Jump to content
qwert

For what purpose is _Crypto_DeriveKey?

Recommended Posts

qwert

I've recently started working with the encryption functions.  I'm able to encrypt and decrypt files just fine.  But I keep noticing references to _Crypto_DeriveKey.  Yet I can't find any explanation of how it fits in.  And the description from msdn isn't any help (to me):

 

The CryptDeriveKey function generates cryptographic session keys derived from a base data value. This function guarantees that when the same cryptographic service provider (CSP) and algorithms are used, the keys generated from the same base data are identical. The base data can be a password or any other user data.

 

What are the intended uses?

Any help will be appreciated.

Share this post


Link to post
Share on other sites
TheDcoder

Generates random a key which is constant IMO. For real I don't know what It does...

TD :sweating:


AutoIt.4.Life Clubrooms - Life is like a Donut (secret key)

Spoiler

My contributions to the AutoIt Community

If I have hurt or offended you in anyway, Please accept my apologies, I never (regardless of the situation) mean to do that to anybody!!!

3fHNZJ.gif

PLEASE JOIN ##AutoIt AND HELP THE IRC AUTOIT COMMUNITY!

Share this post


Link to post
Share on other sites
jvanegmond

I don't know about Crypto API but when you want to use a symmetric cypher such as AES, you need to use the same shared key for decryption as for encryption. With public-key cryptography (commonly known as being used in certificates for authentication and encryption) you don't have a shared secret key. So you have algorithms to negotiate and compute a shared secret key for this session only (also known as session key), for example by combining both of your public keys. An example of this is Diffie-Hellman key exchange.

It wouldn't be much of a stretch to assume that this is an implementation of such an algorithm. Also make sure you are reading the right documentation: https://msdn.microsoft.com/en-us/library/windows/desktop/aa379916(v=vs.85).aspxAnd in general working with encryption requires a solid understanding of the theory.

Share this post


Link to post
Share on other sites
TheDcoder

@Manadar Do you mean that _Crypto_DeriveKey  generates a (constant) key for a session (i.e from start of the program till exit) ?

TD :)


AutoIt.4.Life Clubrooms - Life is like a Donut (secret key)

Spoiler

My contributions to the AutoIt Community

If I have hurt or offended you in anyway, Please accept my apologies, I never (regardless of the situation) mean to do that to anybody!!!

3fHNZJ.gif

PLEASE JOIN ##AutoIt AND HELP THE IRC AUTOIT COMMUNITY!

Share this post


Link to post
Share on other sites
jchd

No this primitive generates a key structure from the credential supplied which is suitable for further cryptographic processing.

Say you supply a key = 'abcdef' for encrypting with AES for instance, the call derives (hence its name) a key structure useable by subsequent AES encryption.


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites
jchd

See MSDN for more details. In short, most if not all crypto standards use a predetermined key size. For instance, AES uses keys of 128, 192 or 256 bits. If your user-level password is 'abc', there is not enough data(*) so your 'abc' (base key) is transformed into a hash and you get a handle to this key block in return from CryptoDeriveKey. Parameters for this call dictate which algorithm will be used and flags allow for flexibility.

(*) Even when your supplied user-level base key is long enough, it is also transformed into a cryptographic hash.


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×