43 units, no components, no design-time footprint: pass TBytes in, get TBytes back. AES-GCM and ChaCha20-Poly1305 for encryption, SHA-3, BLAKE2 and Argon2 for hashing and key derivation, Ed25519, X25519 and RSA for signatures and key exchange, X.509 parsing and generation, and post-quantum ML-KEM, ML-DSA and SLH-DSA. No external DLL, no OpenSSL binding, and the same source compiles unchanged from Delphi 7 through RAD Studio 13.
Hashing, authenticated encryption, password storage, signatures and post-quantum key encapsulation, one function call at a time. Narrated, with captions. Nothing downloads until you press play.
The families split by the job you are doing rather than by the mathematics behind it, so the unit you reach for is the one named after the thing you are trying to build.
sgcCrypto_AES covers CBC, GCM and CTR, sgcCrypto_Modes adds ECB, OFB, CFB, ciphertext stealing, AES-CCM and AES Key Wrap. ChaCha20, XChaCha20, Salsa20 and XSalsa20 pair with Poly1305 into the RFC 8439 AEAD ciphers. Decryption compares the tag in constant time and refuses to return plaintext when it fails.
SHA-1, SHA-2, SHA-3, SHAKE, cSHAKE and KMAC, with BLAKE2b and BLAKE2s alongside. PBKDF2, HKDF, scrypt and sgcCrypto_Argon2 with all three variants, d, i and id. sgcCrypto_SipHash for hash-table keys and sgcCrypto_HMAC over any of the digests.
Ed25519 and Ed448 sign, X25519 and X448 do the matching Diffie-Hellman, and sgcCrypto_ECCurves adds ECDSA and ECDH over seven curves with RFC 6979 deterministic nonces and BIP-340 Schnorr signing. RSA keys at any bit length, exported as DER or PEM in PKCS#1 and PKCS#8.
sgcCrypto_X509 parses a certificate, verifies its issuer, walks a chain and reads a CRL. sgcCrypto_X509_Gen generates a self-signed certificate or a PKCS#10 CSR with the full distinguished name, validity, CA flag, key usage, extended key usage and subject alternative names.
FIPS 203 key encapsulation in all three parameter sets, FIPS 204 signing in ML-DSA-44, 65 and 87, and FIPS 205 in all six SHAKE parameter sets. sgcCrypto_MLKEM_Hybrid combines an X25519 secret with an ML-KEM secret, so the shared key is never weaker than the classical half.
sgcCrypto_OTP generates and verifies HOTP and TOTP codes with a constant-time window that absorbs clock skew. Constant-time compare, secure buffer zeroing, hex, Base64url and Base32, WinZip AES AE-1 and AE-2 for ZIP entries, and the cross-platform CSPRNG behind every key.
No object to construct, no context to free, no handle to keep open. Both snippets compile the same in Delphi 7 to 13 and C++ Builder, on every target platform.
uses
sgcCrypto_Random, sgcCrypto_AES, sgcCrypto_Keccak;
var
vKey, vIV, vPlain, vAAD, vTag, vCipher, vDigest: TBytes;
begin
// AES-256-GCM: authenticated encryption in one call
vKey := sgcRandomBytes(32);
vIV := sgcRandomBytes(12);
vPlain := TEncoding.UTF8.GetBytes('confidential payload');
vCipher := sgcAES_GCM_Encrypt(vKey, vIV, vPlain, vAAD, vTag);
// SHA-3-256, one call, no context object to manage
vDigest := sgcSHA3_256(vPlain);
// Decryption checks the tag in constant time and fails closed
vPlain := sgcAES_GCM_Decrypt(vKey, vIV, vCipher, vAAD, vTag);
end;uses
sgcCrypto_Random, sgcCrypto_Ed25519, sgcCrypto_MLKEM;
var
vSeed, vMessage, vSignature: TBytes;
vPublicKey, vPrivateKey, vCiphertext, vSharedSecret: TBytes;
begin
// Ed25519 signature from a 32-byte seed
vSeed := sgcRandomBytes(32);
vMessage := TEncoding.UTF8.GetBytes('sign me');
vSignature := sgcEd25519_Sign(vSeed, vMessage);
// ML-KEM-768: post-quantum key encapsulation (FIPS 203)
sgcMLKEM_GenerateKeyPair(mlkem768, vPublicKey, vPrivateKey);
sgcMLKEM_Encapsulate(mlkem768, vPublicKey, vCiphertext, vSharedSecret);
// The peer recovers the same secret from the ciphertext
sgcMLKEM_Decapsulate(mlkem768, vPrivateKey, vCiphertext, vSharedSecret);
end;TBytes. sgcRandomBytes is the same call on every platform, backed by the right CSPRNG per target.The same shape in Object Pascal and in C++ Builder. Every unit and function is listed in the feature matrix.
sgcCrypto implements the primitives directly rather than binding to a library you also have to ship and version-match, so a key, a digest or a signature is one function call, and full source code means nothing in between is a black box.
Turn a password into a key with PBKDF2, scrypt or Argon2 in all three variants, d, i and id, then compare with the constant-time helper from sgcCrypto_Encoding, so the comparison itself does not leak the answer.
Symmetric (5), hashing and KDF (11), signatures and key exchange (10), PKI (5), post-quantum (6), and OTP and utilities (6). There is no Tsgc* class and no sgcCrypto_Reg.pas: every unit exports plain functions that step through in your own debugger rather than disappearing into a binary.
Nothing in sgcVer.inc restricts sgcCrypto to Windows. The units are ordinary Object Pascal arithmetic, so they compile for Win32, Win64, Linux64, macOS, iOS and Android from one source. sgcCrypto_Random is the one platform-aware unit.
The pack also carries a TLS implementation written on top of the sgcCrypto primitives, in the sgcSSL_NativeTLS* units. Set IOHandler := iohNativeTLS on any sgcWebSockets client or server and there is nothing to deploy. The default group list starts with the X25519MLKEM768 hybrid.
FIPS 197 and 202, RFC 8439, RFC 5280 and FIPS 203, 204 and 205. ML-KEM, ML-DSA and SLH-DSA key generation, signing and verification are checked against the NIST ACVP known-answer vectors in the sgcWebSockets QA suite.
Every unit and function →All 43 units ship inside sgcWebSockets Standard, Professional and Enterprise, and inside All-Access, at no extra cost. Own only sgcWebSockets Core, or no sgcWebSockets license at all? The standalone package bundles the Core runtime with the crypto units. Every license carries full source code and royalty-free deployment.
sgcCrypto is included free from Standard upwards, alongside WebSocket, HTTP/2, MQTT and the rest of the library. If you hold one of these, there is nothing more to buy.
All 43 units with the sgcWebSockets Core runtime bundled in, for developers who own Core alone or hold no sgcWebSockets license. Single, Team and Site licenses.
Every eSeGeCe product for one year, Delphi and .NET, sgcCrypto included, with Premium Support.
The free trial installer is the sgcWebSockets All-Access trial, so all 43 units can be evaluated today.
See sgcCrypto pricingTrusted by Delphi, C++ Builder, Lazarus and .NET developers around the world.
Your sgcWebSockets library is very useful and easy to setup. Keep up the good work!
sgcWebSockets is amazing and your support is the best!
Thanks so much for your help and support, I love your components.
AEAD encryption, hashing, signatures, X.509 and post-quantum cryptography in 43 units, with full source code in the box.
sgcCrypto is one of the eSeGeCe component libraries for Delphi, C++ Builder and .NET. They share conventions, they ship with full source, and they deploy royalty-free.
WebSocket, HTTP/2, MQTT, AMQP, WebRTC, AI and 30+ API integrations for Delphi, C++ Builder, Lazarus and .NET. sgcCrypto is included from its Standard edition up.
XAdES, PAdES, CAdES and ASiC for documents, Authenticode, ClickOnce, NuGet and VSIX for code.
OAuth2 client, JWT client and WebAuthn support for Delphi and C++ Builder.
Raw QUIC transport and an HTTP/3 client and server, with WebTransport. An add-on to sgcWebSockets Enterprise.
Create, edit, view, sign, redact and validate PDF files in pure Object Pascal, with no DLL to deploy.
Packs, add-ons and more
