Encryption

Fortanix Data Security Manager (DSM) provides multiple interfaces to application developers. For C/C++ programmers, Fortanix DSM provides a PKCS#11 interface through a library. For Java programmers, Fortanix DSM can be accessed through the JCE interface and through Java SDK. Fortanix DSM can also be accessed through its RESTful interface, documented at https://www.fortanix.com/api/

We provide examples for using Fortanix DSM in 7 languages – a C++ program using the PKCS#11 interface, a Java program using the JCE interface, and other programs using the REST interface through Java, Python, Go, C#, PHP and Javascript SDKs

The example programs can be downloaded in full at the Downloads page.

string encrypt(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey, string plain) {
CK_RV rv;
CK_BYTE *iv;
CK_ULONG iv_len;
string iv_b64;
CK_BYTE *cipher;
CK_ULONG cipher_len;
string cipher_b64;

iv_len = (CK_ULONG) AES_KEYLENGTH/8;
iv = (CK_BYTE *)malloc(iv_len * sizeof(CK_BYTE));
CK_MECHANISM mechanism = {
CKM_AES_CBC_PAD, iv, iv_len
};
Base64::Encode(string((char *)iv, iv_len), &iv_b64);

rv = p11->C_EncryptInit(hSession, &mechanism, hKey);
if (rv == CKR_OK) {
rv = p11->C_Encrypt(hSession, (CK_BYTE_PTR) plain.c_str(), plain.length(), NULL, &cipher_len);
if (rv == CKR_OK) {
cipher = (CK_BYTE *)malloc(cipher_len * sizeof(CK_BYTE));
rv = p11->C_Encrypt(hSession, (CK_BYTE_PTR) plain.c_str(), plain.length(), cipher, &cipher_len);
}
}
if (rv != CKR_OK) {
cout << "Encryption failed. Error code = " << rv << endl;
return string();
}
Base64::Encode(string((char *)cipher, cipher_len), &cipher_b64);
return iv_b64 + ":" + cipher_b64;
}

public void encrypt() {
    EncryptRequest encryptRequest = new EncryptRequest(Alg: ObjectType.AES, Mode: CryptMode.CBC, Plain: Encoding.ASCII.GetBytes("Hello World"));
    EncryptionAndDecryptionApi encryptionAndDecryptionApi = new EncryptionAndDecryptionApi();
    EncryptResponse encResp = encryptionAndDecryptionApi.Encrypt(kid, encryptRequest);
}

encryptResponse, err := client.Encrypt(ctx, sdkms.EncryptRequest{
     Key:   sdkms.SobjectByID(*sobject.Kid),
     Alg:   sdkms.AlgorithmAes,
     Plain: []byte("hello, world!"),
     Mode:  sdkms.CryptModeSymmetric(sdkms.CipherModeCbc),
})
if err != nil {
     log.Fatalf("Failed to encrypt: %v", err)
}
fmt.Printf("Ciphertext: %v\n", encryptResponse.Cipher)
fmt.Printf("Initilization Vector: %v\n", *encryptResponse.Iv)

private static EncryptResponse encrypt() {
    String data = "Hello World!";
    byte[] plain = data.getBytes()
    EncryptRequest encryptRequest = new EncryptRequest();
    encryptRequest.alg(ObjectType.AES)
        .plain(plain)
        .mode(CryptMode.CBC);
    try {
        EncryptResponse encryptResponse = 
            encryptionAndDecryptionApi.encrypt(kid, encryptRequest);
        return encryptResponse;
    } catch (Exception e) {
        System.out.println("Encryption failed: " + e);
        return null;
    }
}

def encrypt():
    api_instance = sdkms.v1.EncryptionAndDecryptionApi(api_client=client)
    request = sdkms.v1.EncryptRequest(alg=ObjectType.AES, plain=plain, mode=CipherMode.CBC)
    try:
        encryption_response = api_instance.encrypt(kid, request)
        return encryption_response
    except ApiException as e:
        print("Exception when calling EncryptionAndDecryptionApi->encrypt: %s\n" % e)
        return None

public function encrypt() {
    $cryptMode = new Swagger\Client\Model\CryptMode();
    $encryptionRequestBody = array('alg' => $objType::AES, 'mode' => $cryptMode::CBC, 'plain' => $plain);
    $encryptionRequest = new Swagger\Client\Model\EncryptRequest($encryptionRequestBody);
    $encryptionAndDecryptionApi = new Swagger\Client\Api\EncryptionAndDecryptionApi($client);
    $encryptionResponse = $encryptionAndDecryptionApi->encrypt($securityObjectResponse["kid"], $encryptionRequest);
}

var encryptCallback = function(error, data, response) {
    if (error) {
        console.error("Error: " + JSON.stringify(response));
    } else {
        console.log('Data encrypted successfully. result: ' + JSON.stringify(data));
    }
};

var encryptApi = new FortanixSdkmsRestApi.EncryptionAndDecryptionApi()
var plain = btoa("Hello World!")
var encryptRequest = FortanixSdkmsRestApi.EncryptRequest.constructFromObject({"alg" :"AES", "plain": plain, "mode": "CBC"})
encryptApi.encrypt(data["kid"], encryptRequest, encryptCallback)