sgcCrypto — a Modern Cryptography Library for Delphi & C++ Builder

sgcCrypto_AES covers CBC, GCM and CTR; sgcCrypto_Modes adds ECB, OFB, CFB, ciphertext-stealing CTS, AES-CCM, and AES Key Wrap / Key Wrap with Padding (RFC 3394 / 5649); sgcCrypto_CMAC is AES-CMAC and AES-GMAC. sgcCrypto_ChaCha implements ChaCha20, XChaCha20, Salsa20 and XSalsa20, and sgcCrypto_Poly1305 pairs Poly1305 with them into the ChaCha20-Poly1305 and XChaCha20-Poly1305 AEAD ciphers from RFC 8439. AES-CCM is the AEAD Zigbee, Bluetooth and the TLS CCM suites name, since it needs nothing beyond the block cipher itself, and CBC and ECB will both take the padding scheme of your choice, PKCS#7, ANSI X9.23, ISO 7816-4 and the rest, for the day you have to read what another system wrote. sgcAES_GCM_Decrypt and the Poly1305 verifiers compare the authentication tag in constant time and refuse to return plaintext when it fails.

sgcCrypto_SHA2 and sgcCrypto_Keccak cover SHA-1/2, SHA-3, SHAKE, cSHAKE and KMAC; sgcCrypto_Blake2b and sgcCrypto_Blake2s add BLAKE2. sgcCrypto_HMAC is keyed message authentication. For turning a password into a key: sgcCrypto_KDF (PBKDF2), sgcCrypto_HKDF, sgcCrypto_Scrypt and sgcCrypto_Argon2, which implements all three Argon2 variants, d, i and id, the Password Hashing Competition winner. sgcCrypto_SipHash gives you a fast keyed hash for hash-table keys, and sgcCrypto_TLSH is a fuzzy hash with a similarity-distance function, not a cryptographic digest, useful for near-duplicate detection.

sgcCrypto_Ed25519/Ed448 sign and verify; sgcCrypto_X25519/X448 do the matching Diffie-Hellman. sgcCrypto_ECCurves adds ECDSA and ECDH over seven curves, secp256k1, the three Brainpool curves and NIST P-256/P-384/P-521, with RFC 6979 deterministic nonces and signatures in the raw or the DER form, and BIP-340 Schnorr signing on top, with the x-only public keys Taproot, Nostr and Lightning expect. sgcCrypto_EC is the JOSE-oriented sibling: sign and verify a JWS directly, ES256/384/512. sgcCrypto_RSA verifies PKCS#1 v1.5 and PSS signatures straight from a PEM key, and sgcCrypto_RSA_Keys goes further with key generation at any bit length, OAEP and PKCS#1 v1.5 encryption, and DER/PEM export in both the PKCS#1 and the PKCS#8 BEGIN PRIVATE KEY form. RSA and EC keys import as readily as they export, DER or PEM, so a key generated once can be saved and loaded again instead of living only as long as the process. sgcCrypto_ECIES rounds it out with hybrid seal/open encryption to an X25519 public key.

sgcCrypto_ASN1 reads DER and PEM and parses PKCS#1/SEC 1 keys; sgcCrypto_DER writes every tag a certificate or CSR needs. sgcCrypto_X509 parses a certificate, verifies it was signed by a given issuer, walks and verifies a chain, verifies a CSR, and parses a CRL to check revocation. sgcCrypto_X509_Gen generates a self-signed certificate or a PKCS#10 CSR from scratch, and a CA issues with sgcX509_CreateSigned or sgcX509_CreateSignedFromCSR: full subject and issuer distinguished name, validity window, CA flag with a path-length constraint, key usage flags, extended key usage OIDs and subject alternative names, including IP address SANs, which now take IPv6 in any RFC 4291 text form, and URI SANs for SPIFFE-style service identities.

Signing is no longer limited to RSA and EC. sgcX509_MLDSAKey and sgcX509_SLHDSAKey wrap a post-quantum key for sgcX509_CreateSelfSignedEx and sgcX509_CreateCSREx, so a certificate or a CSR can be signed with ML-DSA or SLH-DSA. A CA can also certify an ML-KEM public key (RFC 9935), which cannot sign, so possession has to be proved some other way. On the reading side TsgcX509PublicKeyType gained x509pkMLDSA, x509pkSLHDSA and x509pkMLKEM, and sgcX509_VerifyChain now enforces the basicConstraints path length and the nameConstraints extension over dNSName, iPAddress, rfc822Name, uniformResourceIdentifier and directoryName, written on the generating side from PermittedDNSNames, ExcludedDNSNames, PermittedIPRanges and ExcludedIPRanges. An EC certificate still comes out roughly a third the size of an RSA one and verifies far faster, which is why new deployments reach for one.

sgcCrypto_MLKEM is FIPS 203 key encapsulation, three parameter sets (ML-KEM-512/768/1024), with implicit rejection on a malformed ciphertext. sgcCrypto_MLDSA is FIPS 204 signing, ML-DSA-44/65/87. sgcCrypto_SLHDSA is FIPS 205, all six SHAKE parameter sets: 128s, 128f, 192s, 192f, 256s, 256f. Because ML-KEM alone bets everything on a lattice assumption younger than elliptic curves, sgcCrypto_MLKEM_Hybrid combines an X25519 secret and an ML-KEM secret into one shared key, so the result is never weaker than the classical half, the migration pattern the industry is converging on.

The same unit implements X-Wing (draft-connolly-cfrg-xwing-kem-10), X25519 with ML-KEM-768 as one KEM: a 1216-byte public key, a 32-byte private key (the seed), a 1120-byte ciphertext and a 32-byte shared secret, through sgcXWing_GenerateKeyPair, sgcXWing_Encapsulate and sgcXWing_Decapsulate. It also builds the TLS 1.3 hybrid key shares of RFC 10024 for X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024 (IANA codepoints 0x11EC, 0x11EB and 0x11ED). Those three are not standalone KEMs, they only build a TLS key share.

All three algorithms now read and write keys as X.509 SubjectPublicKeyInfo, PKCS#8 OneAsymmetricKey and PEM, so a post-quantum key lives in the same files as an RSA or EC one. ML-DSA and ML-KEM private keys have three forms, picked with TsgcPQCPrivateKeyFormat: pqkfSeed writes the seed alone (32 bytes for ML-DSA, the 64-byte d||z seed for ML-KEM), pqkfExpanded writes the expanded key, pqkfBoth carries both. SLH-DSA has a single private key form. sgcMLDSA_GenerateKeyPairAndSeed and sgcMLKEM_GenerateKeyPairAndSeed hand back the seed alongside the key pair, so a seed-form file can be written straight after generation.

sgcCrypto_OTP generates and verifies HOTP and TOTP codes, the same six-digit codes an authenticator app shows, with a constant-time verification window that absorbs clock skew. sgcCrypto_Encoding holds the utility functions the rest of the library shares: constant-time compare, secure buffer zeroing, hex, Base64url and Base32. sgcCrypto_Zip_AE2 implements WinZip AES encryption, AE-1 and AE-2, for encrypting individual ZIP entries. sgcCrypto_Random is the cross-platform CSPRNG behind every key and nonce generated elsewhere in the library, and sgcCrypto_Legacy keeps MD4/MD5/HMAC-MD5/DES-ECB available for interoperability with older formats, not for new designs.