sgcWebSockets includes sgcCrypto, a general purpose cryptography library written entirely in pure Pascal. It has no dependency on OpenSSL or any other external library, and it compiles unchanged from Delphi 7 through Delphi 13, on Win32, Win64, Linux64, macOS and iOS.
The library covers hashing and message authentication, password hashing and key derivation, symmetric encryption, classical public key cryptography, post-quantum cryptography, X.509 certificates, one time passwords, archive encryption and a fuzzy hash for near duplicate detection. It is organized as one unit per algorithm family (sgcCrypto_AES, sgcCrypto_MLKEM, sgcCrypto_TLSH, and so on), so an application only pulls in the code it actually calls.
Every function is a plain call taking and returning TBytes: there are no components to drop on a form and no design time configuration. The implementation of every algorithm listed below was cross checked, byte for byte, against an independent implementation of the same standard (OpenSSL, Python's hashlib/cryptography, or a reference implementation published by the standard's authors) rather than only against its own output, which is what catches a bug that is internally consistent but wrong.
Enabling the library
The cryptography units belong to the Cryptography install package, controlled by the SGC_PACK_CRYPTO conditional define in sgcVer.inc. With the define off, every sgcCrypto_* unit compiles to an empty stub, which keeps the pack out of a build that does not need it. Select the package from the installer, or define SGC_PACK_CRYPTO in your project options if you compile from source.
What is covered on this page
The table below is the complete inventory: every algorithm the library implements, and which unit it lives in. The pages that follow explain each family one by one, with the exact function signatures and a short Delphi example.
| Category | Algorithms | Standard | Unit |
| Hashing | SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 | FIPS 180-4 | sgcCrypto_SHA2 |
| Hashing | SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128, SHAKE256, cSHAKE, KMAC | FIPS 202, SP 800-185 | sgcCrypto_Keccak |
| Hashing | BLAKE2b (keyed, up to 512 bit) | RFC 7693 | sgcCrypto_Blake2b |
| Hashing | BLAKE2s (keyed, up to 256 bit) | RFC 7693 | sgcCrypto_Blake2s |
| Hashing | SipHash-2-4 | — | sgcCrypto_SipHash |
| Hashing | RIPEMD-160, HMAC-RIPEMD160 | ISO/IEC 10118-3, RFC 2286 | sgcCrypto_Legacy |
| Hashing (legacy) | MD4, MD5, DES-ECB, NTLM v1 hash | — | sgcCrypto_Legacy |
| Fuzzy hashing | TLSH digest and distance | — | sgcCrypto_TLSH |
| Message authentication | HMAC-SHA1/256/384/512, HMAC-MD5 | FIPS 198-1 | sgcCrypto_HMAC |
| Message authentication | AES-CMAC | RFC 4493 | sgcCrypto_CMAC |
| Message authentication | AES-GMAC | SP 800-38D | sgcCrypto_CMAC |
| Message authentication | Poly1305 | RFC 8439 | sgcCrypto_Poly1305 |
| Password hashing & KDF | PBKDF2 (SHA-1/256/384/512) | RFC 8018 | sgcCrypto_KDF |
| Password hashing & KDF | KDF1, KDF2, ANSI X9.63 KDF | ISO 18033-2, ANSI X9.63 | sgcCrypto_KDF |
| Password hashing & KDF | scrypt | RFC 7914 | sgcCrypto_Scrypt |
| Password hashing & KDF | Argon2d, Argon2i, Argon2id | RFC 9106 | sgcCrypto_Argon2 |
| Password hashing & KDF | HKDF (SHA-256/384) | RFC 5869 | sgcCrypto_HKDF |
| Symmetric encryption | AES-128/192/256: ECB, CBC, CFB, OFB, CTR, CBC ciphertext stealing, GCM | FIPS 197, SP 800-38A/D | sgcCrypto_AES, sgcCrypto_Modes |
| Symmetric encryption | AES-CBC with no padding, and the PKCS#7, zero, ANSI X9.23, ISO 7816-4, ISO 10126-2 and TBC padding schemes | SP 800-38A, ISO/IEC 9797-1 | sgcCrypto_AES, sgcCrypto_Modes |
| Symmetric encryption | AES-CCM (AEAD) | RFC 3610, SP 800-38C | sgcCrypto_Modes |
| Symmetric encryption | AES Key Wrap, AES Key Wrap with Padding | RFC 3394, RFC 5649 | sgcCrypto_Modes |
| Symmetric encryption | ChaCha20, XChaCha20, Salsa20, XSalsa20 | RFC 8439 | sgcCrypto_ChaCha |
| Symmetric encryption | ChaCha20-Poly1305, XChaCha20-Poly1305 (AEAD) | RFC 8439 | sgcCrypto_Poly1305 |
| Public key cryptography | RSA key generation, RSA-OAEP, RSA-PSS, PKCS#1 v1.5 sign/verify | RFC 8017 | sgcCrypto_RSA_Keys, sgcCrypto_RSA |
| Public key cryptography | RSA PKCS#1 v1.5 encryption | RFC 8017 | sgcCrypto_RSA_Keys |
| Public key cryptography | Ed25519, Ed448 (signatures) | RFC 8032 | sgcCrypto_Ed25519, sgcCrypto_Ed448 |
| Public key cryptography | X25519, X448 (key agreement) | RFC 7748 | sgcCrypto_X25519, sgcCrypto_X448 |
| Public key cryptography | ECIES sealed box encryption | — | sgcCrypto_ECIES |
| Public key cryptography | ECDSA / ECDH on NIST P-256, P-384, P-521 | FIPS 186-5 | sgcCrypto_EC, sgcCrypto_ECCurves |
| Public key cryptography | ECDSA / ECDH on secp256k1, brainpoolP256r1, brainpoolP384r1, brainpoolP512r1 | SEC 2, RFC 5639 | sgcCrypto_ECCurves |
| Public key cryptography | ECDSA DER encoded signatures, raw and DER conversion | RFC 3279 | sgcCrypto_ECCurves, sgcCrypto_EC |
| Public key cryptography | Schnorr signatures on secp256k1 | BIP-340 | sgcCrypto_ECCurves |
| Public key cryptography | RSA and EC key export and import: PKCS#1, PKCS#8, SEC1, SubjectPublicKeyInfo, DER and PEM | RFC 8017, RFC 5958, RFC 5280 | sgcCrypto_RSA_Keys, sgcCrypto_ECCurves |
| Post-quantum cryptography | ML-KEM-512/768/1024, hybrid X25519 + ML-KEM-768 | FIPS 203 | sgcCrypto_MLKEM, sgcCrypto_MLKEM_Hybrid |
| Post-quantum cryptography | ML-DSA-44/65/87 | FIPS 204 | sgcCrypto_MLDSA |
| Post-quantum cryptography | SLH-DSA-SHAKE-128s/128f/192s/192f/256s/256f | FIPS 205 | sgcCrypto_SLHDSA |
| Certificates & PKI | X.509 parsing, chain and CRL verification | RFC 5280 | sgcCrypto_X509 |
| Certificates & PKI | X.509 self-signed certificate and PKCS#10 CSR generation | RFC 5280, RFC 2986 | sgcCrypto_X509_Gen |
| Certificates & PKI | EC signed X.509 certificates and CSRs, URI subject alternative names | RFC 5280, RFC 2986 | sgcCrypto_X509_Gen |
| Certificates & PKI | DER / ASN.1 reader and writer, PEM, Base64 | — | sgcCrypto_ASN1, sgcCrypto_DER |
| One time passwords | HOTP, TOTP | RFC 4226, RFC 6238 | sgcCrypto_OTP |
| Archive encryption | WinZip AE-1 / AE-2 | WinZip AE-2 | sgcCrypto_Zip_AE2 |
| Encoding & utilities | Hex, Base32, Base64url, constant time compare, secure zero, random bytes | RFC 4648 | sgcCrypto_Encoding, sgcCrypto_Random |
Explained one by one
1. Hashing & Message Authentication: SHA-2, SHA-3, SHAKE, BLAKE2, SipHash, HMAC, AES-CMAC and Poly1305, the building blocks almost every other algorithm on this page is built from.
2. Password Hashing & Key Derivation: PBKDF2, scrypt, Argon2id and HKDF. Storing a password and deriving a key from an existing secret are different jobs; this page explains why and which function fits which one.
3. Symmetric Encryption: AES in every mode the library supports, AES key wrapping, ChaCha20/Salsa20 and their Poly1305 AEAD constructions, and why an authenticated mode should be the default choice.
4. Public Key Cryptography: RSA, Ed25519/Ed448 signatures, X25519/X448 key agreement, ECIES, ECDSA/ECDH on the NIST, secp256k1 and Brainpool curves, and BIP-340 Schnorr signatures.
5. Post-Quantum Cryptography: ML-KEM, ML-DSA and SLH-DSA, the three schemes standardized by NIST in FIPS 203-205, and the hybrid construction to deploy today.
6. Certificates & PKI: parsing and verifying X.509 certificates you receive, and generating your own self-signed certificates and PKCS#10 requests, signed with either an RSA or an EC key.
7. One Time Passwords: HOTP and TOTP, the codes an authenticator app produces, including the provisioning URI.
8. Fuzzy Hashing (TLSH): a locality sensitive hash for near duplicate detection, unlike every other hash on this page it is not meant for integrity or security.
9. WinZip AE-2 Archive Encryption: the AES encryption used inside .zip archives, and what it does and does not protect.
Demos
The Demos\18.Cryptography folder has seven runnable applications, one per area above (hashing, symmetric encryption, passwords, public key, post-quantum, certificates, and one time passwords with WinZip AE-2), each showing the API in use and explaining the reasoning behind the recommended choices.