function HashFileENC(const path: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Hashes a file and returns the hash as an encoded string. The hash algorithm is specified by the `HashAlgorithm` property, The encoding is controlled by the `EncodingMode` property, which can be set to `base64`, `hex`, `base64url`, or any of the encodings listed at the link below. Any size file is supported because the file is hashed internally in streaming mode (keeping memory usage low and constant). Returns True for success, False for failure. ### Crypt2.HashFinalENC `Chilkat 11.7.0 · pascal · Crypt2 · HashFinalENC · method` ```pascal function HashFinalENC: string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Finalizes a multi-step hash computation and returns the hash bytes encoded according to the `EncodingMode` property setting. Returns True for success, False for failure. ### Crypt2.HashMoreString `Chilkat 11.7.0 · pascal · Crypt2 · HashMoreString · method` ```pascal function HashMoreString(const strData: string): Boolean; ``` Adds more text to the hash currently under computation. (See `HashBeginString`) Returns True for success, False for failure. ### Crypt2.HashStringENC `Chilkat 11.7.0 · pascal · Crypt2 · HashStringENC · method` ```pascal function HashStringENC(const str: string): string; ``` **Full documentation for this method (same in every language):** [Importance of Charset when Hashing Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/hashing_text.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Hashes the `str` and returns the hash as a binary encoded string. The `Charset` property determines the actual bytes that are hashed. **Input** → **Get bytes according to** `Charset` → **Hash** → **Encode using** `EncodingMode` → **Output** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. The hash algorithm is determined by the `HashAlgorithm` property. Returns True for success, False for failure. ### Crypt2.HasSignatureSigningTime `Chilkat 11.7.0 · pascal · Crypt2 · HasSignatureSigningTime · method` ```pascal function HasSignatureSigningTime(index: Integer): Boolean; ``` After verifying a digital signature with a signature verification method, you can call this method. It returns `True` if the signing time for the Nth certificate is available and can be accessed using the `GetSignatureSigningTimeStr` method. ### Crypt2.Hotp `Chilkat 11.7.0 · pascal · Crypt2 · Hotp · method · since 9.5.0.77` ```pascal function Hotp(const secret: string;     const secretEnc: string;     const counterHex: string;     numDigits: Integer;     truncOffset: Integer;     const hashAlg: string): string; ``` Implements RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm. The arguments to this method are: - `secret`: The shared secret in an enocded representation such as base64, hex, ascii, etc. - `secretEnc`: The encoding of the shared secret, such as `base64` - `counterHex`: The 8-byte counter in hexidecimal format. - `numDigits`: The number of decimal digits to return. - `truncOffset`: Normally set this to -1 for dynamic truncation. Otherwise can be set in the range 0..15. - `hashAlg`: Normally set to `sha1`. Can be set to other hash algorithms such as `sha256`, `sha512`, etc. Returns True for success, False for failure. ### Crypt2.LastDecryptCert `Chilkat 11.7.0 · pascal · Crypt2 · LastDecryptCert · method · since 11.0.0` ```pascal // cert is a TCert object. function LastDecryptCert(cert: TChilkatBase): Boolean; ``` Returns in `cert` the last certificate used for public-key decryption. Returns True for success, False for failure. ### Crypt2.LastSignerCert `Chilkat 11.7.0 · pascal · Crypt2 · LastSignerCert · method · since 11.0.0` ```pascal // cert is a TCert object. function LastSignerCert(index: Integer;     cert: TChilkatBase): Boolean; ``` Retrieves the Nth certificate used for signing in `cert`, where the first certificate is at index 0. Use this method **after verifying a digital signature** to access the signer certificates. The `NumSignerCerts` property indicates the total number of signing certificates. Usually, only one certificate is used when creating a digital signature. Returns True for success, False for failure. ### Crypt2.LoadTaskCaller `Chilkat 11.7.0 · pascal · Crypt2 · LoadTaskCaller · method · since 9.5.0.80` ```pascal // task is a TTask object. function LoadTaskCaller(task: TChilkatBase): Boolean; ``` Loads the caller of the task's async method. Returns True for success, False for failure. ### Crypt2.MacBdENC `Chilkat 11.7.0 · pascal · Crypt2 · MacBdENC · method · since 9.5.0.66` ```pascal // bd is a TBinData object. function MacBdENC(bd: TChilkatBase): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Generates a **Message Authentication Code** (MAC) for the bytes in `bd` using the algorithm defined by the `MacAlgorithm` property. The resulting MAC is encoded into a string based on the `EncodingMode` property (e.g., `base64` or `hex`). The `HashAlgorithm` property determines the internal hash function. Before generating the MAC, specify the secret key using `SetMacKeyEncoded` . Returns True for success, False for failure. ### Crypt2.MacStringENC `Chilkat 11.7.0 · pascal · Crypt2 · MacStringENC · method · since 9.5.0.55` ```pascal function MacStringENC(const inText: string): string; ``` **Full documentation for this method (same in every language):** [Importance of Charset when Hashing Text](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/hashing_text.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Computes a Message Authentication Code (MAC) and returns it as a binary encoded string. The MAC algorithm is defined by the `MacAlgorithm` property. The `Charset` property determines the actual bytes that are hashed. **Input** → **Get bytes according to** `Charset` → **MAC** → **Encode using** `EncodingMode` → **Output** The encoding (e.g. `base64`, `hex`, etc.) is determined by the `EncodingMode` property. The hash algorithm is determined by the `HashAlgorithm` property. The secret key must be set beforehand by calling `SetMacKeyEncoded` . Returns True for success, False for failure. ### Crypt2.MySqlAesDecrypt `Chilkat 11.7.0 · pascal · Crypt2 · MySqlAesDecrypt · method` ```pascal function MySqlAesDecrypt(const strEncryptedHex: string;     const strPassword: string): string; ``` Matches `MySQL`'s `AES_DECRYPT` function. `strEncryptedHex` is a hex-encoded AES-encrypted string, and the return value is the original unencrypted string. Returns True for success, False for failure. ### Crypt2.MySqlAesEncrypt `Chilkat 11.7.0 · pascal · Crypt2 · MySqlAesEncrypt · method` ```pascal function MySqlAesEncrypt(const strData: string;     const strPassword: string): string; ``` This function replicates `MySQL`'s `AES_ENCRYPT`, returning the encrypted data as a hex-encoded string. In MySQL, this is done using: `HEX(AES_ENCRYPT('The quick brown fox jumps over the lazy dog', 'password'))`. Returns True for success, False for failure. ### Crypt2.OpaqueSignBd `Chilkat 11.7.0 · pascal · Crypt2 · OpaqueSignBd · method · since 9.5.0.67` ```pascal // bd is a TBinData object. function OpaqueSignBd(bd: TChilkatBase): Boolean; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) Digitally signs the contents of `bd`. If successful, the contents of `bd` are replaced with the `PKCS#7 signed-data`, which embeds the original data within the signature. Ensure a certificate is set using `SetSigningCert` before invoking this method. The `HashAlgorithm` property specifies the hash algorithm for creating the data's hash during signing. Returns True for success, False for failure. ### Crypt2.OpaqueSignStringENC `Chilkat 11.7.0 · pascal · Crypt2 · OpaqueSignStringENC · method` ```pascal function OpaqueSignStringENC(const str: string): string; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Why Charset Matters in Digital Signatures](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_in_digital_signatures.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Digitally signs a string and returns `PKCS#7 signed-data` as a `binary encoded string`. The `EncodingMode` property determines the binary encoding, such as `base64`, `hex`, `hex_lower`, `base64_mime`, etc. The `Charset` property determines the actual bytes that are hashed and signed. The `HashAlgorithm` property specifies the hash algorithm for creating the data's hash during signing. Returns True for success, False for failure. ### Crypt2.OpaqueVerifyBd `Chilkat 11.7.0 · pascal · Crypt2 · OpaqueVerifyBd · method · since 9.5.0.67` ```pascal // bd is a TBinData object. function OpaqueVerifyBd(bd: TChilkatBase): Boolean; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) The method performs in-place verification of the `PKCS#7 signed-data` content of `bd`. If the signature is successfully verified, the content of `bd` is replaced with the original data, and the method returns `True`. If verification fails, `bd` remains unchanged, and the method returns `False`. Afterwards, you can retrieve signer certificates by using the `NumSignerCerts` property and the `LastSignerCert` method. Returns True for success, False for failure. ### Crypt2.OpaqueVerifyStringENC `Chilkat 11.7.0 · pascal · Crypt2 · OpaqueVerifyStringENC · method` ```pascal function OpaqueVerifyStringENC(const p7m: string): string; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · [Why Charset Matters in Digital Signatures](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_in_digital_signatures.md) This function verifies a `PKCS#7 signed-data` binary-encoded signature and returns the original text data. The `EncodingMode` property determines how `p7m` is decoded to bytes. If the signature does not verify successfully, it returns an empty string. The `Charset` property specifies how the original data bytes are converted to characters. You can obtain signer certificates using the `NumSignerCerts` property and the `LastSignerCert` method. Returns True for success, False for failure. ### Crypt2.Pbkdf1 `Chilkat 11.7.0 · pascal · Crypt2 · Pbkdf1 · method` ```pascal function Pbkdf1(const password: string;     const charset: string;     const hashAlg: string;     const salt: string;     iterationCount: Integer;     outputKeyBitLen: Integer;     const encoding: string): string; ``` **Full documentation for this method (same in every language):** [More About PBKDF1](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pbkdf1.md) This function implements the `PBKDF1` (Password-Based Key Derivation Function #1) algorithm. Follow these guidelines to use it: 1. **`password`** (the password) is first converted using the character encoding specified by **`charset`** before being processed by the key derivation function. 2. **`hashAlg`** specifies the hash function to use, such as `md5`, `sha1`, or `md2`. 3. **`salt`** represents the salt, which should be random data of at least 8 bytes (64 bits). You can use the `GenRandomBytesENC` method to generate this. 4. **`iterationCount`** sets the iteration count, which must be a minimum of 1000. 5. **`outputKeyBitLen`** determines the length (in bits) of the derived key. 6. **`encoding`** defines the output encoding format, such as `base64` or `hex`, and also the expected encoding of **`salt`** (the salt). The function returns the derived key. Note: If `charset` is specified as hex or base64, the password (`password`) will be treated as binary data encoded in that format. It will be decoded into binary form and used directly as such. Returns True for success, False for failure. ### Crypt2.Pbkdf2 `Chilkat 11.7.0 · pascal · Crypt2 · Pbkdf2 · method` ```pascal function Pbkdf2(const password: string;     const charset: string;     const hashAlg: string;     const salt: string;     iterationCount: Integer;     outputKeyBitLen: Integer;     const encoding: string): string; ``` **Full documentation for this method (same in every language):** [More about PBKDF2 Key Derivation](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/key_derivation_pbkdf2.md) Implements the `PBKDF2` algorithm as follows: 1. Convert `password` to the character encoding specified by `charset` before using it in the key derivation function. 2. `hashAlg` specifies the hash algorithm. Options include `sha256`, `sha384`, `sha512`, `md5`, `sha1`, `md2`, or any algorithm listed in the HashAlgorithm property. 3. Provide a random `salt` value that is at least 8 bytes (64 bits) long. Use methods like `GenRandomBytesENC` to generate this salt value. 4. Ensure `iterationCount` is 1000 or greater. 5. Control the length of the derived key output using `outputKeyBitLen`. 6. Set `encoding` to specify the encoding format for the output and the expected encoding for `salt`. Options include `base64` and `hex`. The derived key is the output of this process. Internally, PBKDF2 uses a pseudorandom function (PRF), specifically a keyed HMAC. The hash algorithm chosen with `hashAlg` dictates this PRF; for example, `SHA256` uses HMAC-SHA256, while `SHA1` uses HMAC-SHA1. Note: If `charset` is `hex` or `base64`, `password` is treated as binary data. It will be decoded and used directly as a binary password. `SHA256` uses HMAC-SHA256, while `SHA1` uses HMAC-SHA1. PBKDF1 and PBKDF2 are both key derivation functions used to strengthen passwords for cryptographic purposes, but PBKDF2 is the improved version. - **PBKDF1**: Older and limited - it can only generate small keys (up to the hash function’s output size), making it less flexible and secure. - **PBKDF2**: More advanced - it can generate longer keys, is more resistant to attacks, and is widely recommended for modern security needs. In short, `PBKDF2` is stronger and more versatile than `PBKDF1`. Returns True for success, False for failure. ### Crypt2.RandomizeIV `Chilkat 11.7.0 · pascal · Crypt2 · RandomizeIV · method` ```pascal procedure RandomizeIV; ``` Sets the initialization vector (IV) to a random value. The `CryptAlgorithm` property should be set prior to calling this method. A **random IV** is used in symmetric encryption (like AES-CBC or AES-GCM) to ensure that encrypting the same plaintext with the same key produces **different ciphertext each time**. This prevents attackers from recognizing patterns in encrypted data and strengthens security. **Why use a random IV?** - It ensures **semantic security** (i.e. same plaintext never results in same ciphertext). - Prevents replay and pattern attacks. - Especially important in modes like **CBC** and **GCM**. **How is the IV sent to the decrypting party?** The IV is **not secret**, but it must be **available** for decryption. Common methods: - **Prepended** to the ciphertext (e.g., `IV || ciphertext`) - **Sent in a separate field** (e.g., JSON field, HTTP header) - **Concatenated and encoded** (e.g., base64 of IV + ciphertext) At the receiving side, the decryptor **extracts the IV** and uses it with the shared key to decrypt the ciphertext correctly. ### Crypt2.ReEncode `Chilkat 11.7.0 · pascal · Crypt2 · ReEncode · method` ```pascal function ReEncode(const encodedData: string;     const fromEncoding: string;     const toEncoding: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) This method converts between different encodings, such as from `base64` to `hex`. Each argument can be **any binary encoding supported by Chilkat**. Returns True for success, False for failure. ### Crypt2.SetDecryptCert `Chilkat 11.7.0 · pascal · Crypt2 · SetDecryptCert · method` ```pascal // cert is a TCert object. function SetDecryptCert(cert: TChilkatBase): Boolean; ``` **Full documentation for this method (same in every language):** [Certificates and Private Keys (Files and Sources)](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/certificates_and_private_keys.md) Sets the digital certificate for decryption when the `CryptAlgorithm` property is set to `"pki"`. This method requires that the certificate has a private key. Returns True for success, False for failure. ### Crypt2.SetDecryptCert2 `Chilkat 11.7.0 · pascal · Crypt2 · SetDecryptCert2 · method` ```pascal // cert is a TCert object. // key is a TPrivateKey object. function SetDecryptCert2(cert: TChilkatBase;     key: TChilkatBase): Boolean; ``` Sets the digital certificate and associated private key for decryption when the `CryptAlgorithm` property is set to `"pki"`. The private key must be the one that matches the certificate's public key. Returns True for success, False for failure. ### Crypt2.SetEncodedAad `Chilkat 11.7.0 · pascal · Crypt2 · SetEncodedAad · method · since 9.5.0.55` ```pascal function SetEncodedAad(const aadStr: string;     const encoding: string): Boolean; ``` Sets the optional authenticated additional data (`AAD`) for AES encryption in `GCM` mode. The data is provided as a binary-encoded string using the specified `encoding`, and any binary encoding supported by Chilkat can be used. In GCM (Galois/Counter Mode) encryption, AAD (Additional Authenticated Data) is optional input that is not encrypted but is authenticated along with the ciphertext. It's used to verify integrity of associated data like headers or metadata. If AAD is modified, decryption will fail due to authentication tag mismatch. Returns True for success, False for failure. ### Crypt2.SetEncodedAuthTag `Chilkat 11.7.0 · pascal · Crypt2 · SetEncodedAuthTag · method · since 9.5.0.55` ```pascal function SetEncodedAuthTag(const authTagStr: string;     const encoding: string): Boolean; ``` **Full documentation for this method (same in every language):** [Explaining the AES-GCM Authentication Tag](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/gcm_authentication_tag.md) · [AES-GCM Overview](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/aes_gcm_overview.md) · [Explaining Authenticated Encryption, such as AES-GCM](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/authenticated_encryption_gcm.md) In GCM mode, the authentication tag is a short value (e.g. 16 bytes) **generated during encryption** that ensures the integrity and authenticity of both the ciphertext and any AAD. It must be verified during decryption to confirm the data hasn't been altered. When decrypting AES-GCM, applications must call this method to provide the expected authentication tag. To prevent Chilkat from checking the authentication tag after decryption, you can set the authentication tag to the special `hex` value `FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF` (16 bytes of 0xFF). Returns True for success, False for failure. ### Crypt2.SetEncodedIV `Chilkat 11.7.0 · pascal · Crypt2 · SetEncodedIV · method` ```pascal procedure SetEncodedIV(const ivStr: string;     const encoding: string); ``` **Full documentation for this method (same in every language):** [IV Length and Algorithm Block Size](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/symmetric_encrpytion_iv_and_algorithm_block_size.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Sets the initialization vector used in **symmetric encrpytion** (`AES`, `Blowfish`, etc.) from a binary-encoded string using any Chilkat-supported encoding method (e.g., `base64`, `hex`). An **Initialization Vector (IV)** is a random or unique value used in symmetric encryption to ensure that encrypting the same plaintext multiple times produces different ciphertexts. It prevents pattern leakage. **Cipher Modes That Require an IV:** - `CBC` (Cipher Block Chaining) - `CFB` (Cipher Feedback) - `OFB` (Output Feedback) - `CTR` (Counter Mode) - `GCM` (Galois/Counter Mode) **ECB (Electronic Codebook)** does \*not\* use an IV, which makes it less secure. ### Crypt2.SetEncodedKey `Chilkat 11.7.0 · pascal · Crypt2 · SetEncodedKey · method` ```pascal procedure SetEncodedKey(const keyStr: string;     const encoding: string); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Sets the encryption key used in **symmetric encryption** (`AES`, `Blowfish`, etc.) from a binary-encoded string using any Chilkat-supported encoding method (e.g., `base64`, `hex`). The key must have a byte size equal to the `KeyLength` property. For instance, a KeyLength of `128 bits` requires a `16-byte` key, and a KeyLength of `256 bits` requires a `32-byte` key. ### Crypt2.SetEncodedSalt `Chilkat 11.7.0 · pascal · Crypt2 · SetEncodedSalt · method` ```pascal procedure SetEncodedSalt(const saltStr: string;     const encoding: string); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · [Explaining PBES2 Encryption](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/explaining_pbes2_encryption.md) Sets the `pbes2` or `pbes1` salt bytes from a binary-encoded string using any Chilkat-supported encoding method (e.g., `base64`, `hex`). This salt is used for encryption and decryption when the `CryptAlgorithm` property is set to `pbes1` or `pbes2`. Note: This does not apply to the `Pbkdf1` or `Pbkdf2` methods, where the salt is provided as a function argument. ### Crypt2.SetEncryptCert `Chilkat 11.7.0 · pascal · Crypt2 · SetEncryptCert · method` ```pascal // cert is a TCert object. function SetEncryptCert(cert: TChilkatBase): Boolean; ``` Instructs the encryption library to use a specified digital certificate for public-key encryption. To encrypt using multiple certificates, call `AddEncryptCert` for each one. This action is equivalent to calling `ClearEncryptCerts` before `AddEncryptCert` . Returns True for success, False for failure. ### Crypt2.SetMacKeyEncoded `Chilkat 11.7.0 · pascal · Crypt2 · SetMacKeyEncoded · method · since 9.5.0.55` ```pascal function SetMacKeyEncoded(const key: string;     const encoding: string): Boolean; ``` **Full documentation for this method (same in every language):** [MAC Key Ambiguity](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/mac_key_ambiguity.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Sets the MAC key from a binary-encoded string using any Chilkat-supported encoding method (e.g., `base64`, `hex`). Returns True for success, False for failure. ### Crypt2.SetMacKeyString `Chilkat 11.7.0 · pascal · Crypt2 · SetMacKeyString · method · since 9.5.0.55` ```pascal function SetMacKeyString(const key: string): Boolean; ``` **Full documentation for this method (same in every language):** [Mac Key Ambiguity](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/mac_key_ambiguity.md) Sets the MAC key from a string. The `Charset` property determines the actual bytes used for the MAC key. Returns True for success, False for failure. ### Crypt2.SetSigningCert `Chilkat 11.7.0 · pascal · Crypt2 · SetSigningCert · method` ```pascal // cert is a TCert object. function SetSigningCert(cert: TChilkatBase): Boolean; ``` Sets the digital certificate to be used for signing. Signing requires that the certificate has a private key. Returns True for success, False for failure. ### Crypt2.SetSigningCert2 `Chilkat 11.7.0 · pascal · Crypt2 · SetSigningCert2 · method` ```pascal // cert is a TCert object. // privateKey is a TPrivateKey object. function SetSigningCert2(cert: TChilkatBase;     privateKey: TChilkatBase): Boolean; ``` Sets the digital certificate and associated private key for signing. The private key must be the one that matches the certificate's public key. Returns True for success, False for failure. ### Crypt2.SetTsaHttpObj `Chilkat 11.7.0 · pascal · Crypt2 · SetTsaHttpObj · method` ```pascal // http is a THttp object. procedure SetTsaHttpObj(http: TChilkatBase); ``` If timestamp server communications are needed for signing and special Internet settings like a proxy server are necessary, this method can provide an Http object configured with these settings. ### Crypt2.SetVerifyCert `Chilkat 11.7.0 · pascal · Crypt2 · SetVerifyCert · method` ```pascal // cert is a TCert object. function SetVerifyCert(cert: TChilkatBase): Boolean; ``` Assigns the digital certificate for signature verification. Typically, a PKCS7 (CMS) signature includes the signing certificate information, making it **unnecessary to call this method explicitly**. This is only required in rare instances. Returns True for success, False for failure. ### Crypt2.SignBdENC `Chilkat 11.7.0 · pascal · Crypt2 · SignBdENC · method · since 9.5.0.67` ```pascal // dataToSign is a TBinData object. function SignBdENC(dataToSign: TChilkatBase): string; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Digitally signs the content in `dataToSign` and returns a `detached` signature (`PKCS#7 signed-data`) as a binary-encoded string. The `EncodingMode` property determines the binary-encoding. Possible encodings include `base64`, `base64_mime`, `hex`, and `hex_lower`. The `HashAlgorithm` property specifies the hash algorithm for creating the data's hash during signing. Returns True for success, False for failure. ### Crypt2.SignHashENC `Chilkat 11.7.0 · pascal · Crypt2 · SignHashENC · method · since 9.5.0.90` ```pascal function SignHashENC(const encodedHash: string;     const hashAlg: string;     const hashEncoding: string): string; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · [Digital Signatures Actually Sign the Hash of the Data](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/digital_signatures_sign_the_hash.md) Digitally signs a pre-computed hash and returns a `detached` signature (`PKCS#7 signed-data`) as a binary-encoded string. The `EncodingMode` property determines the binary-encoding. Possible encodings include `base64`, `base64_mime`, `hex`, and `hex_lower` `encodedHash` is a binary-encoded hash to be signed, with its encoding format specified by `hashEncoding` (e.g., `base64`, `hex`). `hashAlg` specifies the hash algorithm (e.g., `sha256`, `sha1`, `sha512`) used for `encodedHash`. Returns True for success, False for failure. ### Crypt2.SignSbENC `Chilkat 11.7.0 · pascal · Crypt2 · SignSbENC · method · since 9.5.0.67` ```pascal // sb is a TStringBuilder object. function SignSbENC(sb: TChilkatBase): string; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Why Charset Matters in Digital Signatures](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_in_digital_signatures.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Digitally signs the text contained in `sb` and returns a `detached` signature (`PKCS#7 signed-data`) as a binary-encoded string. The `EncodingMode` property determines the binary-encoding. Possible encodings include `base64`, `base64_mime`, `hex`, and `hex_lower`. The `HashAlgorithm` property specifies the hash algorithm for creating the data's hash during signing. The `Charset` property determines the actual bytes that are hashed and signed. Returns True for success, False for failure. ### Crypt2.SignStringENC `Chilkat 11.7.0 · pascal · Crypt2 · SignStringENC · method` ```pascal function SignStringENC(const str: string): string; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Why Charset Matters in Digital Signatures](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_in_digital_signatures.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Digitally signs a string and returns a `detached` signature (`PKCS#7 signed-data`) as a binary-encoded string. The `EncodingMode` property determines the binary-encoding. Possible encodings include `base64`, `base64_mime`, `hex`, and `hex_lower`. The `HashAlgorithm` property specifies the hash algorithm for creating the data's hash during signing. The `Charset` property determines the actual bytes that are hashed and signed. Returns True for success, False for failure. ### Crypt2.Totp `Chilkat 11.7.0 · pascal · Crypt2 · Totp · method · since 9.5.0.77` ```pascal function Totp(const secret: string;     const secretEnc: string;     const t0: string;     const tNow: string;     tStep: Integer;     numDigits: Integer;     truncOffset: Integer;     const hashAlg: string): string; ``` Implements RFC 6238: TOTP: Time-Based One-Time Password Algorithm. The arguments to this method are: - `secret`: The shared secret in an enocded representation such as base64, hex, ascii, etc. - `secretEnc`: The encoding of the shared secret, such as `base64` - `t0`: The Unix time to start counting time steps. It is a number in decimal string form. A Unix time is the number of seconds elapsed since midnight UTC of January 1, 1970. `0` is a typical value used for this argument. - `tNow`: The current Unix time in decimal string form. To use the current system date/time, pass an empty string for this argument. - `tStep`: The time step in seconds. A typical value is 30. Note: Both client and server must pre-agree on the secret, the t0, and the tStep. - `numDigits`: The number of decimal digits to return. - `truncOffset`: Normally set this to -1 for dynamic truncation. Otherwise can be set in the range 0..15. - `hashAlg`: Normally set to `sha1`. Can be set to other hash algorithms such as `sha256`, `sha512`, etc. Returns True for success, False for failure. ### Crypt2.UseCertVault `Chilkat 11.7.0 · pascal · Crypt2 · UseCertVault · method · since 9.5.0.40` ```pascal // vault is a TXmlCertVault object. function UseCertVault(vault: TChilkatBase): Boolean; ``` Adds an XML certificate vault to the object's internal list of sources to be searched for certificates and private keys when encrypting/decrypting or signing/verifying. Unlike the AddPfxSourceData and AddPfxSourceFile methods, only a single XML certificate vault can be used. If UseCertVault is called multiple times, only the last certificate vault will be used, as each call to UseCertVault will replace the certificate vault provided in previous calls. Returns True for success, False for failure. ### Crypt2.VerifyBdENC `Chilkat 11.7.0 · pascal · Crypt2 · VerifyBdENC · method · since 9.5.0.67` ```pascal // data is a TBinData object. function VerifyBdENC(data: TChilkatBase;     const encodedSig: string): Boolean; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Verifies a `detached digital signature` against the original data contained in `data`. Returns `True` if the signature is verified. The `encodedSig` holds a binary-encoded `PKCS#7 signed-data` detached signature. The type of binary encoding, such as `base64,` `hex,` or `base64_mime,` is determined by the `EncodingMode` property. Afterwards, you can retrieve signer certificates by using the `NumSignerCerts` property and the `LastSignerCert` method. Returns True for success, False for failure. ### Crypt2.VerifyP7M `Chilkat 11.7.0 · pascal · Crypt2 · VerifyP7M · method` ```pascal function VerifyP7M(const p7mPath: string;     const destPath: string): Boolean; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) Verifies an `opaque digital signature` contained in a `.p7m` file and extracts the original data to `destPath`. Returns `True` if the .p7m is validated and the original data was extracted. Otherwise returns `False`. Afterwards, you can retrieve signer certificates by using the `NumSignerCerts` property and the `LastSignerCert` method. Returns True for success, False for failure. ### Crypt2.VerifyP7S `Chilkat 11.7.0 · pascal · Crypt2 · VerifyP7S · method` ```pascal function VerifyP7S(const originalDataPath: string;     const p7sPath: string): Boolean; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) Verifies a `detached digital signature` contained in a `.p7s` file against the original data contained in `originalDataPath`. Returns `True` if the signature is verified. Afterwards, you can retrieve signer certificates by using the `NumSignerCerts` property and the `LastSignerCert` method. Returns True for success, False for failure. ### Crypt2.VerifySbENC `Chilkat 11.7.0 · pascal · Crypt2 · VerifySbENC · method · since 9.5.0.67` ```pascal // sb is a TStringBuilder object. function VerifySbENC(sb: TChilkatBase;     const encodedSig: string): Boolean; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Why Charset Matters in Digital Signatures](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_in_digital_signatures.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Verifies a `detached digital signature` against the original text contained in `sb`. Returns `True` if the signature is verified. The `encodedSig` holds a binary-encoded `PKCS#7 signed-data` detached signature. The type of binary encoding, such as `base64,` `hex,` or `base64_mime,` is determined by the `EncodingMode` property. The `Charset` property determines how the text in `sb` is converted to bytes for signature validation. Afterwards, you can retrieve signer certificates by using the `NumSignerCerts` property and the `LastSignerCert` method. Returns True for success, False for failure. ### Crypt2.VerifyStringENC `Chilkat 11.7.0 · pascal · Crypt2 · VerifyStringENC · method` ```pascal function VerifyStringENC(const str: string;     const encodedSig: string): Boolean; ``` **Full documentation for this method (same in every language):** [About PKCS#7 signed-data Format](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/pkcs7_signed-data.md) · [Why Charset Matters in Digital Signatures](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/charset_matters_in_digital_signatures.md) · [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Verifies a `detached digital signature` against the original text in `str`. Returns `True` if the signature is verified. The `encodedSig` holds a binary-encoded `PKCS#7 signed-data` detached signature. The type of binary encoding, such as `base64,` `hex,` or `base64_mime,` is determined by the `EncodingMode` property. The `Charset` property determines how the text in `str` is converted to bytes for signature validation. Afterwards, you can retrieve signer certificates by using the `NumSignerCerts` property and the `LastSignerCert` method. Returns True for success, False for failure. ### Crypt2.XtsSetDataUnitNumber `Chilkat 11.7.0 · pascal · Crypt2 · XtsSetDataUnitNumber · method · since 9.5.0.91` ```pascal procedure XtsSetDataUnitNumber(loUint32: LongWord;     hiUint32: LongWord); ``` Sets the XTS-AES mode data unit number. The data unit number is a 64-bit unsigned integer. It is passed in as two 32-bit unsigned integers representing the high and low 32-bits. Setting the data unit number is one way of setting the tweak value. The tweak value is 16 bytes in length and can alternatively be set by calling XtsSetEncodedTweakValue. This method sets the tweak value such that the first 8 bytes are composed of the little-endian 64-bit data unit number, followed by 8 zero bytes. (Unfortunately, Chilkat cannot use 64-bit integers in method arguments because many older programming environments, such as ActiveX, do not support it. Chilkat must present an identical and uniform API across all programming languages.) ### Crypt2.XtsSetEncodedTweakKey `Chilkat 11.7.0 · pascal · Crypt2 · XtsSetEncodedTweakKey · method · since 9.5.0.91` ```pascal procedure XtsSetEncodedTweakKey(const key: string;     const encoding: string); ``` Sets the XTS-AES mode tweak key from an encoded string. The encoding argument can be set to any of the following strings: `base64`, `hex`, `quoted-printable`, `ascii`, or `url`. The tweak key should be equal in size to the encryption key. For example, to do 256-bit AES-XTS, the encryption key is 256-bits, and the tweak key is also 256-bits. ### Crypt2.XtsSetEncodedTweakValue `Chilkat 11.7.0 · pascal · Crypt2 · XtsSetEncodedTweakValue · method · since 9.5.0.91` ```pascal procedure XtsSetEncodedTweakValue(const tweak: string;     const encoding: string); ``` Sets the XTS-AES mode tweak value from an encoded string. The encoding argument can be set to any of the following strings: `base64`, `hex`, `quoted-printable`, `ascii`, or `url`. The tweak value must be 16 bytes in length. An application can set the initial tweak value by calling this method, or by calling XtsSetDataUnitNumber (but not both). ## Events and callbacks Chilkat for Pascal supports three synchronous event callbacks: `OnAbortCheck`, `OnPercentDone`, and `OnProgressInfo`. Each is a property of the class; assign a method of one of your own objects (an *of object* handler) to receive the callbacks, or assign `nil` to unhook. The handler types are declared in the `Chilkat.Base` unit: ```pascal TChilkatAbortCheckEvent = function(Sender: TChilkatBase): Boolean of object; TChilkatPercentDoneEvent = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object; TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object; ``` All Chilkat methods are synchronous, so callbacks are invoked on the thread that called the method -- if the method was called from the main thread, it is safe to access UI elements from the handler. The `HeartbeatMs` property controls the frequency of `OnAbortCheck` callbacks (the default of 0 means no AbortCheck events fire). Returning `True` from an `OnAbortCheck` or `OnPercentDone` handler aborts the running method. ### Crypt2.AbortCheck (event) `Chilkat 11.7.0 · pascal · Crypt2 · AbortCheck · event` ```pascal // TChilkatAbortCheckEvent = function(Sender: TChilkatBase): Boolean of object; property OnAbortCheck: TChilkatAbortCheckEvent; ``` Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second. **Event callback implementation:** ```pascal // A handler is a method of one of your own classes, e.g. a form: function TMyObject.Crypt2AbortCheck(Sender: TChilkatBase): Boolean; begin // Called every HeartbeatMs milliseconds while a method is running. // Return True to abort the method; return False to continue. Result := False; end; ``` **To add an event handler:** ```pascal crypt := TCrypt2.Create; crypt.HeartbeatMs := 250; // fire OnAbortCheck 4 times per second crypt.OnAbortCheck := MyObject.Crypt2AbortCheck; ``` ### Crypt2.PercentDone (event) `Chilkat 11.7.0 · pascal · Crypt2 · PercentDone · event` ```pascal // TChilkatPercentDoneEvent = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object; property OnPercentDone: TChilkatPercentDoneEvent; ``` This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100). The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination. To abort the operation, set the `abort` output argument to `True`. This will cause the method to terminate and return a failure status or corresponding failure value. **Event callback implementation:** ```pascal // A handler is a method of one of your own classes, e.g. a form: function TMyObject.Crypt2PercentDone(Sender: TChilkatBase; PctDone: Integer): Boolean; begin // PctDone ranges from 1 to 100. WriteLn('Percent done: ', PctDone); // Return True to abort the method; return False to continue. Result := False; end; ``` **To add an event handler:** ```pascal crypt := TCrypt2.Create; crypt.OnPercentDone := MyObject.Crypt2PercentDone; ``` ### Crypt2.ProgressInfo (event) `Chilkat 11.7.0 · pascal · Crypt2 · ProgressInfo · event` ```pascal // TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object; property OnProgressInfo: TChilkatProgressInfoEvent; ``` This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory. Note: Some Chilkat methods don't fire any ProgressInfo events. **Event callback implementation:** ```pascal // A handler is a method of one of your own classes, e.g. a form: procedure TMyObject.Crypt2ProgressInfo(Sender: TChilkatBase; const Name, Value: string); begin WriteLn(Name, ': ', Value); end; ``` **To add an event handler:** ```pascal crypt := TCrypt2.Create; crypt.OnProgressInfo := MyObject.Crypt2ProgressInfo; ``` ## Related classes [`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Cert.md), [`Http`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Http.md), [`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/JsonObject.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/PrivateKey.md), [`SecureString`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/SecureString.md), [`StringBuilder`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/StringBuilder.md), [`XmlCertVault`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/XmlCertVault.md)