How to encrypt data using a certificate? - public-key-encryption

Question

How do i encrypt data using a "certificate" in the Microsoft Crypto API?
i know how to encrypt data with the Microsoft Crypto API using AES encryption:
keyBlob.hdr.bType := PLAINTEXTKEYBLOB;
keyBlob.hdr.bVersion := CUR_BLOB_VERSION;
keyBlob.hdr.reserved := 0;
keyBlob.hdr.aiKeyAlg := CALG_AES_128;
keyBlob.cbKeySize := 16;
Move(data[0], keyBlob.key[0], 16);
/*
Set ProviderName to either
providerName = "Microsoft Enhanced RSA and AES Cryptographic Provider"
providerName = "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)" //Windows XP and earlier
*/
MS_ENH_RSA_AES_PROV_W: WideString = 'Microsoft Enhanced RSA and AES Cryptographic Provider';
providerName := MS_ENH_RSA_AES_PROV_W;
CryptAcquireContextW(provider, nil, PWideChar(providerName), PROV_RSA_AES, CRYPT_VERIFYCONTEXT);
CryptImportKey(provider, PByte(#keyBlob), sizeof(keyBlob), 0, 0, importedKey);
mode := CRYPT_MODE_CBC;
CryptSetKeyParam(importedKey, KP_MODE, #mode, 0);
//CryptEncrypt encrypts in-place. Copy stuff to be encrypted into new byte buffer
utf8PlainText := TCrypt.WideStringToUTF8(szPlainText);
dataLen := Length(utf8PlainText);
bufferLen := dataLen+16; //allocate a buffer larger than we need to hold the data we want to encrypt
SetLength(data, bufferLen);
Move(utf8PlainText[1], data[0], dataLen);
if not CryptEncrypt(importedKey, 0, True, 0, #data[0], {var}dataLen, bufferLen) then
begin
le := GetLastError;
if le = ERROR_MORE_DATA then
begin
/*
If the buffer allocated for pbData is not large enough to hold the encrypted data,
GetLastError returns ERROR_MORE_DATA and stores the required buffer size,
in bytes, in the DWORD value pointed to by pdwDataLen.
*/
bufferLen := dataLen;
SetLength(data, bufferLen);
CryptEncrypt(importedKey, 0, True, 0, #data[0], {var}dataLen, bufferLen);
end;
CryptDestroyKey(importedKey);
CryptReleaseContext(provider, 0);
end;
Now i need to do the same thing, except rather than symmetric encryption i need to use a public-key to encrypt, and a private key to decrypt.
Note: It took 3 days to come up with those 15 lines of code for symmetric encryption. i'm hoping someone can same me from a week of banging my head against a wall, and i end up going down the wrong path thinking that i have to install OpenSSL. Even worse, if i try to call COM Objects from native code
Note: i only included the code example as a way to fill-up the question with irrelavent junk. Some people vote to close a question if it only contains one line.

Answer 1

Microsoft Crypto API contain high-level functions for asymmetric encryption and decryption with certificates. Look at CryptEncryptessage and CryptDecryptMessage.
In decryption case your CERT_CONTEXT must have a CERT_KEY_PROV_INFO_PROP_ID property.
I can give you an examples of usage:
const wchar_t message[] = L"This is a simple test message.";
PCCERT_CONTEXT hCert = NULL;
HCERTSTORE hStore = NULL;
static bool openCertStoreMY(CDialog *parent)
{
if(!hStore)
{
hStore = CertOpenSystemStore(NULL, L"MY");
if(!hStore)
{
parent->MessageBox(L"Cannot open \"MY\"", L"Error", MB_ICONERROR);
return false;
}
}
return true;
}
void CTestDlg::OnEncryptClicked()
{
if(!hCert)
{
if(!openCertStoreMY(this))
return;
hCert = CryptUIDlgSelectCertificateFromStore(hStore, GetSafeHwnd(), NULL, NULL, 0, 0, 0);
if(!hCert)
return;
}
CRYPT_ENCRYPT_MESSAGE_PARA params;
memset(&params, 0, sizeof(CRYPT_ENCRYPT_MESSAGE_PARA));
params.cbSize = sizeof(CRYPT_ENCRYPT_MESSAGE_PARA);
params.dwMsgEncodingType = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING;
params.ContentEncryptionAlgorithm.pszObjId = "2.16.840.1.101.3.4.1.2"; //AES128
DWORD msz;
DWORD cbMsg = sizeof(message);
const BYTE *pbMsg = (PBYTE)message;
if(!CryptEncryptMessage(&params, 1, &hCert, pbMsg, cbMsg, NULL, &msz))
return;
PBYTE outBuf = new BYTE[msz];
if(CryptEncryptMessage(&params, 1, &hCert, pbMsg, cbMsg, outBuf, &msz))
{
FILE *fil = _wfopen(filename, L"wb");
if(fil)
{
fwrite(outBuf, 1, msz, fil);
fclose(fil);
MessageBox(L"Complete");
}
else
MessageBox(L"Cannot open file", L"Error", MB_ICONERROR);
}
delete [] outBuf;
}
void CTestDlg::OnDecryptClicked()
{
if(!openCertStoreMY(this))
return;
CRYPT_DECRYPT_MESSAGE_PARA params;
params.cbSize = sizeof(CRYPT_DECRYPT_MESSAGE_PARA);
params.dwMsgAndCertEncodingType = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING;
params.cCertStore = 1;
params.rghCertStore = &hStore;
params.dwFlags = 0;
DWORD cbMsg;
PBYTE pbMsg;
FILE *fil = _wfopen(filename, L"rb");
if(fil)
{
fseek(fil, 0 ,2);
cbMsg = ftell(fil);
fseek(fil, 0, 0);
pbMsg = new BYTE[cbMsg];
fread(pbMsg, 1, cbMsg, fil);
fclose(fil);
} else {
MessageBox(L"Cannot open file", L"Error", MB_ICONERROR);
return;
}
DWORD msz;
if(!CryptDecryptMessage(&params, pbMsg, cbMsg, NULL, &msz, NULL))
{
delete [] pbMsg;
return;
}
PBYTE outBuf = new BYTE[msz];
if(CryptDecryptMessage(&params, pbMsg, cbMsg, outBuf, &msz, NULL))
MessageBox((LPCWSTR)outBuf);
delete [] pbMsg;
delete [] outBuf;
}