Crypto.Kit for Delphi – S/MIME (CMS, X.509) and OpenPGP

Cryptography for signed and encrypted mail

Crypto.Kit is the toolkit’s home for cryptography. It gives S/MIME its CMS messages (RFC 5652: SignedData and EnvelopedData, with key transport and ECDH key agreement) and X.509 certificates, stores and chains on Windows CNG and CryptoAPI, and implements OpenPGP (RFC 9580) in Delphi.

The OpenPGP part reads keys version 4 and 6 from armored text, .gpg files and GnuPG keyboxes, unlocks them (S2K and Argon2), verifies RSA, ECDSA, Ed25519 and – for old archives – DSA signatures, decrypts with RSA, ECDH, X25519, Elgamal and passphrases, SEIPD version 1 and 2 (OCB, EAX, GCM), and still opens old messages with IDEA, CAST5, Blowfish, Twofish and Camellia. Nothing is ever written in an old format.

Delphi 13 Florence · Win32 and Win64 · Windows CNG and CryptoAPI · no OpenSSL, no GnuPG · VCL-free

Download the Crypto.Kit reference (PDF)

What Crypto.Kit is for

One options record, TCryptoOptions, carries the keys, certificates, passphrases and trust settings for every kit and both protocols.
CMS: sign, co-sign and verify SignedData; encrypt and decrypt EnvelopedData (RSA and ECDH).
X.509: certificates from files, PFX and the Windows stores, chains and their trust.
OpenPGP: key rings, detached, inline and cleartext signatures, encrypted (and signed) messages, compression (ZIP, ZLIB, BZip2).
Used by MIME.Kit, Msg.Kit, PST.Kit and MAPI.Kit for signed and encrypted mail – through one small facade, so an application can use the same calls.

How it is organised

uses CryptoKit; links the whole kit and registers it behind the crypto facade Shared.Contracts.Crypto (ICmsEngine, IOpenPgpEngine).
S/MIME side: CryptoKit.X509, CryptoKit.Cms, CryptoKit.Cng (the CNG primitives), CryptoKit.Asn and CryptoKit.Oid.
OpenPGP side: CryptoKit.Pgp.Keys, .Packets, .Message, .Verify, .SessionKey, .Secret, .Cipher, .Armor and .Write, plus the own primitives (Argon2, Curve25519, the old ciphers, RIPEMD-160, BZip2).
Clear rules: a PFX is imported in memory only and the kit never changes the user’s stores or keyrings; every failure raises ECryptoKitError with the HRESULT, but a cryptographic verdict is a result, not an exception; nothing asks the user anything unless allowed.

Getting started

The keys of every kit in one place: a PFX for S/MIME, OpenPGP keys and a passphrase:

uses System.IOUtils, Shared.Contracts.Crypto, CryptoKit;

var
  Opts: TCryptoOptions;
begin
  Opts := TCryptoOptions.Default;            // Windows stores + GnuPG public keyring, no UI
  Opts.Keys := [TCryptoKey.Create(TFile.ReadAllBytes('me.pfx'), 'pfx password')];
  Opts.PgpKeys := [TFile.ReadAllBytes('me-secret.asc')];
  Opts.PgpPassphrases := ['my passphrase'];
  SetDefaultCryptoOptions(Opts);             // what every kit uses unless it is given its own
end;

Verifying a CMS SignedData and reading an OpenPGP message through the facade:

uses Shared.Contracts.Crypto, Shared.Contracts.SecureMessage, CryptoKit;

var
  R: TCmsVerifyResult;
  S: TMessageSigner;
  M: TPgpMessageReadResult;
begin
  R := CmsEngine.Verify(SignedBytes, nil, DefaultCryptoOptions);   // nil = attached content
  for S in R.Signers do
    Writeln(S.Name, ': ', SignatureStatusName(S.Status), ' -- ', S.StatusText);

  M := OpenPgpEngine.ReadMessage(ArmoredBytes, DefaultCryptoOptions);
  if DecryptStatusIsDecrypted(M.Decrypt) then
    Writeln(M.FileName, ': ', Length(M.Data), ' bytes, ', M.EncryptionAlgorithm)
  else
    Writeln(M.DecryptText);
end;

More examples, the rules of ownership, errors and time zones, and every class, property, method and routine are in the Class Reference and Developer Guide.

Part of the IMIBO mail toolkit

Every kit gives the same answer for the same message: the kits share one property catalogue, one message contract and one JSON property dump, so a message read by one kit can be written, converted or compared by any other.

MAPI.Kit · PST.Kit · Msg.Kit · MIME.Kit · Crypto.Kit · Autodiscover.Kit

Crypto.Kit is developed by IMIBO; the source code is not public. For licensing, custom development or questions write to info@imibo.com.

Crypto.Kit Class Reference and Developer Guide (PDF)

Pages of the Crypto.Kit Class Reference and Developer Guide

Crypto.Kit 1.00 – Class Reference and Developer Guide · PDF, 61 pages, English, October 2026. Introduction, requirements and rules, the units at a glance, getting started, signed and encrypted mail in the toolkit, the crypto facade, X.509 certificates, CMS messages, ASN.1 and object identifiers, OpenPGP keys, messages, signatures and packets, the primitives and the road map.

The document is free. Enter your email address and you will receive a personal download link.

Questions about Crypto.Kit: info@imibo.com.