Crypto++ and Qt

[vermarajeev]

Hi guys,

I want to use crypto++ library in a Qt application(3.3.5) developed by me.

For this I have downloded crypto5.4 version and checked the souce files
with some examples. I'm able to get the output.

Now my question is here.
I have a Qt(3.3.5) application like ms paint. It
gererates some text file which needs to be encrypted and decrypted.

There are so many algorithms provided in crypto++ that which one to
use is really confusing.


My requirement is as follows:
I have some text files which I need to encrypt and decrypt. The
encryption should be password protected which means whenever I encrypt
a file a password has to be provided by the user. The other user who
wants to read the data in that file has to first enter a correct
password. If he/she enters correct password, the file is decrypted and
read
else fails.


Now first question is
how do I use crypto++ library in my Qt project???
What is the procedure to include crypto++ library to my project???

The next question is
what algorithm is the best provided by crypto++ for the above scenario???


Details of my project::::
Language: C++
GUI : Qt ( a C++ GUI Tool )
Platform: Windows and Linux
Editor used: On Windows-->Microsoft Visual Studio .NET 2003
On Linux-->Kdevelop

I have also another doubt....In the Links section there is something called
Libraries->Qt Cryptographic Architecture. Can this help me to achieve what
crypto++ provides...If yes please let me know how I can achieve that in my Qt
application

[jacek]

What is the procedure to include crypto++ library to my project???

Add:

INCLUDEPATH += <path to crypto++ includes>
LIBS += -L<path to crypto++ lib directory> -lcrypto++

to your .pro file.

what algorithm is the best provided by crypto++ for the above scenario???

AES256 will be enough for you.

In the Links section there is something called
Libraries->Qt Cryptographic Architecture. Can this help me to achieve what
crypto++ provides...If yes please let me know how I can achieve that in my Qt
application

QCA integrates with Qt more easily and depending on the plugins it can support many different algorithms. Choose the library that fits you better.

[vermarajeev]

Add: to your .pro file.

Ok, the way what you suggested is for linux, What about Windows????? I use Microsoft Visual Studio .NET 2003 on my system. If possible with all the steps

QCA integrates with Qt more easily and depending on the plugins it can support many different algorithms. Choose the library that fits you better.

What is the best option either crypto++ or QCA.... You know my requirement as discussed in above thread. Please dont tell me "Choose the library that fits you better" .

I'm totally confused about which to use either crypto++ or QCA....I feel using QCA will be easier for me as my application is developed using Qt. I just need to encrypt and decrypt some files with password protected.
If I use external library(like crypto++) I need to care of linking it to Qt library.

Please suggest

[jacek]

Ok, the way what you suggested is for linux, What about Windows????? I use Microsoft Visual Studio .NET 2003 on my system. If possible with all the steps

It will work on windows too, provided that you use .pro files.

What is the best option either crypto++ or QCA.... You know my requirement as discussed in above thread. Please dont tell me "Choose the library that fits you better" .

But you have to choose the library, not me. Both of these libraries implement the functionality you need and both are easy to use.

Crypto++ is a single library, while QCA needs a plugin that will implement desired algorithms, so you will have to compile at least three things to make it work and you will have to distribute more files.

[vermarajeev]

It will work on windows too, provided that you use .pro files.


But you have to choose the library, not me. Both of these libraries implement the functionality you need and both are easy to use.

Crypto++ is a single library, while QCA needs a plugin that will implement desired algorithms, so you will have to compile at least three things to make it work and you will have to distribute more files.

So, I think crypto++ is better to use than QCA since I need not distribute more files

I have some idea about to use crypto++ with Qt. Please let me know if I'm wrong

On windows platform
1) In the .pro I include these statements

INCLUDEPATH += <path to crypto++ includes>
LIBS += -L<path to crypto++ lib directory> -lcrypto++

Doubt1: "path to crypto++ includes" ---> I dont want to hard code the path. What is the other alternative???

Probable Solution:According to me I'll create a directory called cryptoInclude and dump all the header files which I downloaded with crypto++. Put this folder(cryptoInclude) whereever my pro file is present, then say INCLUDEPATH += . ./cryptoInclude

Doubt2: OH, I'm confused what to do with "path to crypto++ lib directory"
Hmm! I think I need to put cryptopp( Exports Library file ) and cryptopp.dll ( Crypto++ Library Dll ) into a folder named cryptoLib. Put this folder whereever my pro file is present, then say

LIBS += -L cryptoLib -lcrypto++

2) Using the .pro file generated above create VC++ Project with this command
qmake -project -t vcapp -o proFIlename.pro

3) Load and execute the Qt application using Microsoft Visual Studio .NET 2003.

DO you think when I want to use a particular class of crypto++ library, my Qt application gets compiled.

Please bear with me if I'm talking stupid... This is my new experience
Thanks for your unserstanding

[jacek]

According to me I'll create a directory called cryptoInclude and dump all the header files which I downloaded with crypto++. Put this folder(cryptoInclude) whereever my pro file is present, then say INCLUDEPATH += . ./cryptoInclude

It should work.

I think I need to put cryptopp( Exports Library file ) and cryptopp.dll ( Crypto++ Library Dll ) into a folder named cryptoLib. Put this folder whereever my pro file is present, then say

LIBS += -L cryptoLib -lcrypto++

Yes, that's exactly what you have to do, but with just one little correction: since the import library is called cryptopp.lib, you have to use "-lcryptopp".

Using the .pro file generated above create VC++ Project with this command
qmake -project -t vcapp -o proFIlename.pro

Yes, but if you don't use .pro files at all, you can also do it directly in VC++.

DO you think when I want to use a particular class of crypto++ library, my Qt application gets compiled.

There shouldn't be any problems with it.

[vermarajeev]

Yes, but if you don't use .pro files at all, you can also do it directly in VC++.

How can I do this???? I'm using Microsoft Visual Studio .NET 2003 on my system.

Also one more very improtant problem which is troubling me again and again.

After the installation of Qt3.3.5 on windows, I should get some buttons at the top like( MOC, Open *.pro files etc) but you wont believe I dont have those butons on my editor. Now if I want to moc a file which has Q_OBJECT in it, I have to explicitly set the properties for each *.h files which is really pain...

Is there a document which can solve my this problem?????


I tried the process what I had explained you in above thread. And there are hundreds of warnings....I think I'm going somewhere wrong. I need to find out.

Waiting eagerly for a reply

[jacek]

How can I do this???? I'm using Microsoft Visual Studio .NET 2003 on my system.

Sorry, I don't know, because I don't use VS.

After the installation of Qt3.3.5 on windows, I should get some buttons at the top like( MOC, Open *.pro files etc) but you wont believe I dont have those butons on my editor.

Sounds like you didn't install the Qt-VS integration plugin.

[vermarajeev]

Hi jacek,
I tried the above process to include the INCLUDEPATH and LIBS as discussed above.

First of all
LIBS += -L<path to crypto++ lib directory> -lcryptopp
is for Qt4 and I'm using Qt3.3.5.

To correct above I used this
unix:LIBS += -lcryptopp -L/. ./cryptLib/Debug

The other important issue is
On windows I have linked crypto++ lib successfully. It created cryptopp.lib

then I tried the above process for linux. I get error like cryptopp is not found
at /usr/lib/Id

Then I realized, cryptopp.lib cannot be a library file for linux. I need to first creat a library file for linux environment then I can use above commands.

Now my question is how can I create a library file for linux same as cryptopp.lib on windows

Please help

[jacek]

First of all
LIBS += -L<path to crypto++ lib directory> -lcryptopp
is for Qt4 and I'm using Qt3.3.5.

It works for both Qt3 and Qt4.

To correct above I used this
unix:LIBS += -lcryptopp -L/. ./cryptLib/Debug

It should be:

unix:LIBS += -L/. ./cryptLib/Debug -lcryptopp

Now my question is how can I create a library file for linux same as cryptopp.lib on windows

Use the GNUmakefile file that comes with the sources.

[vermarajeev]

It works for both Qt3 and Qt4..

Oh I didnt know that. Thanks for your correction

Use the GNUmakefile file that comes with the sources.

Which sources???? Where???? What is GNUmakefile????

Please provide some document or something which can help me to solve my problem....

[jacek]

Which sources???? Where????

Crypto++ sources from http://www.cryptopp.com

You use a library and you don't know where to get it?

What is GNUmakefile????

It's a Makefile for GNU make. Every C++ programmer should know what to do with a Makefile.

Please provide some document or something which can help me to solve my problem....

http://www.cryptopp.com/
`man make`

[vermarajeev]

Crypto++ sources from http://www.cryptopp.com
You use a library and you don't know where to get it?

No but I got confused what sources you are taking about...I thought you talked about linux sources...

It's a Makefile for GNU make. Every C++ programmer should know what to do with a Makefile.

Yes I know what a makefile is... Again I got confused with the term GNUmakefile....

Jacek, I'm not a linux expert so having problem to understand the technical terms. But I'm not too bad to grasp it.

Will let you know the status.

Thanks for your understanding

[vermarajeev]

Hi jacek,
One problem in crypto++5.4 library. In the sample code test.cpp provided by crypto++ library, it tells me

- To encrypt a file with AES in CTR mode
	cryptest ae input output

- To encrypt a file with AES in CTR mode
	cryptest ae input output

To copy to clipboard, switch view to plain text mode 

but when I pass these as arguments in command line I get this error

"CryptoPP::Exception caught: AES/CTR: 1 is not a valid key length"

"CryptoPP::Exception caught: AES/CTR: 1 is not a valid key length"

To copy to clipboard, switch view to plain text mode 

Then I went through the code to check what is wrong?? I realized I need to pass 6 arguments namely

cryptest ae key IV input output

cryptest ae key IV input output

To copy to clipboard, switch view to plain text mode 

where IV is initialization vector

Now I have one question, Suppose I have a password "somepassword". How do I calculate key and IV for this somepassword. I tried using some dummy value

"2b7e151628aed2a6abf7158809cf4f3c" as my key;
"000102030405060708090a0b0c0d0e0f" as my initialization vector;

"2b7e151628aed2a6abf7158809cf4f3c" as my key;
"000102030405060708090a0b0c0d0e0f" as my initialization vector;

To copy to clipboard, switch view to plain text mode 

The file got encrypted. But I want to calculate key and IV based on password.

Please tell me using some sample code. I'll be thankful to you...

Then there is another problem.
crypto++ library gives code for only encryption. How can I decrypt the file with same password "somepassword". I tried using decrypt instead of encrypt, but I'm not sure what I'm doing is correct or not.

Here is the sample code for decryption

void AES_CTR_Decrypt(const char *hexKey, const char *hexIV, const char *infile, const char *outfile)
{
  SecByteBlock key = HexDecodeString(hexKey);
  SecByteBlock iv = HexDecodeString(hexIV);
  CTR_Mode<AES>::Decryption aes(key, key.size(), iv);
  FileSource(infile, true, new StreamTransformationFilter(aes, new FileSink(outfile)));
}

void AES_CTR_Decrypt(const char *hexKey, const char *hexIV, const char *infile, const char *outfile)
{
  SecByteBlock key = HexDecodeString(hexKey);
  SecByteBlock iv = HexDecodeString(hexIV);
  CTR_Mode<AES>::Decryption aes(key, key.size(), iv);
  FileSource(infile, true, new StreamTransformationFilter(aes, new FileSink(outfile)));
}

To copy to clipboard, switch view to plain text mode 

[jacek]

To encrypt a file with AES in CTR mode (...)

I would use the CBC mode.

Now I have one question, Suppose I have a password "somepassword". How do I calculate key and IV for this somepassword.

Well... for 128-bit version of AES you need 128-bit key. For example you can compute MD5 hash of the password, which will give you always exactly 128 bits.

As for the IV, you can use a constant one, but of course you can also generate it from the password.

crypto++ library gives code for only encryption. How can I decrypt the file with same password "somepassword". I tried using decrypt instead of encrypt, but I'm not sure what I'm doing is correct or not.

CTR mode works in such way that the decryption scheme is exactly the same as encryption.

If you read the docs closely, you will see that CTR_Mode::Decryption is defined as "typedef Encryption Decryption;".

[vermarajeev]

I would use the CBC mode.

Please explain why????

Yes I had the same problem when initially I went through cryptoPP to decide which algorithm to use. I just started to play with AES in CTR mode as that is the only example provided by cryptoPP.. As suggested by you to use AES256 I'm just trying to to achieve the result.

I know CBC is chaining block cipher and CTR is counter mode. I went through some document explaining AES where I had come across these modes. Let me know why you think you would have used CBC instead of CTR modes?????

Thanks for your understanding

[jacek]

Let me know why you think you would have used CBC instead of CTR modes?

Because in CTR mode encryption and decryption schemes are the same, so if you have an application that only encrypts data, still somebody might use it to decrypt data just by feeding it with the encrypted message. Or worse, suppose that your user wants a more secure encryption, so he decided to encrypt the file twice (never underestimate your users ).

[vermarajeev]

Because in CTR mode encryption and decryption schemes are the same, so if you have an application that only encrypts data, still somebody might use it to decrypt data just by feeding it with the encrypted message. Or worse, suppose that your user wants a more secure encryption, so he decided to encrypt the file twice (never underestimate your users ).

Hi jacek,
Thanks for your interest. Now I'm more clearer....

I have just written a code to encrypt and decrypt the files using AES::CBC mode...It encrypts and decrypts properly...I have made the program to react if the user enter a wrong password. It all became possible coz of your support...

But there is still some problem and let me tell you, very interesting one!!!...

Description
My application is something by which I can draw some diagram. Once I'm satisfied with the structure, I say 'Save'.
My program (or logic)takes the input file say myTest.txt along with a password. Pass these information to the encryptionOrDecryption function defined by me.

int encryptionDecryption(const char* password, const char* inputFile);
Then based on inputFIleName I encrypt or decrypt. If the inputfileName ends with a *.enc I'll decode the file if it is *.txt I'll decode it.

Problem-->
Now In the process discussed, First I use ifstream to open the file, IF the inputFileName ends with *.txt.. I append "enc" so now my inputFileName is *.txt.enc.... Then I push encrypted data to *.txt.enc..

Now this process creates two files 1) *.txt which actual data 2) *.txt.enc with encoded data...

I have to delete *.txt because I dont want the user to see the actual data....
I use "::remove( inputfileName.data() );" to remove the *.txt file...

When I save the file the *.txt file gets deleted properly...But supppose I open the encoded file then decode the file.. This creates a file *.txt with actual data which my program reads to load the structure on the drawing area. The I want to delete it again...The file doesnt get deleted...
Though I remove it after closing the stream as if.close();

The other interesting, if I go and delete the file from outside, I says 'The program is being used by external program and is busy"..I dont know why??? The file proerty shows me 0bytes.. If I double click on the file old contents are shown...The new contents are lost(after I modify the diagram and say save again)...Is that operating system problem????

In this scenario how can I solve the above program????

I hope I was clear....If not please let me know....

Waiting eagerly

[jacek]

The I want to delete it again...The file doesnt get deleted...
Though I remove it after closing the stream as if.close();

The other interesting, if I go and delete the file from outside, I says 'The program is being used by external program and is busy"..I dont know why???

You can use Process Explorer to see whether that file is still opened or not.

But why do you write the unencrypted data to the disk? While your program is running, some other process might read it. It can also be recovered with some file recovery tool.

[vermarajeev]

Hi jacek,
I have finished with the first version of module.
I have some doubts.

1) My code for encryption and decryption will create two files test.ct and test.ct.enc.
test.ct with alphanumeric characters and test.ct.enc with encrypted data. I delete test.ct so that the user cannot view the original text. I retain test.ct.enc back.

Problems-->
I dont want the user to get confused by renaming the file's extension. What I want is, the same file test.ct to be encrypted and retained.

I have some solutions in my mind but is unsure if it is correct.
First, test.ct contains this data

# file version 2
6    2  1    1  4  4  0  0  0       0.9625         0.0125  0  1
6    2  1    2  3  3  0  0  0          0.4              0  0  1

# file version 2
6    2  1    1  4  4  0  0  0       0.9625         0.0125  0  1
6    2  1    2  3  3  0  0  0          0.4              0  0  1

To copy to clipboard, switch view to plain text mode 

My possible solutions-->
Solution1-->

First open the file(test.ct) using a stream. Read the first line. Check if the first line matches '# file version 2'. If yes the file has to be encrypted else decrypt the file.
If yes
Write the encrypted data to a temporary file 'test.ct.enc'. Delete 'test.ct' then rename 'test.ct.enc' to 'test.ct'
Else
Decrypt 'test.ct'. Write original data to temp file 'test.ct.enc'. Read original data from 'test.ct.enc' and delete after processing.

Solution2-->

Take a string 'version2'. Encrypt it with a private password(Known to me and not others). Create a block with encrypted data. Say this is block1.

Encrypt the file contents with the user's password(As done by me now). Say this is block2.

Attach both block1 and block2 in a file. block1 first then block2.

To encrypt or decrypt I enter my private password and check if it is new version.
If yes-->Encrypt
Else
Decrypt...
Here too the same process of creating dummy file exists.

Now according to me the first solution is easy to implement. The second solution is tough as I have to deal with blocks for which I have to be thorough with crypto++. I need to know internally how the classes are written. My deadline is too short to achieve that.

Yesterday I just gave an attempt to get solution2. But found difficult to attach block1 and block2 in a single file.

I'm thorough with filestreams and can produce some efficient code. So dont have problem with solution1.

Now, please help me to achieve some good and best results.

Waiting eagerly