Component General Information

1. What is Polar Crypto Light?

Polar Crypto Light is a feature-rich ActiveX component. It can be used in all your applications whenever secure information and data integrity are needed, for example:

- In all business transactions applications where absolute confidentiality is needed.

- In an e-commerce web site applications that store sensitive information such as clients' credit cards details.

- In a desktop applications that encrypt confidential files on your computer or computer network.

2. Current features

  1. Encryption/Decryption

    • Encrypt strings,buffers (Encrypt Method,Decrypt Method)

    • Encrypt files (EncryptFile Method,DecryptFile Method)

    • Use the 256 bit keys symmetric AES keys

  2. General process information

  • Use the OnError Event to detect any errors in the encryption/decryption process

  • ProcessingStatus Event will tell you the current status of the operation


Description of algorithms used in the component

1. Advanced Encryption Standard (AES)
2. Industry standards

The Advanced Encryption Standard (AES)

To get a better picture of the secuirity of, say, 128-bit key AES encryption, here is what Mr. Schneier says about it in his 'Secrets & Lies' book:

Even a machine a billion times as fast as Deep Crack [today's one of the most advanced brute-force attack machine, which computes 90 billions keys per second!] would take a million years to try all 2^112 keys and recover the plaintext; [and] over a thousand times longer for a 128-bit key. This will be secure for a millennium.

Now try to imagine the strength of AES encryption incorporated in Polar Crypto using the full 256-bit key!

References
B. Schneier, "Secrets and Lies", p. 100.
http://csrc.nist.gov/encryption/aes/
http://csrc.nist.gov/encryption/aes/rijndael/
http://www.esat.kuleuven.ac.be/~rijmen/rijndael/

Industry standards

Advanced Encryption Standard (AES)

The U.S. National Institute of Standards and Technology (NIST) has been working with the industry and the cryptographic community to develop an Advanced Encryption Standard (AES) to replace the obsolete Data Encryption Standard (DES), which was introduced way back in 1977.

The overall goal was to develop a standard that specifies an encryption algorithm capable of protecting sensitive government information well into the 21st century. The AES is the Rijndael algorithm, the winner of a three-year competition involving some of the world's leading cryptographers. It will be used by U.S. Government organizations to protect sensitive (unclassified) information. It is also anticipated that the AES will be widely used on a voluntary basis by organizations, institutions, and individuals outside of the U.S. Government and outside of the United States as well.

The AES is a block cypher that uses long keys (128-, 192-, 256-bit) for data encryption. It was developed by Belgian cryptographers Joan Daemen and Vincent Rijmen. Both are highly regarded experts within the international cryptographic community.

Polar Crypto was the first encryption component software product that fully integrated the new AES.


What about compatibility?

Compatibility with different development tools

Polar Crypto works with all major Windows™ development languages and platforms including:

      • MS Visual Basic,

      • MS Visual C++,

      • MS Visual InterDev,

      • MS Access,

      • MS FoxPro for Windows,

      • Microsoft Office,

      • Borland Delphi,

      • Borland C++Builder,

      • PowerBuilder,

      • Any other 32-bit visual programming environment that supports ActiveX technology,

      • It can also be used in web scripting languages, your ASP and DCOM projects, regardless of what developing tool you are using for web development.

Trademarks

Microsoft, Windows, MS Visual C++, MS Word, MS Excel, MS FoxPro, MS Internet Explorer, ASP, MS Visual Basic, MS Office, ActiveX, .NET, Visual Studio .NET, are registered trademarks of Microsoft Corporation. Inprise, Borland, Borland C++Builder, Borland Delphi are registered trademarks of Inprise Corporation, PowerBuilder is registered trademark of Sybase, Inc. or its subsidiaries.


What is inside this component?

1. What do you get within the Polar Crypto Light Component?

In both cases, whether you are installing the trial or the release version, you will get all the needed files with all the available functionality. The trial version is limited in the way that it onyl uses 32-bit key AES and Twofish encryption, together with the limited RSA public key encryption.

2. What does the installation of the Polar Crypto Light Component include?

Polar Crypto Light Component:

  • polarcryptolight.dll Polar Crypto Light dynamic-link library and ActiveX control (both in one file,installed in the WIN/SYSTEM directory)

Polar Crypto Light Documentation:

  • polarcrypto20light.chm Developer's on-line Documentation

  • License.txt License agreement

  • ReadMe.txt Information about installation, registration, etc.

Polar Crypto Light Sample Files:

  • Source code for the samples written in Visual Basic 6.0 (using ActiveX)

  • Source code for the sample written in Visual C++ 6.0 (using ActiveX)

  • Source code for the sample written in Borland Delphi (using ActiveX)

  • Source code for the ASP Sample

Demo Browser (for easier browsing through the samples)

3. Redistributing applications

The table below shows all the files necessary for the Polar ActiveX controls to operate properly. If you have purchased the Polar Crypto Light Component and are deploying an application, you must ensure that the first three groups of the files listed below exist on your client's machine and are the proper version.

If your client's machine has older versions, they should be updated.

1. POLARCRYPTOLIGHT.DLL

2. OLE32.DLL

OLEAUT32.DLL

3. KERNEL32.DLL

USER32.DLL
GDI32.DLL
SHELL32.DLL
ADVAPI32.DLL

4. Attention!

If you are using the polarcryptolight.dll you do not need these external dependencies as polarcryptolight.dll is a pure Win32 DLL.

polarcryptolight.dll is the Polar Crypto Light Component's re-distributable file. This file may be in the Windows system directory, in the computer's path or for WinNT and Win95, in the directory specified by your application's Per Application Path key in the Registry Database. The .OCX file must be registered on each user's machine. The Polar Crypto Light Component Setup program registers the OCXs on your development machine.

To register an OCX on the user's machine, use the REGSVR32.EXE utility, which is available from Microsoft. To run this utility, type in the following at the command prompt on each user's machine:

regsvr32 filename

The second group of files are Microsoft re-distributable files necessary for the ActiveX control to operate. Your programming environment should have installed and registered these files. If they were not installed or they are older versions, the Polar Crypto Light Component installer updated and registered them. Copy these files from your development machine to your user's machine.

Our ActiveX controls require OLE2 support to be installed on a machine. In order to run an application containing one of our controls you must ensure that OLE2 has been installed on the user's machine. The third group of files in the table list are the OLE2 files accessed by the Polar Crypto Light Component. Normally, copying these files to the user machine is all that is required.

The fourth group of files should be present on any system running Windows. You should not remove or update these files. They are included only to form a complete list of files needed to use the Polar Crypto Light Component.


Technical support

We are doing our best to keep our support pages and all our support services informative and versatile. As you can see, there are various ways you can communicate with us and with other Polar Crypto users.

Polar Crypto home page

This is the starting page for all Polar Crypto users. Get the latest info on Polar Crypto and learn about exciting new features and updates.
www.polarsoftware.com/products/crypto/index.html

Request a feature

Please feel free to let us know if you find some particular feature appealing or if you need a feature that is not already provided.
www.polarsoftware.com/support/feature/index.html

Report a problem

Have problems using Polar Crypto? If you cannot find an answer to your specific problem in this help file, please feel free to contact us:
www.polarsoftware.com/support/problem/index.html

Web forum

A great meeting place for all Polar customers. Enrich your knowledge base on Polar Crypto and meet other Polar development gurus on-line!
www.polarsoftware.com/support/forum/index.asp

eNewsletter

Like to hear news right from the source? We invite you to subscribe to our free e-mail newsletter. Published monthly, the Polar eNewsletter contains the latest news about Polar software products, services, tips & handy suggestions, special events at our web site as well as promotional offers.
www.polarsoftware.com/support/newsletter/index.html


With the Microsoft Visual Basic

In order to insert the Polar Crypto Light 2.0 ActiveX Control in your project, follow these steps:

  1. Install the component on your system by starting its setup program.

  2. In the Visual Basic compiler IDE, create a new project or open an existing one.

  3. Click the right mouse button over the Toolbox toolbar to get the pop-up menu.

  4. In the menu choose the "Components" option to start the dialog box.

  5. Find the "Polar Crypto Light 2.0 ActiveX Control" in the dialog box's list of available controls, and select the check-box on it's right.

  6. Click "OK" to leave the dialog box.

  7. You should now see the icon representing the control that you chose on the Toolbox toolbar. You can use Polar Crypto Light 2.0 just like any other Windows control.

  8. Draw the control onto the dialog resource as a child control or manually add the member object onto your dialog form the Polar Crypto Light 2.0 ActiveX Control.


With the Microsoft Visual C++

In order to insert the Polar Crypto Light 2.0 ActiveX Control in your project, follow these steps:

  1. Install the component into your system by starting its setup program.

  2. In the Visual C++ compiler IDE, create a new project or open an existing one.

  3. From the "Project" menu select "Add To Project" / "Components and Controls".

  4. In the "Registered ActiveX Controls" directory select "Polar Crypto Light 2.0 ActiveX Control".

  5. Click the "Insert" button.

  6. Click "OK" on the next dialog box. The compiler will insert the control into your project and will generate its wrapper classes.

  7. Click the "Close" button if you want to finish adding the controls to your project.

  8. You can now Polar Crypto just like any other Windows control.

  9. In the Resource Editor Components toolbar, you should see an icon representing the Polar Crypto Light 2.0 ActiveX Control. You can either draw the control onto the dialog resource as a child control or you can manually add a member object onto your dialog form.


With the Borland Delphi

In order to the insert the Polar Crypto Light 2.0 ActiveX Control Control into your project, follow these steps:

  1. Install the component on your system by starting its setup program.

  2. In the Borland Delphi compiler IDE, create a new project or open an existing one.

  3. In the main menu, choose the "Component" / "Import ActiveX control" option to start the dialog box.

  4. Find the "Polar Crypto Light 2.0 ActiveX Control" in the dialog box's list of available controls and select it.

  5. Click the "Install" button.

  6. In the next dialog box that appears click "OK".

  7. In the next dialog box that appears click "OK" to rebuild the package.

  8. After the package is built, you have to close two more dialogs by clicking "OK".

  9. You should now see an icon on the Component Palette in the ActiveX component's tab representing the chosen control.

  10. You can no use Polar Crypto just like any other Windows control.

  11. Draw the control onto the dialog resource as a child control or manually add the member object onto your dialog


With the Borland C++ Builder

In order to insert the Polar Crypto Light 2.0 ActiveX Control into your project, follow these steps:

  1. Install the component on your system by starting its setup program.

  2. In the Borland Builder compiler IDE, create a new project or open an existing one.

  3. In the main menu, choose the "Component" / "Import ActiveX control" option to start the dialog box.

  4. Find "Polar Crypto Light 2.0 ActiveX Control" in the dialog box's list of available controls and select it.

  5. Click the "Install" button.

  6. In the next dialog box that appears click "OK".

  7. In the next dialog box that appears click "Yes" to rebuild the package.

  8. After the package is built, you have to close one more dialog box by clicking "OK".

  9. You should now see an icon on the Component Palette in the ActiveX component's tab representing the chosen control.

  10. You can now use Polar Crypto just like any other Windows control.

  11. Draw the control onto the dialog resource as a child control or manually add the member object onto your dialog form.


CryptoLight Object

The CryptoLight object represents the control, and does all the encryption/decryption operations.

Properties

AllowErrorReporting Property

Password Property

Methods
Encode Method

Decode Method

Decrypt Method

DecryptFile Method

Encrypt Method

EncryptFile Method

Events

Error Event

ProcessingEnded Event

ProcessingStarted Event

ProcessingStatus Event

List of the enumerations

pceErrorConstants Enumeration

pcfEncodingFormat Enumeration

pcmProcessingMode Enumeration


AllowErrorReporting Property

See Also

Defines how the component handles errors when they occur.

Syntax

object.AllowErrorReporting[ = value] As Boolean

The AllowErrorReporting property syntax consists of the following parts:

Part

Description

value

A Boolean expression defining whether errors will be reported or not

Settings

The settings for Value are:

Value

Description

True | Methods returns a specific error code that can be caught with the OnError (VB) or try-catch block (VC++)
False | Methods always returns S_OK value

Remarks

Default value is True.


Password Property

See Also Example

Defines the password used for the creation of the key for encryption/decryption purposes. 256-bit key is created using AES algorithm , in CBC mode with NULL initialization vector.

Syntax

object.Password[ = value] As String

The password property syntax consists of the following parts:

Part

Description

value

A String expression defining the passowrd

Remarks

An empty string (obj.Password="") will generate an error. This property is not persistable.

Example

CryptoLight1.Password = "MyPassword"

txtOutputText.Text = StrConv(CryptoLight1.Decrypt(txtInputText.Text), vbUnicode)


Encode Method

See Also

Encodes the input data into chosen format.

Syntax

Function Encode(vData, [Format As pcfEncodingFormat = pcfBase64]) As String

Dll syntax

LONG pcDecryptFile( HPCRYPTKEY hKey, char* pszSrcFileName,char* pszDestFileName )

The Encode method syntax consists of the following parts:

Part

Description

vData | A Variant containing data to be encoded (String or Blob)
Format | A pcfEncodingFormat enumeration value defining the type of the output data (Base64 or Hex).

Return value

Returns variant with encoded data if the function succeeded, otherwise empty variant. Output variant is String.

Example

txtOutputText.Text = CryptoLight1.Encode(txtInputText.Text, pcfBase64)


Decode Method

See Also

Decodes the input data into the original form.

Syntax

Function Decode(vData, [Format As pcfEncodingFormat = pcfBase64])

Dll syntax

LONG pcDecryptFile( HPCRYPTKEY hKey, char* pszSrcFileName,char* pszDestFileName )

The Decode method syntax consists of the following parts:

Part

Description

vData | A Variant containing data to be decoded (String or Blob)
Format | A pcfEncodingFormat enumeration value defining the type of the output data (Base64 or Hex).

Return value

Returns variant with decoded data if the function succeeded, otherwise empty variant. Output variant is Blob that can be converted to a string with CryptoLight1.Encode(vBlob, pcfBinary).

Example

'decoded data is in the form of a byte array

Data = CryptoLight1.Decode(txtInputText.Text, pcfBase64)

'here we convert the byte array to string

txtOutputText.Text = CryptoLight1.Encode(Data , pcfBinary)


Encrypt Method

See Also Example

Encrypts the sent data.

Syntax

Function Encrypt(vData)

The Encrypt method syntax consists of the following parts:

Part

Description

vData

A Variant containing data to be decoded (String or Blob)

Return value

Returns the variant object containing the encrypted data if the function succeeded, otherwise returns empty variant. Output variant is a blob (byte array) that can be converted to a string with CryptoLight1.Encode(vBlob, pcfBinary).

Example

CryptoLight1.Password = txtPassword.Text

vOutput = CryptoLight1.Encrypt(txtInputText.Text)

' if you want to convert vOutput data to string use the following:

txtOutputText.Text = CryptoLight1.Encode(vOutput, pcfBinary)


Decrypt Method

See Also Example

Decrypts the sent data.

Syntax

Function Decrypt(vData)

The Decrypt method syntax consists of the following parts:

Part

Description

vData

A Variant containing data to be decoded (String or Blob)

Return value

Returns the variant object containing the decrypted data if the function succeeded, otherwise returns empty variant. Output variant is a blob (byte array) that can be converted to a string with CryptoLight1.Encode(vBlob, pcfBinary).

Example

CryptoLight1.Password = txtPassword.Text

vOutput = CryptoLight1.Encrypt(txtInputText.Text)

' if you want to convert vOutput data to string use the following:

txtOutputText.Text = CryptoLight1.Encode(vOutput, pcfBinary)


EncryptFile Method

See Also Example

Encrypts the file.

Syntax

Function EncryptFile(SrcFileName As String, DestFileName As String, [bOverwriteExisting As Boolean = True]) As Long

The DecryptFile method syntax consists of the following parts:

Part

Description

SrcFileName | A String representing the name of the file to be encrypted.
DestFileName | A String representing the name of the resulting encrypted file.
bOverwriteExisting | A Boolean value defining whether the DestFileName file will be overwritten or no, if already exists. This optional parameter is TRUE by default.

Return value

Returns 0 if the file was decrypted successfully, otherwise returns the error code.

Example

CryptoLight1.Password = txtPassword.Text

I = CryptoLight1.EncryptFile(txtInputFile.Text, txtOutputFile.Text)


DecryptFile Method

See Also Example

Decrypts the file.

Syntax

Function DecryptFile(SrcFileName As String, DestFileName As String, [bOverwriteExisting As Boolean = True]) As Long

The DecryptFile method syntax consists of the following parts:

Part

Description

SrcFileName | A String representing the name of the file to be decrypted.
DestFileName | A String representing the name of the resulting decrypted file.
bOverwriteExisting | A Boolean value defining whether the DestFileName file will be overwritten or no, if already exists. This optional parameter is TRUE by default.

Return value

Returns 0 if the file was decrypted successfully, otherwise returns the error code.

Example

CryptoLight1.Password = txtPassword.Text

I = CryptoLight1.DecryptFile(txtInputFile.Text, txtOutputFile.Text)


Error Event

See Also Example

This event occurs when an error occurs while processing.

Syntax

CryptoLight_Error(ErrorCode As pceErrorConstants, ErrorDescription As String)

The Error event syntax consists of the following parts:

Part

Description

ErrorCode | An pceErrorConstants enumeration value defining the error number
ErrorDescription | A String expression containing the error description

Example

Private Sub CryptoLight1_Error(ByVal ErrorCode As CryptoLightLibCtl.pceErrorConstants, ByVal ErrorDescription As String)

MsgBox ErrorDescription

End Sub


ProcessingEnded Event

See Also

This event occurs when the processing ends.

Syntax

PolarCrypto_ProcessingEnded()


ProcessingStarted Event

See Also

This event occurs just before the processing starts.

Syntax

PolarCrypto_ProcessingStarted()


ProcessingStatus Event

See Also

This event occurs during the processing allowing you to track its progress.

Syntax

PolarCrypto_ProcessingStatus(Percent As Long, pAbort As Boolean)

The ProcessingStatus event syntax consists of the following parts:

Part

Description

Percent | A Long expression representing the percentage of the completed processing [0-100]
pAbort | A Boolean expression defining whether to abort the processing or not

Remarks

pAbort parameter can be used to abort processing. It is initially set to False, but user can set it to True, in which case processing (encryption/decryption) will be aborted.


Encrypt/Decrypt Files

This small example shows how to encrypt and decrypt files.

Private Sub cmdEncryptFile_Click()

CryptoLight1.Password = txtPassword.Text

I = CryptoLight1.EncryptFile(txtInputFile.Text, txtOutputFile.Text)

End Sub

Private Sub cmdDecryptFile_Click()

CryptoLight1.Password = txtPassword.Text

I = CryptoLight1.DecryptFile(txtInputFile.Text, txtOutputFile.Text)

End Sub

Private Sub CryptoLight1_Error(ByVal ErrorCode As Long, ByVal ErrorDescription As String)

MsgBox ErrorDescription

End Sub


Encrypt/Decrypt Text

This small example shows how to encrypt and decrypt text.

Private Sub cmdEncryptText_Click()

CryptoLight1.Password = txtPassword.Text

vOutput = CryptoLight1.Encrypt(txtInputText.Text)

' we export the data as Hex because in its binary form it

' cannot be displayed as string (portions of data might be lost)

txtOutputText.Text = CryptoLight1.Encode(vOutput, pcfHex)

End Sub

Private Sub cmdDecryptText_Click()

CryptoLight1.Password = txtPassword.Text

vOutput = CryptoLight1.Decode(txtInputText.Text, pcfHex)

vOutput = CryptoLight1.Decrypt(vOutput)

' decrypted data must be converted from the byte array to string
' before we can display it.

txtOutputText.Text = CryptoLight1.Encode(vOutput, pcfBinary)

End Sub

Private Sub CryptoLight1_Error(ByVal ErrorCode As Long, ByVal ErrorDescription As String)

MsgBox ErrorDescription

End Sub


Control registering and redistributing

Q: I tried to install your demo file (polarcryptolight.dll) without your install package and the ActiveX file does not work (if I install it with: regsvr32 polarcryptolight.dll). If I buy the release version, is it possible to install it without your installation software?

A: Re-distribution of the Polar Crypto Light ActiveX control is explained in the ReadMe file (comes with the installation).

Q: I downloaded Polar Crypto Light, ran the Setup and copied the polarcryptolight.dll to winnt\system32. I have loaded all the required DLL's but I still got the following problem: Could not register the ActiveX control. Received "specified module could not be found".

A: There are a few possible causes and solutions:

  1. When you copied the control to the WinNT\System32 directory, it is possible that you removed the control from the directory where it was installed. It should not be removed from this directory because the Windows search for the control uses registry entries which contain the control's path, unlike with DLLs which must be located into the system directory. If you moved the control, you have to re-register it in a new directory.

  2. If you just made a new copy of the polarcryptolight.dll in WinNT\System32 and registered it, it is possible that the previous copy of the Polar Crypto Light OCX remained registered (because the setup procedure registered Polar Crypto Light in its own directory during the installation). You have to unregister this copy.

Q: If I want to upgrade my existing ActiveX control, what will happen after I download and install the new version? Is it going to overwrite existing files or will it exist as a new version?

A: When you install the new version, you can choose a different folder to install in. However, the new version will be registered and your system will only recognize this registered one. You can keep two different versions of the control on your computer but you must keep in mind that you must register the control manually each time you wish to switch from one version to another.

Q: I would like to incorporate your Crypto functionality in my program, but I do not know:

  1. What I can distribute to my potential users,

  2. How I would get InstallShield to register the OCX.

A:
a) When re-distributing the Polar Crypto Light Release version, you can only redistribute the polarcryptolight.dll file.

If you did not purchase the licensed Polar Crypto Light control, you are only permitted to redistribute the TRIAL version of Polar Crypto Light, which will limit the passwords length to four bytes and display nag screens every 10-30 minutes.

Finally, in order for the Polar Crypto Light OCX to work properly on the customer's machine, he must have the following file installed and registered:

polarcryptolight.dll

The .OCX file must be registered on each user's machine. To register an OCX on the user machine, use the REGSVR32.EXE utility. This utility is available from Microsoft and comes with all versions of Windows. To run this utility, type the following at the command prompt on each user's machine:

Regsvr32 C:\FilePath\polarcryptolight.dll

Our ActiveX controls require OLE2 support to be installed on a machine. In order to run an application containing one of our controls you must ensure that OLE2 has been installed on the user's machine. If your client's machine has older versions of these files, you will need to update them.

You can also read about the redistribution of files in the ReadMe.txt.

b) You can manually add the function for the registration into the script file (setup.rul):

Note: This function will work if the REGSVR32.EXE is in the windows/system directory!

/*-------------------------------------------------------------------

RegisterOCX

Registration of OCX

-------------------------------------------------------------------*/

function RegisterOCX()

STRING svOCXPath;

begin

// Registration of OCX

svOCXPath = svTargetDir ^ "polarcryptolight.dll";

LongPathToShortPath( svOCXPath );

LaunchAppAndWait(WINSYSDIR^"regsvr32.exe", "/s " + svOCXPath, WAIT);

end;


Troubleshooting

Q: What is: cryptology? Cryptography? Plaintext? Ciphertext? Encryption? Key?

A: The story begins: When Julius Caesar sent messages to his trusted acquaintances, he did not trust his messengers. He therefore replaced every A with a D, every B with a E, and so on. Only those who who knew the ''shift by 3'' rule could decipher his messages.

A cryptosystem or cipher system is a method of disguising messages so that only certain people can see through the disguise. Cryptography is the art of creating and using cryptosystems. Cryptanalysis is the art of breaking cryptosystems – seeing through the disguise even when you are not supposed to be able to. Cryptology is the study of both cryptography and cryptanalysis.

The original message is called the plaintext. The disguised message is called the ciphertext. Encryption means any procedure used to convert the plaintext into ciphertext. Decryption is any procedure used to convert the ciphertext back into plaintext.

A cryptosystem is usually a whole collection of algorithms. These algorithms are labelled; the labels are called keys. For instance, Caesar used "shift by n'' encryption for several different values of n. You can say that 'n' is the key in this case.

The individuals who are supposed to be able to see through the disguise are called recipients. All others are 'enemies', 'opponents', 'interlopers', 'eavesdroppers,' 'outsiders', or 'third parties'.

Q: What is the best way to generate a secure key?

A: We strongly recommend key generation using the GenerateKey method. In this way, the security of the key (which is the most important part of your cryptographic system) will remain strong, even against the possible outsider attacks.

Inside the GenerateKey function, the generation of the hash value from a randomly generated password is also hidden, which increases the security of the key even more.

BEWARE: the most common use of passwords implies generating keys from passwords that have 8-16 characters, which can be easily 'broken' using one of the known cryptanalisys attacks e.g. the Dictionary attack.

Q: What is a "Dictionary attack" ?

A: A Dictionary attack is a cryptanalysis method during which the attacker uses a dictionary of all common passwords. It has been shown (by Daniel Klein) that by using this type of attack, about 40% of all used passwords can be cracked on the average computer!

The Dictionary attack tries as a possible password, for example:

  • The user's name, initials, account name and other personal information

  • Words from various databases, including lists of men's and women's names, places, cartoons,...

  • Variations of the words, strings of letters and numbers, ...

  • Various capitalization variations of the words, nonsense words that can be pronounced,...

  • Foreign language words for foreign users.

Q: What is the Rijndael algorithm?

A: The Rijndael algorithm, also known as the Advanced Encryption Standard (AES), is a cryptographic algorithm used for the encryption and decryption of files and text.

Q: What is the Advanced Encryption Standard (AES)?

A: The Advanced Encryption Standard (AES) will be a new Federal Information Processing Standard (FIPS) Publication that will specify a cryptographic algorithm for use by U.S. Government organizations to protect sensitive (unclassified) information. NIST also predicts that the AES will be widely used on a voluntary basis by organizations, institutions, and individuals outside of the U.S. Government - and outside of the United States - in some cases. NIST has selected Rijndael as the proposed AES algorithm.

Q: How do you pronounce Rijndael?

A: The algorithm's developers have suggested the following pronunciation alternatives: "Reign Dahl," "Rain Doll" and "Rhine Dahl."

Q: Why did NIST select Rijndael as the Advanced Encryption Standard?

A: When all is considered, Rijndael's combination of security, performance, efficiency, ease of implementation and flexibility make it the most appropriate selection for the AES. Specifically, Rijndael appears to be consistently performer in both hardware and software across a wide range of computing environments, regardless of its use in feedback or non-feedback modes. Its key setup time is excellent, and its key agility is good. Rijndael's low memory requirements make it well suited for restricted-space environments, in which it also demonstrates excellent performance. Rijndael's operations are among the easiest to defend against power and timing attacks.

Additionally, some defense tactics can be undertaken against attacks without significantly impacting Rijndael's performance. Rijndael is designed with flexibility, in terms of block and key sizes, and the algorithm can accommodate alterations in the number of rounds (although these features would require further study and are not being considered at this time). Finally, Rijndael's internal round structure has potential to benefit from instruction-level parallelism.

Q: How big are the AES key sizes?

A: The AES will specify three key sizes: 128, 192 and 256 bits. In decimal terms, this means that there are approximately:

3.4 x (10^38) possible 128-bit keys;

6.2 x (10^57) possible 192-bit keys; and

1.1 x (10 ^77) possible 256-bit keys.

Q: What is the chance that someone could crack an AES key?

A: Assuming that one could build a machine that could recover 255 keys per second, then it would take that machine approximately 149 thousand-billion (149 trillion) years to crack a 128-bit AES key.

Q: What is the importance of long key encryption algorithms?

A: Assessing the strength required of the symmetric cryptographic systems, is an essential step in employing cryptography for computer and communication security.

Technology readily available today, makes brute-force attacks against cryptographic systems both fast and cheap. General purpose computers (PCs) can be used, but a much more efficient approach is to employ commercially available Field Programmable Gate Array (FPGA) technology. For attackers prepared to make a higher initial investment, custom-made, special-purpose chips make such calculations much faster and significantly lower the amortized cost per solution.

As a result, cryptosystems with 40-bit keys offer virtually no protection against brute-force attacks at this point. Even the current U.S. Data Encryption Standard (DES) with a 56-bit key is increasingly inadequate. As cryptosystems often succumb to 'smarter' attacks than a brute-force key search, it is also important to remember that the key lengths are the minimum needed for security against the computational threats considered.

Therefore, to provide adequate protection against the most serious threats – well-funded commercial enterprises or government intelligence agencies – keys used to protect data today should be at least 75 bits long. To protect information adequately for the next 20 years in the face of expected advances in computing power, keys in newly deployed systems should be at least 90 bits long.


Trial version

Trial version limitations:

The effective key length of the AES algorithm is 32 bits. The remaining bits are set to zeros.

In both cases, whether you are installing the trial or the release version, you will get all the needed files with all the available functionality. The trial version is limited in that it only uses the weak 32-bit key AES encryption.

Important!

Regarding specific limitations in the key creation algorithms in the trial version, generated key may differ from the key that was created with release version of the component, despite same passwords. Subsequently, for the encryption/decryption process you can not mix these two versions of the product.


Order and payment

Q: How can I order your product?

A: You can order all Polar products on-line at www.polarsoftware.com, by e-mail at sales@polarsoftware.com or via our resellers. You will find more info about our resellers at www.polarsoftware.com/about/resellers.html. If you have any queries regarding your ordering, please feel free to contact our sales department at sales@polarsoftware.com at anytime.

Q: What types of payment do you accept?

A: We accept the following types of payment: Visa, MasterCard & American Express credit cards ; by Wire Transfer and by (Company) Check. Feel free to contact our sales department at sales@polarsoftware.com at anytime.

Q: How do you deliver your products?

A: Polar software products are only available via ESD.

Q: If I buy the component now, will I be entitled to the coming versions at no extra cost?

A: Minor build versions (e.q. 5.1, 5.2, ...) will be free for anyone who owns a registered copy of the last major version. Newer major versions (6.0, 7.0, ...) will be available at a discounted upgrade price.

Q: What about a FREE UPGRADE to a major version?

A: Customers who purchased Polar Crypto within 30 days of the release date of the new Polar Crypto major version will get a 30 day grace period to claim their FREE UPGRADE!

Q: Are the number of licenses or quantities of copies referring to developers or to end users of the software that contains the Polar Crypto component within it?

A: The number of licenses refers to the number of developer's machines. Please note that one software license is required per developer's machine. Re-distribution with your application is royalty free. There are no royalty fees on any of our components.

Contact us

Polar
Put Supavla 1
HR-21000 Split
Croatia, Europe

Phone:

Fax:

URL:

E-mail:

+385 21 380 770

+385 21 380 771

www.polarsoftware.com


License agreement

You can find the Polar License agreement on-line at www.polarsoftware.com/products/license.html

Polar – Single User License Agreement

Important
You should read the following terms and conditions carefully. By installing the Polar software package you indicate your acceptance of them.

By installing this software package (the "SOFTWARE"), or exercising your rights to make and use copies of the SOFTWARE (as may be provided for below), or pressing the 'Accept' button below, you agree to be bound by the terms of this Polar License Agreement. If you do not agree to the terms of this Agreement, you are not allowed to use the SOFTWARE. If you would like specific rights not granted in this agreement, please contact Polar for more information.

Polar Software License Agreement

The enclosed software, including, but not limited to, one or more of the following: source code, object code, dynamic link libraries, static libraries, header files, sample programs, utility programs, Make files and scripts, together with the accompanying documentation (collectively known as the "SOFTWARE") is owned by Polar or its suppliers and is protected by international copyright laws and treaties.

Therefore, you must treat the SOFTWARE like any copyrighted material (e.g., a book or musical recording) except that you may make either:

      • one backup copy of the SOFTWARE solely for backup purposes, or

      • transfer the SOFTWARE to a hard disk and keep the original copy solely for backup purposes.

Polar grants to you (one software programmer) the limited right to use only one copy of the SOFTWARE on a single computer (typically one personal computer) in the manner set forth in this agreement. Each Software Programmer must have his or her own license to use the SOFTWARE.

The SOFTWARE is protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. THE SOFTWARE PRODUCT IS LICENSED, NOT SOLD.

License - You May:

  1. Use the SOFTWARE on a single computer for purposes of developing application programs. The SOFTWARE is "in use" on a computer when it is loaded into temporary memory or installed into permanent memory of such computer. Installation on a network server for the sole purpose of internal distribution does not constitute "use" requiring a development license, but you must have a separate license for each computer on the network used for developing applications programs. Application programs include but are not limited to programs and HTML pages.

  2. Distribute an unlimited number of copies of the DLL, VBX or OCX files as part of the application developed using the Software provided the conditions described in paragraph 2.1 are met. 2.1 The application must include proper copyright notification for the SOFTWARE. The copyright notice must be included with any copyright notice for the including application or at least once in the user interface, and in the printed and electronic documentation, and packaging. The copyright notification must be worded similar to the following: This product contains PRODUCT from Polar. Copyright © 1998-2001. All rights reserved. Substitute the name of the included SOFTWARE for PRODUCT (i.e. Polar Crypto Component).

  3. Make one copy of the SOFTWARE for backup or archival purposes or copy the SOFTWARE to a single permanent storage medium provided you keep the original solely for backup or archival purposes.

  4. Combine the run time portion of the SOFTWARE with your software program for use subject to the restrictions set forth in Subparagraphs (1) and (2) above. Any portion of the SOFTWARE distributed with your program will continue to be subject to the terms and conditions of this License. You must reproduce and include the Polar copyright notice on any copy or merged portion of the SOFTWARE.

  5. Permanently transfer the SOFTWARE together with this License to another party, but only if the other party agrees to accept the terms and conditions of this Agreement. If you transfer the SOFTWARE and License, you must at the same time notify Polar of the name and address of the transferee. You also must either transfer all copies, merged portions, upgrades and prior versions of the SOFTWARE, together with all SOFTWARE documentation, to the same party or destroy those not transferred. Any such transfer terminates your License.

  6. Modify (i.e. modify the source code and rebuild) the dynamic link libraries and statically linked libraries and incorporate the modified dynamic link libraries and statically linked libraries into software application products that you develop.

  7. Make and distribute copies of the dynamic link libraries and statically linked libraries of the SOFTWARE as incorporated into software application products that you develop provided that the SOFTWARE, or other Polar products, do not constitute a major portion of the value of your product.

  8. Solely with respect to electronic documents, you may make an unlimited number of copies (either in hardcopy or electronic form), provided that such copies shall be used only for internal purposes and are not republished or distributed beyond the licensee's premises.

  9. Use and modify the source code version of those portions of the SOFTWARE that are identified in the documentation as the Sample Code ("SAMPLE CODE"), provided you do not distribute the SAMPLE CODE, or any modified version of the SAMPLE CODE, in source code form.

Prohibited uses - You May Not

  1. RENT, LEASE, OR LEND THE SOFTWARE OR SOFTWARE DOCUMENTATION.

  2. OTHERWISE TRANSFER OR USE, COPY, OR MERGE THE SOFTWARE,IN WHOLE OR IN PART, EXCEPT AS EXPRESSLY PERMITTED IN THIS LICENSE.

  3. MODIFY, DECOMPILE, DISASSEMBLE, REVERSE ENGINEER OR TRANSLATE THE SOFTWARE.

  4. REPRODUCE, MODIFY OR TRANSLATE THE SOFTWARE DOCUMENTATION.

  5. REMOVE ANY PROPRIETARY NOTICES, LABELS OR MARKS ON THE SOFTWARE OR SOFTWARE DOCUMENTATION.

  6. DEVELOP OR DISTRIBUTE APPLICATIONS THAT PROVIDE DIRECT ACCESS TO THE SOFTWARE'S PROGRAMMING INTERFACE.

  7. BUNDLE THE SOFTWARE IN A DEVELOPMENT ENVIRONMENT.

  8. USE THE SOFTWARE TO CREATE AN APPLICATION THAT IS NOT SIGNIFICANTLY DIFFERENT THAN THE VBX/DLL OR OCX.

  9. SEPARATION OF COMPONENTS. THE SOFTWARE PRODUCT IS LICENSED AS A SINGLE PRODUCT. ITS COMPONENT PARTS MAY NOT BE SEPARATED FOR USE ON MORE THAN ONE COMPUTER.

  10. EXPOSE THE INTERFACES OF THE SOFTWARE THROUGH YOUR APPLICATION. (e.g. an OCX, DLL, class library, etc.)

The source codes of the SOFTWARE are valuable assets of Polar. You agree to keep all source codes of the SOFTWARE in confidence. You may not transfer or assign the SOFTWARE or your rights under this agreement.

Term

You may terminate your License and this Agreement at anytime by destroying the SOFTWARE and SOFTWARE documentation together with all copies in any form. They will also terminate automatically if you fail to comply with any term or condition of this Agreement, in which event you agree to destroy the SOFTWARE and SOFTWARE documentation together with all copies in any form, and to provide us upon our request with written certification of such destruction.

Limited Warranty/Limitation of Remedies

EXCEPT AS SPECIFICALLY STATED IN THIS AGREEMENT, THE SOFTWARE AND SOFTWARE DOCUMENTATION IS PROVIDED AND LICENSED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Limitation of liability

IN NO EVENT WILL POLAR BE LIABLE TO YOU FOR ANY DAMAGES, INCLUDING WITHOUT LIMITATION LOST PROFITS OR REVENUES, LOSS OF DATA, BUSINESS INTERRUPTION LOSS, RECOVERY OR SUBSTITUTION COSTS, OR CLAIMS BY THIRD PARTIES, OR OTHER INDIRECT INCIDENTAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF THE USE OF OR INABILITY TO USE THE SOFTWARE, EVEN IF POLAR OR A POLAR DEALER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO CASE SHALL POLAR'S LIABILITY EXCEED THE AMOUNT OF THE LICENSE FEE PAID BY YOU FOR THE SOFTWARE.

High Risk Activities

The SOFTWARE is not fault-tolerant and is not designed, manufactured or intended for use or resale as on-line control equipment in hazardous environments requiring fail-safe performance, such as in the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, direct life support machines, or weapons systems, in which the failure of the Software could lead directly to death, personal injury, or severe physical or environmental damage ("High Risk Activities"). Polar and its suppliers specifically disclaim any express or implied warranty of fitness for High Risk Activities.

Technical Support

Polar will provide you (the original licensee only) with limited technical support by electronic media for a period of 60 days after delivery of the SOFTWARE to you. You can use your technical support rights by contacting us:

      • using e-mail: support@polarsoftware.com

      • using support web forms on our web site at www.polarsoftware.com

General

This agreement is governed by international copyright laws and treaties. The prevailing party in any action or proceeding brought in connection with a breach of this Agreement will be entitled to reimbursement by the other party for costs and reasonable attorneys' fees. Any questions concerning this Agreement should be referred in writing to Polar (see our address on top of this agreement).

Copyright Notice

Copyright © 1998-2001 Polar and/or its suppliers, Polar, Put Supavla 1, HR-21000 Split, Croatia, Europe. All rights reserved. Specifications subject to change without notice. Any rights not expressly granted herein are reserved. You acknowledge that you have read this agreement, and by installing this software package indicate your acceptance of its terms and conditions. You also agree that it is the complete agreement between us and that it supersedes any prior information or representations you received relating to the subject matter of this agreement. No Polar dealer, distributor representative or employee is authorized to make any modifications or additions to this agreement.

Polar
Put Supavla 1
HR-21000 Split
Croatia, Europe

Phone:

Fax:

URL:

E-mail:

+385 21 380 770

+385 21 380 771

www.polarsoftware.com


pceErrorConstants Enumeration

Error constants.

enum pceErrorConstants

{

pceFileDoesNotExist = 302,

pceCannotOpenFile = 303,

pceReadOnlyProperty = 306,

pceInternalError = 307,

pceInvalidPassword = 308,

pceOutputFileAlreadyExists = 309

}

pceFileDoesNotExist - Occurs when there is no specific file on the disk

pceCannotOpenFile - Occurs when the file can not be opened

pceReadOnlyProperty - Occurs when you try to set the read only property

pceInternalError - An internal error is occurred

pceInvalidPassword - Occurs if user tries to set Password property to an empty string (ctrl.Password = "").

pceOutputFileAlreadyExists - Occurs if EncryptFile/DecryptFile method is used with bOverwriteExisting parameter set to False, and output file already exists.


pcfEncodingFormat Enumeration

Encoding/decoding formats.

enum pcfEncodingFormat

{

pcfHex = 1,

pcfBase64 = 2,

pcfBinary = 3

}


pcmProcessingMode Enumeration

Defines the type of processing in the events.

enum pcmProcessingMode

{

pcmEncrypting = 1,

pcmDecrypting = 2,

pcmEncoding = 3,

pcmDecoding = 4

}


With the DLL

For development tools that do not have built-in support for ActiveX controls, but which are able to make calls to 32-bit DLLs through a DLL's exported interface, we provided the component as a DLL library. This section of the help file describes how to use Polar Crypto via direct DLL API calls.

All Polar Crypto's properties, methods and events described in this manual can be accessed through the exported DLL API. Properties can be accessed by calling the API's "Get" and "Set" functions. API functions pcSetProperty and pcGetProperty let you read and write Polar Crypto properties:

BOOL pcSetKeyProperty( HPCRYPTKEY hKey, LONG lPropID, LONG lValue)

LONG pcGetKeyProperty( HPCRYPTKEY hKey, LONG lPropID, LONG* plValue)

Polar Crypto's methods can be executed by calling the API functions starting with "pc". Each method returns the error code.

Events can be handled by callback functions. Here are sample functions that process event messages sent by polarcrypto.dll:

VB:

'-------------------------------------------------------------------------

'This is a sample of a callback procedure to handle events in

'the Polar Crypto DLL API. You can copy this code to your own module(s),

'or use it from right here by adding your event handling code wherever

'the comment "Your code here" appears.

'-------------------------------------------------------------------------

'call this callback function like this: PZ_SetCallbackEventFunction AddressOf CallbackProcEventMessage

Private objTDllEvent As TDllEvent

Public Sub CallbackProcEventMessage(ByVal wEventMessage As Long, ByVal lEventParam As Long)

Select Case wEventMessage

Case EVENT_ID_PROCESSSTARTED:

Call CopyMemory(objTDllEvent, ByVal lEventParam, Len(objTDllEvent))

'Add your code here

Case EVENT_ID_PROCESSSTATUS:

Call CopyMemory(objTDllEvent, ByVal lEventParam, Len(objTDllEvent))

'Add your code here

Case EVENT_ID_PROCESSENDED:

Call CopyMemory(objTDllEvent, ByVal lEventParam, Len(objTDllEvent))

'Add your code here

Case EVENT_ID_ERROR:

Call CopyMemory(objTDllError, ByVal lEventParam, Len(objTDllError))

'Add your code here

End Select

End Sub

VC++:

void CALLBACK CTestPolarCryptoDllDlg::CallbackProcEventMessage (long wEventMessage, long lEventParam)

{

switch ( wEventMessage )

{

case EVENT_ID_PROCESSSTARTED:

{

memcpy( &objTDllEvent, lEventParam, sizeof( objTDllEvent ));

// TODO: Add your control notification handler code here

}

break;

case EVENT_ID_PROCESSSTATUS:

{

memcpy( &objTDllEvent, lEventParam, sizeof( objTDllEvent ));

MSG msg;

while (PeekMessage(&msg,0,0,0, PM_REMOVE))

{

TranslateMessage (&msg);

DispatchMessage (&msg);

}

//g_fAbort is your global variable which you can set with click on OnAbort button

*((long*)lEventParam) = g_fAbort;

}

break;

case EVENT_ID_PROCESSENDED:

{
// TODO: Add your control notification handler code here

memcpy( &objTDllEvent, lEventParam, sizeof( objTDllEvent ));

}

break;

case EMSG_ONERROR:

{

memcpy( &objTDllError, lEventParam, sizeof( objTDllError ));

CString strErrorDescription;

strErrorDescription = objEventErrorMessage.szMessage;

pDlg->MessageBox(strErrorDescription, "Polar Crypto DLL sample");

}

break;

default:

{

// TODO: Add your control notification handler code here

assert(false);

}

break;

}

}

C/C++ Users

For C/C++ users, two files, one named POLARCRYPTODLL.H, and one named POLARCRYPTO.LIB, are included in the folder where you install Polar Crypto. The first file, POLARCRYPTODLL.H, contains all the functions and event declarations for the DLL while the second file, POLARCRYPTO.LIB, is the Visual C++ library file need for successfully linking the DLL projects.

VB Users

We recommend that you use the ActiveX Control in the Visual Basic environment. For users who do not want to put the control on a form, we suggest that you instantiate the control's object with the CreateObject method. Here are some declarations for the use of the DLL in VB:

Public Declare Function pcCreateHash Lib "PolarCrypto.dll" ( ByRef hHash As Long) As Long

Other Users

If you cannot link with the POLARCRYPTO.LIB file, you must manually obtain the address of each Polar Crypto property or method you need to use. The functions used for this are:

LoadLibrary - the function that maps the specified .DLL file into the address space of the calling process.

GetProcAddress - the function that returns the address of the specified exported dynamic-link library (DLL).