gpt4 book ai didi

C# 支持对单个 XML 元素进行 RSA SHA 256 签名

转载 作者:数据小太阳 更新时间:2023-10-29 02:50:01 27 4
gpt4 key购买 nike

我在 .NET Framework 4.5 版中遇到了一个阻止程序来处理带有数字签名的 XML 签名。

我的问题是基于需要使用 RSA SHA-256 算法使用 X.509 证书对单个 XML 元素进行签名。我已经阅读了很多关于这个主题的 .NET 帖子,似乎有一个解决方案最初是在 CLR 安全项目 RSAPKCS1SHA256SignatureDescription.cs 类中开发的。 RSAPKCS1SHA256SignatureDescription 当然已经合并到 .net 运行时中,从 .NET 4.5 开始,现在可以在分布式二进制 System.Deployment.dll 下使用。我已尝试在 .NET 中使用上述解决方案使用 RSA SHA-256 对特定的 XML 元素进行签名,但尚未取得任何成功。

我正在尝试使用 WSSE token 签署符合 Oasis ebms 标准的 SOAP 消息。请注意,该类(class)是为满足 Soap With Attachments (SwA) 和签署个人附件而编写的。我的代码如下

我的代码如下:

using System;
using System.Collections.Generic;
using System.IO;
using System.IdentityModel.Tokens;
using System.Security;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography.Xml;
using System.ServiceModel.Channels;
using System.ServiceModel.Security;
using System.Text;
using System.Xml;
using System.Xml.Linq;
using System.Xml.Serialization;
using System.Deployment.Internal.CodeSigning;

namespace TestCSharpX509CertificateRSSHA256
{
public class SignatureSupportUtility
{

private bool IsSignatureContentTransform
{
get
{
return true;
//get IsSignatureContentTransform
}
}

public SignatureSupportUtility()
{
Register();
}


private static void Register()
{
CryptoConfig.AddAlgorithm(typeof(RSAPKCS1SHA256SignatureDescription), "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
}

private void Sign(Message message, string[] elementIdsToSign, string[] attachmentsToSign, string wssNamespace, X509Certificate2 certificate)
{
//Prepare XML to encrypt and sign
var element = this.PrepareEncyrptSign(message);

bool signEntireDocument = true;
string elementToBeSigned = string.Empty;
var signedMessage = new XmlDocument();
signedMessage.AppendChild(signedMessage.ImportNode(element, true));

SignatureType signAs = SignatureType.InternallyDetached;
signedMessage.PreserveWhitespace = false;

OverrideSignedXml signedXml = new OverrideSignedXml(signedMessage);
signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;

if (elementIdsToSign != null && elementIdsToSign.Length > 0)
{
bool isContentTransform = this.IsSignatureContentTransform;

foreach (string s in elementIdsToSign)
{
// Create a reference to be signed.
Reference reference = new Reference(string.Format("#{0}", s));
reference.AddTransform(new XmlDsigExcC14NTransform());
reference.DigestMethod = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";


// Add the reference to the SignedXml object.
signedXml.AddReference(reference);
}

signEntireDocument = false;
}

// Reference attachments to sign
if (attachmentsToSign != null && attachmentsToSign.Length > 0)
{
bool isContentTransform = this.IsSignatureContentTransform;

foreach (string attachmentId in attachmentsToSign)
{
// Create a reference to be signed.
Reference reference = new Reference(string.Format("{0}{1}", Constants.CidUriScheme, attachmentId));
reference.DigestMethod = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";

if (isContentTransform)
{
AttachmentContentSignatureTransform env = new AttachmentContentSignatureTransform();
reference.AddTransform(env);
}
else
{
AttachmentCompleteSignatureTransform env = new AttachmentCompleteSignatureTransform();
reference.AddTransform(env);
}

// Add the reference to the SignedXml object.
signedXml.AddReference(reference);
}

signEntireDocument = false;
}

if (signEntireDocument)
{
Reference reference = new Reference();
reference.Uri = "";
reference.DigestMethod = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";

XmlDsigEnvelopedSignatureTransform env = new XmlDsigEnvelopedSignatureTransform();
reference.AddTransform(env);
signedXml.AddReference(reference);
signAs = SignatureType.Enveloped;
}

string x509CertificateReferenceId = string.Format("{0}-{1}", Constants.IdAttributeName, Guid.NewGuid().ToString("N"));
KeyInfo keyInfo = new KeyInfo();
keyInfo.AddClause(new KeyInfoX509SecurityTokenReference(string.Format("#{0}", x509CertificateReferenceId), wssNamespace));
signedXml.KeyInfo = keyInfo;
signedXml.SignedInfo.SignatureMethod = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";

RSA key = (RSACryptoServiceProvider)certificate.PrivateKey;
signedXML.SigningKey = key;
CidWebRequest.Message = message;

signedXml.ComputeSignature();
var xmlSignature = signedXml.GetXml();
XmlDocument unsignedEnvelopeDoc = new XmlDocument();
unsignedEnvelopeDoc.LoadXml(message.MessageAsString); }}}
using System;
using System.Collections.Generic;
using System.IO;
using System.IdentityModel.Tokens;
using System.Security;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography.Xml;
using System.ServiceModel.Channels;
using System.ServiceModel.Security;
using System.Text;
using System.Xml;
using System.Xml.Linq;
using System.Xml.Serialization;
using System.Deployment.Internal.CodeSigning;


namespace TestCSharpX509CertificateRSSHA256
{
public sealed class OverrideSignedXml : SignedXml
{
public OverrideSignedXml()
: base()
{
}

public OverrideSignedXml(XmlDocument doc)
: base(doc)
{
}

public override XmlElement GetIdElement(XmlDocument document, string idValue)
{
XmlElement element = base.GetIdElement(document, idValue);

if (element == null)
{
XmlNamespaceManager nsmgr = new XmlNamespaceManager(document.NameTable);
nsmgr.AddNamespace("wsu", ="http://docs.oasis-open. org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");

element = document.SelectSingleNode("//*[@wsu:Id=\"" + idValue + "\"]", nsmgr) as XmlElement;
}

return element;
}
}

我的 SignatureSupportUtility 类中的 Sign 方法应该足以对单个 XML 元素或整个消息进行签名,但是我一直收到 Cryptography 异常,声称不支持 SHA-256。我认为这个异常不应该是有效的观察 RSAPKCS1SHA256SignatureDescription.cs 已注册。但是,观察到 SignedXML 类不包含 SHA-256 的命名空间,而只包含 SHA-128,我开始怀疑无论是否注册,是否都支持 SHA 256。

有人可以告诉我如何最好地解决我的问题并能够通过 RSA SHA 256 算法使用 X.509 证书签署 XML 吗?

最佳答案

我也在看 Oasis ebms 的东西。

我找不到我从中获取这篇文章的文章,但我使用了 4.5 中的那个类:

public class RsaPkCs1Sha256SignatureDescription : SignatureDescription
{
public RsaPkCs1Sha256SignatureDescription()
{
KeyAlgorithm = "System.Security.Cryptography.RSACryptoServiceProvider";
DigestAlgorithm = "System.Security.Cryptography.SHA256Managed";
FormatterAlgorithm = "System.Security.Cryptography.RSAPKCS1SignatureFormatter";
DeformatterAlgorithm = "System.Security.Cryptography.RSAPKCS1SignatureDeformatter";
}

public override AsymmetricSignatureDeformatter CreateDeformatter(AsymmetricAlgorithm key)
{
var asymmetricSignatureDeformatter = (AsymmetricSignatureDeformatter) CryptoConfig.CreateFromName(DeformatterAlgorithm);
asymmetricSignatureDeformatter.SetKey(key);
asymmetricSignatureDeformatter.SetHashAlgorithm("SHA256");
return asymmetricSignatureDeformatter;
}

然后使用类似这样的东西来签名(已经编辑了一些不相关的位):

    public XmlElement SignDocument(XmlDocument doc, List<string> idsToSign)
{
CryptoConfig.AddAlgorithm(typeof(RsaPkCs1Sha256SignatureDescription), @"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");

var cspParams = new CspParameters(24) { KeyContainerName = "XML_DISG_RSA_KEY" };
var key = new RSACryptoServiceProvider(cspParams);
key.FromXmlString(_x509SecurityToken.Certificate.PrivateKey.ToXmlString(true));

var signer = new SoapSignedXml(doc) { SigningKey = key };

signer.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;

var keyInfo = new KeyInfo();
keyInfo.AddClause(new SecurityTokenReference(_x509SecurityToken, SecurityTokenReference.SerializationOptions.Embedded));

signer.KeyInfo = keyInfo;
signer.SignedInfo.SignatureMethod = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";

var cn14Transform = new XmlDsigExcC14NTransform();
string referenceDigestMethod = "http://www.w3.org/2001/04/xmlenc#sha256";

foreach (string id in idsToSign)
{
var reference = new Reference("#" + id);
reference.AddTransform(cn14Transform);
reference.DigestMethod = referenceDigestMethod;
signer.AddReference(reference);
}

signer.ComputeSignature();

return signer.GetXml();
}

似乎有效并在另一端验证 OK。前几天使用 Holodeck 进行了测试,我认为它在签名元素中缺少的时间戳上失败了。

但是,附件的签名似乎是 .NET 中的一个真正问题 - 我认为根本不支持相关的转换。

关于C# 支持对单个 XML 元素进行 RSA SHA 256 签名,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/17258800/

27 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com