Dh DataFlex Reference Documentation

Dh

Current Version: 11.5.0
Requires Chilkat Bundle License

Chilkat.Dh

Perform Diffie-Hellman shared-secret key exchange.

Chilkat.Dh provides the core operations needed for Diffie-Hellman shared-secret exchange. It allows two parties to agree on a shared secret over an insecure channel by using common Diffie-Hellman parameters, generating public exchange values, and computing the same shared secret from the other party's public value.

Choose known parameters

Use UseKnownPrime when the application wants to use a predefined Diffie-Hellman prime group.

Generate parameters

Use GenPG to generate Diffie-Hellman parameters when custom prime and generator values are required.

Set custom P and G

Use SetPG when the prime and generator are already known or have been received from another party or protocol.

Create the exchange value

Use CreateE to create the public Diffie-Hellman value that is sent to the other party.

Compute the shared secret

Use FindK with the other party's public exchange value to compute the shared secret.

Use the result carefully

The shared secret is typically used as input to a key derivation step before being used for encryption or authentication.

Common pattern: Select or generate the Diffie-Hellman parameters, create your public exchange value with CreateE, exchange public values with the other party, then call FindK to compute the shared secret. The primary methods are UseKnownPrime, GenPG, SetPG, CreateE, and FindK.

For an extended overview, see Dh Class Overview.

Object Creation

// (Dataflex programs use the 32-bit Chilkat ActiveX)
Handle hoDh
Get Create(RefClass(cComChilkatDh)) to hoDh

Properties

DebugLogFilePath
Function ComDebugLogFilePath Returns String
Procedure Set ComDebugLogFilePath String value

If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.

Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.

Possible causes of hangs include:

  • A timeout property set to 0, indicating an infinite timeout.
  • A hang occurring within an event callback in the application code.
  • An internal bug in the Chilkat code causing the hang.

More Information and Examples
Example showing how to use DebugLogFilePath.
top
G
Function ComG Returns Integer

Returns the current Diffie-Hellman generator, g. The generator is the small public integer used with the prime modulus p in the modular exponentiation operations that create the public exchange value and shared secret.

For this class, g is expected to be 2 or 5. Its value is established by UseKnownPrime, GenPG, or SetPG.

Public parameter: The generator is not secret. Both parties must use exactly the same p and g values for the exchange.

top
LastBinaryResult
Function ComLastBinaryResult Returns Variant

This property is mainly used in SQL Server stored procedures to retrieve binary data from the last method call that returned binary data. It is only accessible if Chilkat.Global.KeepBinaryResult is set to True. This feature allows for the retrieval of large varbinary results in an SQL Server environment, which has restrictions on returning large data via method calls, though temp tables can handle binary properties.

top
LastErrorHtml
Function ComLastErrorHtml Returns String

Provides HTML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

top
LastErrorText
Function ComLastErrorText Returns String

Provides plain text information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

More Information and Examples
Concept of LastErrorTextLastErrorText Standard Information
top
LastErrorXml
Function ComLastErrorXml Returns String

Provides XML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

top
LastMethodSuccess
Function ComLastMethodSuccess Returns Boolean
Procedure Set ComLastMethodSuccess Boolean value

Indicates the success or failure of the most recent method call: True means success, False means failure. This property remains unchanged by property setters or getters. This method is present to address challenges in checking for null or Nothing returns in certain programming languages. Note: This property does not apply to methods that return integer values or to boolean-returning methods where the boolean does not indicate success or failure.

top
LastStringResult
Function ComLastStringResult Returns String

In SQL Server stored procedures, this property holds the string return value of the most recent method call that returns a string. It is accessible only when Chilkat.Global.KeepStringResult is set to TRUE. SQL Server has limitations on string lengths returned from methods and properties, but temp tables can be used to access large strings.

More Information and Examples
Long Strings Returned by ActiveX Methods in SQL Server
top
LastStringResultLen
Function ComLastStringResultLen Returns Integer

The length, in characters, of the string contained in the LastStringResult property.

top
P
Function ComP Returns String

Returns the current Diffie-Hellman prime modulus, p, as a hex-encoded SSH1-format bignum. The value is established by UseKnownPrime, GenPG, or SetPG.

The modulus is a safe prime: p = 2q + 1, where q is also prime. Safe-prime groups are commonly used for finite-field Diffie-Hellman because their subgroup structure is well understood.

Encoding note: The returned string is the hexadecimal encoding of an SSH1 bignum, which includes the SSH1 bit-length prefix. It is not simply the conventional hexadecimal representation of the integer p.
Public parameter: The prime modulus is not secret and may be transmitted to the other party. Both parties must use the same p and g.

top
VerboseLogging
Function ComVerboseLogging Returns Boolean
Procedure Set ComVerboseLogging Boolean value

If set to True, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is False. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.

top
Version
Function ComVersion Returns String

Version of the component/library, such as "10.1.0"

More Information and Examples
How to get the Chilkat version at runtime.
top

Methods

CreateE
Function ComCreateE Integer numBits Returns String

Creates this party's public Diffie-Hellman exchange value, conventionally written as E = gx mod p. Before calling this method, initialize the common Diffie-Hellman parameters by calling UseKnownPrime, GenPG, or SetPG.

numBits (numBits) controls the size of the randomly generated private exponent retained internally by this Dh object. Chilkat recommends setting it to twice the desired strength of the symmetric key that will ultimately be derived. For example, use 256 when the protocol will derive a 128-bit key.

The returned E value is a hex-encoded SSH1-format bignum. It is public and is sent to the other party. The size of the eventual shared-secret integer is determined primarily by p; numBits does not make the returned shared secret a fixed-length symmetric key.

Object state: Call FindK on this same Dh object after receiving the other party's exchange value. CreateE stores the corresponding private value internally, and FindK needs it to compute the shared secret. Use a separate Dh object for each party and generate a fresh exchange value for each session.
Authentication required: Basic Diffie-Hellman does not authenticate either party and is vulnerable to a man-in-the-middle attack. The surrounding protocol must authenticate the exchanged parameters and public values.

For language bindings where a string return cannot directly communicate failure, check LastMethodSuccess. If it is FALSE, inspect LastErrorText.

Returns null on failure

More Information and Examples
Diffie-Hellman Key Exchange (DH)
top
FindK
Function ComFindK String E Returns String

Computes the Diffie-Hellman shared secret from the other party's public exchange value. E is the peer's E value, encoded as the hexadecimal representation of an SSH1-format bignum.

This method must be called on the same Dh object that previously called CreateE. Both parties must also be using the same p and g parameters. Internally, the method computes K = Ex mod p, where x is the private value generated by CreateE.

The result is the shared-secret integer K, returned as a hex-encoded SSH1-format bignum. When the exchange is performed correctly, both parties compute the same value.

Do not use the returned text directly as an encryption key: It is an encoded bignum, not a uniformly formatted symmetric key. Feed the shared-secret value into the key-derivation procedure required by the protocol, together with any required transcript, salt, labels, or context. Do not invent an ad hoc conversion when interoperability or cryptographic security matters.
Key agreement is not authentication: Matching shared secrets do not by themselves prove the identity of the peer. Authenticate the exchange to prevent man-in-the-middle attacks.

For language bindings where a string return cannot directly communicate failure, check LastMethodSuccess. If it is FALSE, inspect LastErrorText.

Returns null on failure

More Information and Examples
Diffie-Hellman Key Exchange (DH)
top
GenPG
Function ComGenPG Integer numBits Integer G Returns Boolean

Generates new finite-field Diffie-Hellman parameters and stores them in this object. numBits specifies the size of the safe prime p in bits, and G specifies the generator g, which should be 2 or 5.

On success, the generated values are available through the P and G properties. The prime generation and validation process is computationally expensive, especially for large groups.

Prefer standardized groups: Most applications should use UseKnownPrime or parameters mandated by the surrounding protocol instead of generating a new group. Standardized groups improve interoperability and avoid the cost and risk of custom parameter generation.
Modern key sizes: The legacy 768-, 1024-, and 1536-bit MODP groups are not appropriate for new designs. Use at least a 2048-bit standardized group when compatibility requires finite-field DH; a 3072-bit group is commonly selected when approximately 128-bit classical security is required.

Returns TRUE if the parameters were generated successfully; otherwise returns FALSE. Check LastErrorText for failure details.

Returns True for success, False for failure.

top
SetPG
Function ComSetPG String p Integer g Returns Boolean

Sets explicit finite-field Diffie-Hellman parameters for this object. p is the prime modulus p, supplied as a hex-encoded SSH1-format bignum, and g is the generator g, normally 2 or 5.

The method validates that the supplied values satisfy the requirements expected by this Diffie-Hellman implementation. It returns TRUE if the parameters are accepted; otherwise it returns FALSE.

Encoding requirement: p is not ordinary integer hex. It must contain the hexadecimal encoding of the SSH1 bignum representation, including its bit-length prefix. The P property of another Chilkat Dh object is already in the required form.
Interoperability: Both parties must use exactly the same p and g. These values are public, but untrusted or nonstandard parameters should not be accepted unless the protocol explicitly permits them and their origin is authenticated.

Returns True for success, False for failure.

More Information and Examples
Diffie-Hellman Key Exchange (DH)
top
UseKnownPrime
Procedure ComUseKnownPrime Integer index

Selects one of eight built-in safe-prime MODP groups and sets the object's P and G properties. index is a Chilkat selector from 1 through 8; it is not the IKE group number.

index MODP group Prime bits Definition G
1Group 1768RFC 2409, section 6.12
2Group 21024RFC 2409, section 6.22
3Group 51536RFC 3526, section 22
4Group 142048RFC 3526, section 32
5Group 153072RFC 3526, section 42
6Group 164096RFC 3526, section 52
7Group 176144RFC 3526, section 62
8Group 188192RFC 3526, section 72
Security guidance: Selectors 1, 2, and 3 are legacy groups and should not be chosen for new systems. Selector 4 is the 2048-bit group 14; selector 5 is the 3072-bit group 15 and is commonly used when approximately 128-bit classical security is required. Always use the group required by the protocol or the communicating peer.
Performance: Larger groups require more CPU time and produce larger public values. Choose a group based on the required security level and interoperability requirements, rather than automatically selecting the largest group.
More Information and Examples
Diffie-Hellman Key Exchange (DH)
top