The CryptoMessage object enables you to encrypt text information directly with a certificate's public key in one easy step. The resultant PKCS#7 encrypted message (also known as "envelope") can only be decrypted with a private key context associated with this certificate. Decryption can take place on the client's machine using the XEncrypt ActiveX control, or on the server.

PKCS#7 envelopes also allow you to encrypt data with multiple certificates at the same time. Any one of the corresponding private keys is sufficient to decrypt the message.

The following code sample demonstrates how to use the CryptoMessage object to encrypt a text string with a certificate. For this code sample to work, you must export your personal certificate to a .cer file and place it on the server.

VBScript
Set CM = Server.CreateObject("Persits.CryptoManager") Set Context = CM.OpenContext( "", True ) Set Msg = Context.CreateMessage( True ) ' Obtain encryption certificate Set Cert = CM.ImportCertFromFile("c:\path\mycert.cer") Msg.AddRecipientCert Cert Encrypted = Msg.EncryptText("my secret phrase")

C#
ICryptoManager objCM = new CryptoManager(); ICryptoContext objContext = objCM.OpenContext( "", true, Missing.Value ); ICryptoMessage objMsg = objContext.CreateMessage( true ); // Obtain encryption certificate ICryptoCert objCert = objCM.ImportCertFromFile( @"c:\path\mycert.cer" ); objMsg.AddRecipientCert( objCert ); txtResult.Text = objMsg.EncryptText("my secret phrase");

The CryptoMessage method EncryptText performs encryption on the specified text string and returns a PKCS#7 envelope which may look similar to the following:

MIICNwYJKoZIhvcNAQcDoIICKDCCAiQCAQAxggHgMIIB3AIBADCBwzCBrjELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJU
UlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMT
LVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbAIQdIendmufMn2Q
RDFiCVP1BTANBgkqhkiG9w0BAQEFAASCAQAb+i9wpStZgR3TfWb+NHg+FduZFQVpCrFaityTREMQ
KB9A+OLBURVStO7RIPODdwvZ7uN3/69tLBrMwckvzXizwiBgLNGE9qtToulaDBIwdxqesN/IU9bU
HcukqUUFtRwS3P6ECsZ+7xuf64QwpouaxiMa4xoaOdEi/CRAxF/sfz2X6D2pCNN7qEy9EVdmjeue
9RgPvmQxQbI7CCP8aixnbdOMw+q9pMAlbqenusxJx6Hot4dTM3wlyG6mXA5mhH1a5PM66vhnuSCe
zy59XXv+KRbZ9cB6v91pKcp7Gj8UfJoYPEDDLJphMl0+UaH9U/0SLINKExt3CcB43buZCH5jMDsG
CSqGSIb3DQEHATAUBggqhkiG9w0DBwQIT1IO/rf63iWAGPAcGb+oHf3fnQD5butjI49SZZjVOcUm
wc==

Even a short string turns into a relatively large encrypted blob because a PKCS#7 envelope also contains the certificate used for encryption.

Before running this code sample, you need to export your personal certificate to a file and change the path argument to ImportCertFromFile, if necessary. Click on the links below to run this code sample.

The following code sample demonstrates this technique:

VBScript

Message = "This is my secret message!!!" ' Prepend message with a CR/LF characters to comply with MIME format Message = chr(13) & chr(10) & Message Set CM = Server.CreateObject("Persits.CryptoManager") Set Context = CM.OpenContext("", True) Set Msg = Context.CreateMessage( True ) ' open encryption certificate Set Cert = CM.ImportCertFromFile("c:\path\mycert.cer") Msg.AddRecipientCert Cert ' Create PKCS#7 envelope Encrypted = Msg.EncryptText(Message) ' Create instance of AspEmail Set Mail = Server.CreateObject("Persits.MailSender") ' Replace with your own SMTP server's address Mail.Host = "smtp.mycompany.com" Mail.Subject = "Sample encrypted message" ' Replace these with your own emails Mail.From = "me@mycompany.com" Mail.AddAddress "someone@hiscompany.com" ' Add custom headers Mail.AddCustomHeader "Content-Type: application/x-pkcs7-mime;name=""smime.p7m""" Mail.AddCustomHeader "Content-Transfer-Encoding: Base64" Mail.AddCustomHeader "Content-Disposition: attachment;filename=""smime.p7m""" Mail.Body = Encrypted Mail.Send

C#

String strMessage = "This is my secret message!!!"; // Prepend message with a CR/LF characters to comply with MIME format strMessage = "\r\n" + strMessage; ICryptoManager objCM = new CryptoManager(); ICryptoContext objContext = objCM.OpenContext("", true, Missing.Value); ICryptoMessage objMsg = objContext.CreateMessage( true ); // open encryption certificate ICryptoCert objCert = objCM.ImportCertFromFile( @"c:\path\mycert.cer" ); objMsg.AddRecipientCert( objCert ); // Create PKCS#7 envelope String strEncrypted = objMsg.EncryptText(strMessage); // Create instance of AspEmail IMailSender objMail = new MailSender(); // Replace with your own SMTP server's address objMail.Host = "smtp.mycompany.com"; objMail.Subject = "Sample encrypted message"; // Replace these with your own emails objMail.From = "me@mycompany.com"; objMail.AddAddress( "someone@hiscompany.com", Missing.Value ); // Add custom headers objMail.AddCustomHeader( "Content-Type: application/x-pkcs7-mime;name=\"smime.p7m\"" ); objMail.AddCustomHeader( "Content-Transfer-Encoding: Base64" ); objMail.AddCustomHeader( "Content-Disposition: attachment;filename=\"smime.p7m\"" ); objMail.Body = strEncrypted; objMail.Send( Missing.Value );

Before running this code sample, you need to specify your own certificate path, SMTP server and email addresses.

Click on the links below to run this code sample.

As of Version 2.6, CryptoKey's EncryptText and EncryptBinary methods can be used not only for symmetric but also for public-key encryption. The encrypted data comes out in the PKCS#1 format and has Little-Endian byte order.

The following code snippet imports a certificate's public key into the CryptoKey object and encrypts some test with it.

VBScript
... Set Cert = CM.ImportCertFromFile( "c:\path\mycert.cer" ) Set Key = Context.ImportKeyFromCert( Cert ) Set Blob = Key.EncryptText( "some text" )

C#
... ICryptoCert objCert = objCM.ImportCertFromFile( @"c:\path\mycert.cer" ); ICryptoKey objKey = objContext.ImportKeyFromCert( objCert ); ICryptoBlob objBlob = objKey.EncryptText( "some text" );

Note that only short strings can be encrypted this way.

To decrypt, CryptoKey's DecryptText and DecryptBinary methods should be used. The decrypting CryptoKey object must be created using a context associated with the proper private key. For example, to decrypt with the private key associated with a certificate residing in the MY store, the following code can be used:

VBScript
... Set Store = CM.OpenStore( "MY", False ) Set Cert = Store.Certificates( "14 cc d0 96 81 78 c8 47 7f 15 0f eb bd 55 0a 57" ) Set Context = CM.OpenContext( Cert.PrivateKeyContext.ContainerName, False ) Set Key = Context.GetUserKey( True ) Decr = Key.DecryptText( Blob )

C#
... ICryptoStore objStore = objCM.OpenStore( "MY", false ); ICryptoCert objCert = objStore.Certificates["14 cc d0 96 81 78 c8 47 7f 15 0f eb bd 55 0a 57"]; ICryptoContext objContext = objCM.OpenContext( objCert.PrivateKeyContext.ContainerName, false, Missing.Value ); ICryptoKey objKey = objContext.GetUserKey( true ); string strDecr = objKey.DecryptText( objBlob );

Note that many public-key encryption packages such as OpenSSL expect the PKCS#1 encrypted data to have Big-Endian byte order. Call the CryptoBlob Reverse method to reverse the byte order if necessary.