harmony 鸿蒙Encryption and Decryption with an AES Symmetric Key (CCM Mode) (C/C++)

2025-06-12
浏览 (5)

Encryption and Decryption with an AES Symmetric Key (CCM Mode) (C/C++)

For details about the algorithm specifications, see AES.

Adding the Dynamic Library in the CMake Script

target_link_libraries(entry PUBLIC libohcrypto.so)

How to Develop

Creating an Object

Call OH_CryptoSymKeyGenerator_Create and OH_CryptoSymKeyGenerator_Generate to generate a 128-bit AES symmetric key (OH_CryptoSymKey).

In addition to the example in this topic, AES and Randomly Generating a Symmetric Key may help you better understand how to generate an AES symmetric key. Note that the input parameters in the reference documents may be different from those in the example below.

Encrypting a Message

Call OH_CryptoSymCipher_Create with the string parameter ‘AES128|CCM’ to create a Cipher instance for encryption. The key type is AES128, and the block cipher mode is CCM.
Call OH_CryptoSymCipherParams_Create to create a symmetric cipher parameter instance, and call OH_CryptoSymCipherParams_SetParam to set cipher parameters.
Call OH_CryptoSymCipher_Init to initialize the Cipher instance. Specifically, set mode to CRYPTO_ENCRYPT_MODE, and specify the key for encryption (OH_CryptoSymKey) and the encryption parameter instance (OH_CryptoSymCipherParams) corresponding to the CCM mode.
Call OH_CryptoSymCipher_Update to update the data (plaintext) to be encrypted.

Currently, the amount of data to be passed in by a single update() call is not limited. You can determine how to pass in data based on the data size. > NOTE
> The CCM mode does not support segment-based encryption and decryption.

Call OH_CryptoSymCipher_Final to generate the ciphertext.
- If data has been passed in by OH_CryptoSymCipher_Update, pass in null in the data parameter of OH_CryptoSymCipher_Final.
- The output of OH_CryptoSymCipher_Final may be null. To avoid exceptions, always check whether the result is null before accessing specific data. > NOTE
  > If CCM mode is used, authTag is set in final() as the authentication information initialized during decryption and needs to be saved.
Call OH_CryptoSymCipherParams_Create to create a Params instance, and call OH_CryptoSymCipherParams_SetParam to set authTag as the authentication information for decryption.

In CCM mode, authTag must be of 12 bytes. It is used as the authentication information during decryption. In the example, authTag is of 12 bytes.

Decrypting a Message

Call OH_CryptoSymCipher_Create with the string parameter ‘AES128|CCM’ to create a Cipher instance for decryption. The key type is AES128, and the block cipher mode is CCM.
Call OH_CryptoSymCipherParams_SetParam to set authTag, which must be the same as that set in encryption.
Call OH_CryptoSymCipher_Init to initialize the Cipher instance. Specifically, set mode to CRYPTO_DECRYPT_MODE, and specify the key for decryption (OH_CryptoSymKey) and the decryption parameter instance (OH_CryptoSymCipherParams) corresponding to the CCM mode.
Call OH_CryptoSymCipher_Update to update the data (ciphertext) to be decrypted.

Call OH_CryptoSymCipher_Final to generate the plaintext.
- If data has been passed in by OH_CryptoSymCipher_Update, pass in null in the data parameter of OH_CryptoSymCipher_Final.
- The output of OH_CryptoSymCipher_Final may be null. To avoid exceptions, always check whether the result is null before accessing specific data.

Destroying Objects

Call OH_CryptoSymKeyGenerator_Destroy, OH_CryptoSymCipher_Destroy, OH_CryptoSymKey_Destroy and OH_Crypto_FreeDataBlob to release the allocated memory and destroy the symmetric key, Cipher instance, and Params.

Example

#include "CryptoArchitectureKit/crypto_common.h"
#include "CryptoArchitectureKit/crypto_sym_cipher.h"
#include <string.h>

static OH_Crypto_ErrCode doTestAesCcm()
{
    OH_CryptoSymKeyGenerator *genCtx = nullptr;
    OH_CryptoSymCipher *encCtx = nullptr;
    OH_CryptoSymCipher *decCtx = nullptr;
    OH_CryptoSymKey *keyCtx = nullptr;
    OH_CryptoSymCipherParams *params = nullptr;

    Crypto_DataBlob encData = {.data = nullptr, .len = 0};
    Crypto_DataBlob decData = {.data = nullptr, .len = 0};

    uint8_t aad[8] = {1, 2, 3, 4, 5, 6, 7, 8}; // The aad value here is for reference only.
    uint8_t tag[12] = {0};
    uint8_t iv[7] = {1, 2, 4, 12, 3, 4, 2}; // The iv value here is for reference only.
    Crypto_DataBlob ivData = {.data = iv, .len = sizeof(iv)};
    Crypto_DataBlob aadData = {.data = aad, .len = sizeof(aad)};
    Crypto_DataBlob tagData = {.data = tag, .len = sizeof(tag)};
    Crypto_DataBlob tagOutPut = {.data = nullptr, .len = 0};
    char *plainText = const_cast<char *>("this is test!");
    Crypto_DataBlob msgBlob = {.data = (uint8_t *)(plainText), .len = strlen(plainText)};
    // Generate a symmetric key.
    OH_Crypto_ErrCode ret;
    ret = OH_CryptoSymKeyGenerator_Create("AES128", &genCtx);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymKeyGenerator_Generate(genCtx, &keyCtx);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }

    // Set parameters.
    ret = OH_CryptoSymCipherParams_Create(&params);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipherParams_SetParam(params, CRYPTO_IV_DATABLOB, &ivData);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipherParams_SetParam(params, CRYPTO_AAD_DATABLOB, &aadData);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipherParams_SetParam(params, CRYPTO_TAG_DATABLOB, &tagData);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }

    // Encrypt the message.
    ret = OH_CryptoSymCipher_Create("AES128|CCM", &encCtx);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipher_Init(encCtx, CRYPTO_ENCRYPT_MODE, keyCtx, params);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipher_Update(encCtx, &msgBlob, &encData);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipher_Final(encCtx, nullptr, &tagOutPut);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }

    // Decrypt the message.
    ret = OH_CryptoSymCipher_Create("AES128|CCM", &decCtx);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipherParams_SetParam(params, CRYPTO_TAG_DATABLOB, &tagOutPut);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipher_Init(decCtx, CRYPTO_DECRYPT_MODE, keyCtx, params);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipher_Update(decCtx, &encData, &decData);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }
    ret = OH_CryptoSymCipher_Final(decCtx, nullptr, &decData);
    if (ret != CRYPTO_SUCCESS) {
        goto end;
    }

end:
    OH_CryptoSymCipherParams_Destroy(params);
    OH_CryptoSymCipher_Destroy(encCtx);
    OH_CryptoSymCipher_Destroy(decCtx);
    OH_CryptoSymKeyGenerator_Destroy(genCtx);
    OH_CryptoSymKey_Destroy(keyCtx);
    OH_Crypto_FreeDataBlob(&encData);
    OH_Crypto_FreeDataBlob(&decData);
    OH_Crypto_FreeDataBlob(&tagOutPut);
    return ret;
}