qwert

For what purpose is _Crypto_DeriveKey?

7 posts in this topic

I've recently started working with the encryption functions.  I'm able to encrypt and decrypt files just fine.  But I keep noticing references to _Crypto_DeriveKey.  Yet I can't find any explanation of how it fits in.  And the description from msdn isn't any help (to me):

 

The CryptDeriveKey function generates cryptographic session keys derived from a base data value. This function guarantees that when the same cryptographic service provider (CSP) and algorithms are used, the keys generated from the same base data are identical. The base data can be a password or any other user data.

 

What are the intended uses?

Any help will be appreciated.

Share this post


Link to post
Share on other sites



Generates random a key which is constant IMO. For real I don't know what It does...

TD :sweating:


AutoIt.4.Life Clubrooms - Life is like a Donut (secret key)

Spoiler

My contributions to the AutoIt Community

Some messages & Apologizes:

If I hurt you, Please accept my apologies, I never (regardless of the situation) mean to hurt anybody!!!

Also, I am very busy with my project so I will appear in the last row of the online list, if you want to contact me: Email@TheDcoder.xyz

Or you can have a nice chat with me in freenode, I use the same nick on freenode too!

3fHNZJ.gif

PLEASE JOIN ##AutoIt AND HELP THE IRC AUTOIT COMMUNITY!

Share this post


Link to post
Share on other sites

I don't know about Crypto API but when you want to use a symmetric cypher such as AES, you need to use the same shared key for decryption as for encryption. With public-key cryptography (commonly known as being used in certificates for authentication and encryption) you don't have a shared secret key. So you have algorithms to negotiate and compute a shared secret key for this session only (also known as session key), for example by combining both of your public keys. An example of this is Diffie-Hellman key exchange.

It wouldn't be much of a stretch to assume that this is an implementation of such an algorithm. Also make sure you are reading the right documentation: https://msdn.microsoft.com/en-us/library/windows/desktop/aa379916(v=vs.85).aspxAnd in general working with encryption requires a solid understanding of the theory.

Share this post


Link to post
Share on other sites

@Manadar Do you mean that _Crypto_DeriveKey  generates a (constant) key for a session (i.e from start of the program till exit) ?

TD :)


AutoIt.4.Life Clubrooms - Life is like a Donut (secret key)

Spoiler

My contributions to the AutoIt Community

Some messages & Apologizes:

If I hurt you, Please accept my apologies, I never (regardless of the situation) mean to hurt anybody!!!

Also, I am very busy with my project so I will appear in the last row of the online list, if you want to contact me: Email@TheDcoder.xyz

Or you can have a nice chat with me in freenode, I use the same nick on freenode too!

3fHNZJ.gif

PLEASE JOIN ##AutoIt AND HELP THE IRC AUTOIT COMMUNITY!

Share this post


Link to post
Share on other sites

No this primitive generates a key structure from the credential supplied which is suitable for further cryptographic processing.

Say you supply a key = 'abcdef' for encrypting with AES for instance, the call derives (hence its name) a key structure useable by subsequent AES encryption.


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

key structure :blink:?


AutoIt.4.Life Clubrooms - Life is like a Donut (secret key)

Spoiler

My contributions to the AutoIt Community

Some messages & Apologizes:

If I hurt you, Please accept my apologies, I never (regardless of the situation) mean to hurt anybody!!!

Also, I am very busy with my project so I will appear in the last row of the online list, if you want to contact me: Email@TheDcoder.xyz

Or you can have a nice chat with me in freenode, I use the same nick on freenode too!

3fHNZJ.gif

PLEASE JOIN ##AutoIt AND HELP THE IRC AUTOIT COMMUNITY!

Share this post


Link to post
Share on other sites

See MSDN for more details. In short, most if not all crypto standards use a predetermined key size. For instance, AES uses keys of 128, 192 or 256 bits. If your user-level password is 'abc', there is not enough data(*) so your 'abc' (base key) is transformed into a hash and you get a handle to this key block in return from CryptoDeriveKey. Parameters for this call dictate which algorithm will be used and flags allow for flexibility.

(*) Even when your supplied user-level base key is long enough, it is also transformed into a cryptographic hash.


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now