c# - 如何将 openssl_pkey_get_public 和 openssl_verify 转换为 C# .NET

Question

PHP 代码验证来自银行的 iPizza 签名:

$key = openssl_pkey_get_public (file_get_contents ($preferences['bank_certificate'])); 
if (!openssl_verify ($data, $signature, $key)) { 
    trigger_error ("Invalid signature", E_USER_ERROR); 
    } 

我尝试使用 将它转换为 ASP .NET

SHA1CryptoServiceProvider sha1 = new SHA1CryptoServiceProvider();
X509Certificate2 cert = new X509Certificate2(HttpContext.Current.Request.MapPath("~/App_Data/bankert.crt"), "");
RSACryptoServiceProvider rsaCryptoIPT = new RSACryptoServiceProvider();
rsaCryptoIPT.ImportCspBlob(cert.RawData);
if (!rsaCryptoIPT.VerifyData(data, CryptoConfig.MapNameToOID("SHA1"), signature))
    throw new InvalidOperationException("Invalid signature from bank ");

但行 rsaCryptoIPT.ImportCspBlob(cert.RawData) 导致 Cryptography.CryptographicException 提供程序版本无效:

  StackTrace:
       at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
       at System.Security.Cryptography.Utils._ImportCspBlob(Byte[] keyBlob, SafeProvHandle hProv, CspProviderFlags flags, SafeKeyHandle& hKey)
       at System.Security.Cryptography.Utils.ImportCspBlobHelper(CspAlgorithmType keyType, Byte[] keyBlob, Boolean publicOnly, CspParameters& parameters, Boolean randomKeyContainer, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle)
       at System.Security.Cryptography.RSACryptoServiceProvider.ImportCspBlob(Byte[] keyBlob)
...

如何修复？

bank_certificate 文件包含

-----BEGIN CERTIFICATE----- MIIDRTCCAq6gAwIBAgIBADANBgkqhkiG9w0BAQQFADB7MQswCQYDVQQGEwJFRTEO .... C82uR/wUZJDw9kj+R1O46/byG8yA+S9FVw== -----END CERTIFICATE-----

更新:我根据 tyranid answer 更改了代码

var cert = new X509Certificate2(HttpContext.Current.Request.MapPath("~/App_Data/banksert.crt"), "");
var rsaCryptoIPT = (RSACryptoServiceProvider)cert.PublicKey.Key;
var sha1 = new SHA1CryptoServiceProvider();
if (!rsaCryptoIPT.VerifyData(data, sha1, signature))
  throw new InvalidOperationException("Invalid signature from bank ");

此代码导致来自银行异常的无效签名。检查证书对象显示证书数据。如何解决此问题以便验证签名？调试器显示银行证书有效日期已过期。可能这会导致错误或 VerifyDate 第二个参数错误。

我可以成功地签署数据并且银行接受使用代码的签名

SHA1CryptoServiceProvider sha1 = new SHA1CryptoServiceProvider();
X509Certificate2 cert = new X509Certificate2(HttpContext.Current.Request.MapPath("~/App_Data/P12File.p12"), "");
RSACryptoServiceProvider rsaCryptoIPT = (RSACryptoServiceProvider)cert.PrivateKey;
byte[] binSignature = rsaCryptoIPT.SignData(binData, sha1);

验证银行签名应该与此过程相反，使用相同的算法。如何验证签名？

Answer 1

您是否安装了增强型加密提供程序？实际上，要不依赖于加密提供者，您可以使用其他库，这些库在 native 代码中实现了所有的密码学内容。我知道 EldoS SecureBlackbox(商业版)和 Bouncy CaSTLe(免费版)，但市场上可能还有其他图书馆。