sgcCrypto: Modern Cryptography Library for Delphi & C++ Builder
Included from sgcWebSockets Standard Also sold standalone

sgcCrypto — a Modern Cryptography Library for Delphi & C++ Builder

43 pure Object Pascal units, no components, no design-time footprint: pass TBytes in, get TBytes back. AES-GCM and ChaCha20-Poly1305 for encryption, SHA-3/BLAKE2/Argon2 for hashing, Ed25519/X25519/RSA for signatures and key exchange, X.509 certificate parsing and generation, and post-quantum ML-KEM, ML-DSA and SLH-DSA. Every primitive is implemented directly in the unit you add to your uses clause: no external DLL, no OpenSSL binding, and the same source compiles unchanged from Delphi 7 through RAD Studio 13. sgcCrypto ships free with sgcWebSockets Standard, Professional and Enterprise, and is also sold standalone (bundling the sgcWebSockets Core runtime) for customers who only own Core.

Download Free Trial Browse Features
Full source code
Win32, Win64, Linux64, macOS, iOS & Android
Delphi 7 → 13, Unchanged
Zero External Dependencies
43 pure functions sgcCrypto_*.pas No components. Call a function, get bytes back.
AES-GCM sgcAES_GCM_Encrypt
ChaCha20-Poly1305 sgcChaCha20Poly1305_Encrypt
SHA-3 / SHAKE sgcSHA3_256
Ed25519 / X25519 sgcEd25519_Sign
RSA-PSS sgcRSA_PSS_Sign
ML-KEM / ML-DSA sgcMLKEM_Encapsulate
X.509 / CSR sgcX509_CreateSelfSigned
43 Pure-function units sgcCrypto_*.pas, zero components
6 Capability families Symmetric, hashing, signatures, PKI, PQC, OTP
6 Target platforms Win32, Win64, Linux64, macOS, iOS, Android
3 Post-quantum FIPS standards ML-KEM (203), ML-DSA (204), SLH-DSA (205)
2 Ways to own it Included in an edition, or standalone
BEFORE YOU BUY

Three Things Worth Knowing First

What sgcCrypto is, whether you already own it, and where it runs. All three answers are short.

sgcCrypto is pure functions, not components

Every one of the 43 units exports plain functions and procedures. There is no Tsgc* class, nothing gets RegisterComponents'd, and there is no sgcCrypto_Reg.pas. You call sgcAES_GCM_Encrypt(aKey, aIV, aPlain, aAAD, aTag) the same way you would call any RTL function, from a form, a service, a console app or a thread.

Full source code ships with every license, so the primitives step through in your own debugger rather than disappearing into a binary or a DLL.

Edition overlap

Already own a sgcWebSockets edition?

sgcCrypto ships inside sgcWebSockets Standard, Professional and Enterprise, and inside All-Access, at no extra cost. If you already hold any edition license from Standard up, you already have all 43 units, nothing more to buy.

sgcCrypto exists standalone for the opposite case: you only own sgcWebSockets Core, or no sgcWebSockets license at all, and want the crypto units without licensing a full edition.

Platform scope

sgcCrypto carries no platform guard

Unlike the AI or speech packages, nothing in sgcVer.inc restricts sgcCrypto to Windows. The units are ordinary Object Pascal arithmetic, so they compile for Win32, Win64, Linux64, macOS, iOS and Android from the same source.

The one platform-aware unit, sgcCrypto_Random, selects a CSPRNG backend per target (Windows CryptoAPI, or /dev/urandom elsewhere) behind the same sgcRandomBytes call, so your code never branches on platform.

WHAT IS IN THE BOX

43 Units, Six Capability Families

Every unit is compiled Object Pascal, callable from any Delphi 7 through 13 or C++ Builder project. There is no external DLL, no OpenSSL binding and no code generator: the primitives are implemented directly in the unit you add to your uses clause.

Symmetric5 units

AES, ChaCha20 and the AEAD constructions on top

sgcCrypto_AES covers CBC, GCM and CTR; sgcCrypto_Modes adds ECB, OFB, CFB, ciphertext-stealing CTS, and AES Key Wrap / Key Wrap with Padding (RFC 3394 / 5649); sgcCrypto_CMAC is AES-CMAC. sgcCrypto_ChaCha implements ChaCha20, XChaCha20, Salsa20 and XSalsa20, and sgcCrypto_Poly1305 pairs Poly1305 with them into the ChaCha20-Poly1305 and XChaCha20-Poly1305 AEAD ciphers from RFC 8439. sgcAES_GCM_Decrypt and the Poly1305 verifiers compare the authentication tag in constant time and refuse to return plaintext when it fails.

sgcCrypto_AES sgcCrypto_ChaCha sgcCrypto_Poly1305 FIPS 197 · RFC 8439
Hashing & KDF11 units

SHA-2, SHA-3, BLAKE2, and every mainstream KDF

sgcCrypto_SHA2 and sgcCrypto_Keccak cover SHA-1/2, SHA-3, SHAKE, cSHAKE and KMAC; sgcCrypto_Blake2b and sgcCrypto_Blake2s add BLAKE2. sgcCrypto_HMAC is keyed message authentication. For turning a password into a key: sgcCrypto_KDF (PBKDF2), sgcCrypto_HKDF, sgcCrypto_Scrypt and sgcCrypto_Argon2, which implements all three Argon2 variants, d, i and id, the Password Hashing Competition winner. sgcCrypto_SipHash gives you a fast keyed hash for hash-table keys, and sgcCrypto_TLSH is a fuzzy hash with a similarity-distance function, not a cryptographic digest, useful for near-duplicate detection.

sgcCrypto_Keccak sgcCrypto_Argon2 sgcCrypto_HKDF FIPS 202 · RFC 9106
Signatures & key exchange10 units

Ed25519/Ed448, X25519/X448, secp256k1, Brainpool and RSA

sgcCrypto_Ed25519/Ed448 sign and verify; sgcCrypto_X25519/X448 do the matching Diffie-Hellman. sgcCrypto_ECCurves adds ECDSA and ECDH over secp256k1 and the three Brainpool curves with RFC 6979 deterministic nonces, and sgcCrypto_EC is the JOSE-oriented sibling: sign and verify a JWS directly, ES256/384/512. sgcCrypto_RSA verifies PKCS#1 v1.5 and PSS signatures straight from a PEM key, and sgcCrypto_RSA_Keys goes further with key generation at any bit length, OAEP encryption and DER/PEM export. sgcCrypto_ECIES rounds it out with hybrid seal/open encryption to an X25519 public key.

sgcCrypto_Ed25519 sgcCrypto_ECCurves sgcCrypto_RSA_Keys RFC 8032 · RFC 7748 · RFC 8017
PKI5 units

Read, verify and generate X.509 certificates

sgcCrypto_ASN1 reads DER and PEM and parses PKCS#1/SEC 1 keys; sgcCrypto_DER writes every tag a certificate or CSR needs. sgcCrypto_X509 parses a certificate, verifies it was signed by a given issuer, walks and verifies a chain, and parses a CRL to check revocation. sgcCrypto_X509_Gen generates a self-signed certificate or a PKCS#10 CSR from scratch: full subject and issuer distinguished name, validity window, CA flag with a path-length constraint, key usage flags, extended key usage OIDs and subject alternative names, including IP address SANs.

sgcCrypto_X509 sgcCrypto_X509_Gen sgcCrypto_ASN1 RFC 5280 · RFC 2986
Post-quantum6 units

ML-KEM, ML-DSA and SLH-DSA, plus a hybrid combiner

sgcCrypto_MLKEM is FIPS 203 key encapsulation, three parameter sets (ML-KEM-512/768/1024), with implicit rejection on a malformed ciphertext. sgcCrypto_MLDSA is FIPS 204 signing, ML-DSA-44/65/87. sgcCrypto_SLHDSA is FIPS 205, all six SHAKE parameter sets: 128s, 128f, 192s, 192f, 256s, 256f. Because ML-KEM alone bets everything on a lattice assumption younger than elliptic curves, sgcCrypto_MLKEM_Hybrid combines an X25519 secret and an ML-KEM secret into one shared key, so the result is never weaker than the classical half, the migration pattern the industry is converging on.

sgcCrypto_MLKEM sgcCrypto_MLDSA sgcCrypto_SLHDSA FIPS 203 · FIPS 204 · FIPS 205
OTP & misc6 units

One-time passwords, encoding, and encrypted ZIP entries

sgcCrypto_OTP generates and verifies HOTP and TOTP codes, the same six-digit codes an authenticator app shows, with a constant-time verification window that absorbs clock skew. sgcCrypto_Encoding holds the utility functions the rest of the library shares: constant-time compare, secure buffer zeroing, hex, Base64url and Base32. sgcCrypto_Zip_AE2 implements WinZip AES encryption, AE-1 and AE-2, for encrypting individual ZIP entries. sgcCrypto_Random is the cross-platform CSPRNG behind every key and nonce generated elsewhere in the library, and sgcCrypto_Legacy keeps MD4/MD5/HMAC-MD5/DES-ECB available for interoperability with older formats, not for new designs.

sgcCrypto_OTP sgcCrypto_Encoding sgcCrypto_Zip_AE2 RFC 6238 · RFC 4648
See every unit and function →
QUICK START

No Component, No Object Inspector

Add a unit to uses and call a function. Every call below comes from a different one of the 43 units, spanning symmetric, hashing, signatures and post-quantum.

uses
  sgcCrypto_Random, sgcCrypto_AES, sgcCrypto_Keccak, sgcCrypto_Ed25519,
  sgcCrypto_MLKEM;

var
  vKey, vIV, vPlain, vAAD, vTag, vCipher: TBytes;
  vDigest, vSeed, vSignature, vMessage: TBytes;
  vPublicKey, vPrivateKey, vSharedSecret, vCiphertext: TBytes;
begin
  // AES-256-GCM: authenticated encryption in one call
  vKey    := sgcRandomBytes(32);
  vIV     := sgcRandomBytes(12);
  vPlain  := TEncoding.UTF8.GetBytes('confidential payload');
  vCipher := sgcAES_GCM_Encrypt(vKey, vIV, vPlain, vAAD, vTag);

  // SHA-3-256, one call, no context object to manage
  vDigest := sgcSHA3_256(vPlain);

  // Ed25519: sign, then verify
  vSeed      := sgcRandomBytes(32);
  vMessage   := TEncoding.UTF8.GetBytes('sign me');
  vSignature := sgcEd25519_Sign(vSeed, vMessage);

  // ML-KEM-768: post-quantum key encapsulation (FIPS 203)
  sgcMLKEM_GenerateKeyPair(mlkem768, vPublicKey, vPrivateKey);
  sgcMLKEM_Encapsulate(mlkem768, vPublicKey, vCiphertext, vSharedSecret);
end;
// includes: sgcCrypto_Random.hpp, sgcCrypto_AES.hpp, sgcCrypto_Keccak.hpp,
// sgcCrypto_Ed25519.hpp, sgcCrypto_MLKEM.hpp

// AES-256-GCM: authenticated encryption in one call
TBytes vKey    = sgcRandomBytes(32);
TBytes vIV     = sgcRandomBytes(12);
TBytes vAAD, vTag;
TBytes vPlain  = TEncoding::UTF8->GetBytes("confidential payload");
TBytes vCipher = sgcAES_GCM_Encrypt(vKey, vIV, vPlain, vAAD, vTag);

// SHA-3-256, one call, no context object to manage
TBytes vDigest = sgcSHA3_256(vPlain);

// Ed25519: sign, then verify
TBytes vSeed      = sgcRandomBytes(32);
TBytes vMessage   = TEncoding::UTF8->GetBytes("sign me");
TBytes vSignature = sgcEd25519_Sign(vSeed, vMessage);

// ML-KEM-768: post-quantum key encapsulation (FIPS 203)
TBytes vPublicKey, vPrivateKey, vSharedSecret, vCiphertext;
sgcMLKEM_GenerateKeyPair(mlkem768, vPublicKey, vPrivateKey);
sgcMLKEM_Encapsulate(mlkem768, vPublicKey, vCiphertext, vSharedSecret);
Constant-time where it matters

GCM and Poly1305 tag checks, HOTP/TOTP verification and sgcConstantTimeEquals all compare in constant time, so a failed check does not leak timing information about how close the guess was.

Decapsulation never fails

A malformed ML-KEM ciphertext produces a pseudorandom secret instead of an error, implicit rejection per FIPS 203, so an attacker learns nothing from whether a ciphertext was well formed.

Delphi 7 through 13, unchanged

No native 64-bit integer type is assumed. sgcCrypto_Int64 and TsgcBigInt emulate the arithmetic the hashes, curves and post-quantum units need, so the same source compiles on every supported version.

Nothing leaves your process

Every function runs in-process on data you pass in. There is no network call, no telemetry and no eSeGeCe relay anywhere in the library.

PRICING

Included, or a Standalone Pack

sgcCrypto ships free with sgcWebSockets Standard, Professional and Enterprise. If you only own sgcWebSockets Core, it is also sold as its own pack, starting at €149 for a single developer. All licenses include full source code, 1 year of updates and a 50% to 70% renewal discount: 50% when you renew one pack, 60% for two, 70% for three or more.

sgcCrypto

€149

Standalone pack. Single, Team and Site licenses available. Free if you already own sgcWebSockets Standard, Professional or Enterprise.

  • All 43 sgcCrypto_*.pas units
  • sgcWebSockets Core runtime included
  • Delphi & C++ Builder, all six platforms
  • Full source code
  • 1 year of updates

Already on sgcWebSockets Standard, Professional or Enterprise? sgcCrypto is already in your installer, no order needed.

View Pricing & Order
3,000+Developers
20+Years
761+Components
30+API Integrations
5Platforms
30-Day Money-Back GuaranteeNot satisfied? Request a full refund within 30 days of purchase. See refund policy

Cryptography Without the Component Overhead

43 pure functions covering encryption, hashing, signatures, PKI and post-quantum key exchange, ready wherever your Delphi or C++ Builder code already runs. Full source code, no relay, no DLL.

Download Free Trial View Pricing
MORE FROM ESEGECE

Other Products by eSeGeCe

Pair sgcCrypto with our other Delphi and C++ Builder component libraries.

sgcWebSockets

Enterprise WebSocket, HTTP/2, MQTT, AMQP and WebRTC components. Standard, Professional and Enterprise all include sgcCrypto.

Learn more →

sgcSign

Enterprise digital signatures. XAdES, PAdES, CAdES and ASiC with 10 key providers and 21 EU country profiles.

Learn more →

sgcAuth

OAuth2 client and JWT client components, plus WebAuthn passkey sign-in. Standalone, the sgcWebSockets Core runtime is included.

Learn more →

sgcQUIC

QUIC (RFC 9000) and HTTP/3 (RFC 9114) client and server components built on the native OpenSSL 3.5 QUIC engine.

Learn more →

sgcAI

AI, LLM and MCP components. One chat component reaches OpenAI, Anthropic, Gemini, DeepSeek, Ollama, Grok and Mistral.

Learn more →

sgcMQ

Native MQTT 3.1.1/5.0, AMQP 0.9.1, AMQP 1.0, Apache Kafka and STOMP client components, with the Core runtime bundled.

Learn more →

sgcOpenAPI

OpenAPI 3.0 parser and SDK generator. Turn any OpenAPI spec into a strongly-typed Delphi client in seconds.

Learn more →