sgcCrypto is a new general-purpose cryptography library for Delphi and C++ Builder: 43 pure Object Pascal units covering symmetric encryption, hashing, digital signatures, PKI and post-quantum key exchange. There are no design-time components, no Tsgc* classes and nothing to drop on a form. You add a unit to your uses clause and call a function, the same way you would call an RTL routine.
sgcCrypto ships free with sgcWebSockets Standard, Professional and Enterprise, so if you already hold any of those licenses, or All-Access, you already have it, nothing new to install or order. It is also sold as its own standalone pack, bundling the sgcWebSockets Core runtime, for customers who only own Core or no sgcWebSockets license at all.
How It Works
Each unit exports plain functions and procedures that take TBytes in and return TBytes out. There is no context object to allocate, no interface to implement and no sgcCrypto_Reg.pas, because there is nothing to register. Full Pascal source ships with every license, so a primitive steps through in your own debugger instead of disappearing into a DLL or an OpenSSL binding.
Nothing in the library depends on an external library. Every algorithm, from AES to the post-quantum signature schemes, is implemented directly in the unit that exposes it, and the same source compiles unchanged across Delphi 7 through RAD Studio 13, for Win32, Win64, Linux64, macOS, iOS and Android.
uses
sgcCrypto_Random, sgcCrypto_AES, sgcCrypto_Keccak, sgcCrypto_Ed25519,
sgcCrypto_MLKEM;
var
vKey, vIV, vPlain, vAAD, vTag, vCipher: TBytes;
vDigest, vSeed, vSignature, vMessage: TBytes;
vPublicKey, vPrivateKey, vSharedSecret, vCiphertext: TBytes;
begin
// AES-256-GCM: authenticated encryption in one call
vKey := sgcRandomBytes(32);
vIV := sgcRandomBytes(12);
vPlain := TEncoding.UTF8.GetBytes('confidential payload');
vCipher := sgcAES_GCM_Encrypt(vKey, vIV, vPlain, vAAD, vTag);
// SHA-3-256, one call, no context object to manage
vDigest := sgcSHA3_256(vPlain);
// Ed25519: sign a message
vSeed := sgcRandomBytes(32);
vMessage := TEncoding.UTF8.GetBytes('sign me');
vSignature := sgcEd25519_Sign(vSeed, vMessage);
// ML-KEM-768: post-quantum key encapsulation (FIPS 203)
sgcMLKEM_GenerateKeyPair(mlkem768, vPublicKey, vPrivateKey);
sgcMLKEM_Encapsulate(mlkem768, vPublicKey, vCiphertext, vSharedSecret);
end;Symmetric Encryption and AEAD
sgcCrypto_AES covers CBC, GCM and CTR. sgcCrypto_Modes adds ECB, OFB, CFB, ciphertext-stealing CTS, and AES Key Wrap and Key Wrap with Padding (RFC 3394 and RFC 5649), and sgcCrypto_CMAC is AES-CMAC. sgcCrypto_ChaCha implements ChaCha20, XChaCha20, Salsa20 and XSalsa20, and sgcCrypto_Poly1305 pairs Poly1305 with them into the ChaCha20-Poly1305 and XChaCha20-Poly1305 AEAD ciphers from RFC 8439. Every authentication tag, whether GCM or Poly1305, is compared in constant time, so a failed check never leaks how close the guess was.
Hashing, Key Derivation and MACs
sgcCrypto_SHA2 and sgcCrypto_Keccak cover SHA-1/2, SHA-3, SHAKE, cSHAKE and KMAC, and sgcCrypto_Blake2b/Blake2s add BLAKE2. sgcCrypto_HMAC is keyed message authentication. For turning a password into a key there is sgcCrypto_KDF (PBKDF2), sgcCrypto_HKDF, sgcCrypto_Scrypt and sgcCrypto_Argon2, which implements all three Argon2 variants, d, i and id, the Password Hashing Competition winner. sgcCrypto_SipHash gives a fast keyed hash for hash-table keys, and sgcCrypto_TLSH is a fuzzy similarity hash, useful for near-duplicate detection rather than as a cryptographic digest.
Signatures, Key Exchange and PKI
sgcCrypto_Ed25519 and sgcCrypto_Ed448 sign and verify, and sgcCrypto_X25519 and sgcCrypto_X448 do the matching Diffie-Hellman key exchange. sgcCrypto_ECCurves adds ECDSA and ECDH over secp256k1 and the three Brainpool curves with RFC 6979 deterministic nonces, and sgcCrypto_RSA_Keys covers RSA key generation at any bit length, OAEP encryption and PSS signatures.
On the PKI side, sgcCrypto_X509 parses a certificate, verifies it was signed by a given issuer, walks and verifies a chain, and checks a CRL for revocation. sgcCrypto_X509_Gen generates a self-signed X.509 certificate or a PKCS#10 CSR from scratch, including subject alternative names, key usage and CA path-length constraints, on top of a DER writer built for exactly that.
Post-Quantum Cryptography
sgcCrypto also implements the three NIST post-quantum standards. sgcCrypto_MLKEM is FIPS 203 key encapsulation across all three parameter sets, ML-KEM-512, 768 and 1024, with implicit rejection on a malformed ciphertext so a bad input never leaks information. sgcCrypto_MLDSA is FIPS 204 signing, ML-DSA-44/65/87, and sgcCrypto_SLHDSA is FIPS 205 across all six SHAKE parameter sets. Because a lattice assumption is younger than elliptic curves, sgcCrypto_MLKEM_Hybrid combines an X25519 secret with an ML-KEM secret into one shared key, the hybrid migration pattern the industry is converging on.
Availability
sgcCrypto ships free with sgcWebSockets Standard, Professional and Enterprise, and with All-Access. If you already hold any of those licenses, the 43 units are already in your installer, no separate order needed. If you only own sgcWebSockets Core, or no sgcWebSockets license at all, sgcCrypto is also sold as its own standalone pack with the Core runtime bundled in. Every license, included or standalone, ships full Pascal source code and one year of updates.
You can read the full unit reference and try it yourself on the sgcCrypto product page.
Questions or feedback? Get in touch, you will get a reply from the people who wrote the code.