c# - 使用在 .NET 中不起作用但在 SOAP UI 中起作用的证书解密加密 key

Question

我想弄清楚为什么我似乎无法使用 X509 证书从 .NET 解密加密 key 。

    encryptedKey = "jW3VDsUZWIdzfZ1bPN3iKI2Pf9u22kUax0DFnF3A9H+nvcBQuVC2efw1FYGm5/AvnN27kXqA4PyCqcQLp/tguVqHtzdR7mJtkTCyY8TUoAej2Mqzv2uiEKULB/8rlPDl2DOkSMGJqieenAG/7gZjWhlU0eYrlcMi5dtAnPFTfy+LvtJ6bbGEDgy4FhoT49T6sO0kjBJHp5YI0p/CeEuc+WMT/BMGG1YuDPswltj0VzeaE3KbHSLvJPjGCQ3U0YkUWm8h9zM22S/mRvfMhEu1aRdQpojGUiSLKUJyotNu8fRulKeB1TVuE7AlDGrbAUsRtU+y6PdLMcEHW+BRq5Uouw==";

    var encryptedKeyByte = Convert.FromBase64String(encryptedKey);

    var clientCert = new X509Certificate2(@"C:\certificates\xxxxx.pfx", "xxxx");
    var rsa = (RSACryptoServiceProvider)clientCert.PrivateKey;
    byte[] key = rsa.Decrypt(encryptedKeyByte, false);

当我尝试运行代码的最后一行 rsa.Decrypt(encryptedKeyByte, false)

时出现的错误

The parameter is incorrect.

在 SOAP UI 中，我使用相同的证书进行解密。我只需要将文件 pfx 转换为 jks 文件即可使其在 SOAP UI 中工作。但除此之外，设置对我来说看起来是一样的。下面是 SOAP UI 设置的屏幕截图。我猜 SOAP UI 设置中的签名 keystore 未用于解密过程。 SOAP UI 中的 Decrypt Keystore 设置是我在 .NET 中使用的设置。仅在 .NET 中它是一个 pfx 文件。

这是来自 MMC 的证书详细信息

堆栈跟踪错误:

服务器堆栈跟踪:

   at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
   at System.Security.Cryptography.RSACryptoServiceProvider.DecryptKey(SafeKeyHandle pKeyContext, Byte[] pbEncryptedKey, Int32 cbEncryptedKey, Boolean fOAEP, ObjectHandleOnStack ohRetDecryptedKey)
   at System.Security.Cryptography.RSACryptoServiceProvider.Decrypt(Byte[] rgb, Boolean fOAEP)
   at Microsoft.Austria.WcfHelpers.SoapWithAttachments.SwaEncoder.ReadMessage(Stream stream, Int32 maxSizeOfHeaders, String contentType) in C:\Crap\Stuff\CARES\Microsoft.Austria.WcfHelpers.SoapWithAttachments\SwaEncoder.cs:line 503
   at Microsoft.Austria.WcfHelpers.SoapWithAttachments.SwaEncoder.ReadMessage(Stream stream, Int32 maxSizeOfHeaders, String contentType) in C:\Crap\Stuff\CARES\Microsoft.Austria.WcfHelpers.SoapWithAttachments\SwaEncoder.cs:line 458
   at Microsoft.Austria.WcfHelpers.SoapWithAttachments.SwaEncoder.ReadMessage(ArraySegment`1 buffer, BufferManager bufferManager, String contentType) in C:\Crap\Stuff\CARES\Microsoft.Austria.WcfHelpers.SoapWithAttachments\SwaEncoder.cs:line 126
   at System.ServiceModel.Channels.HttpInput.DecodeBufferedMessage(ArraySegment`1 buffer, Stream inputStream)
   at System.ServiceModel.Channels.HttpInput.ReadBufferedMessage(Stream inputStream)
   at System.ServiceModel.Channels.HttpInput.ParseIncomingMessage(HttpRequestMessage httpRequestMessage, Exception& requestException)
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
   at System.ServiceModel.Channels.RequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Dispatcher.RequestChannelBinder.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 

Answer 1

这门课可能对你有帮助:

public class TFRSAEncryption
{
    public string RsaEncryptWithPublic(string clearText, string publicKey)
    {
        var bytesToEncrypt = Encoding.UTF8.GetBytes(clearText);

        var encryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(publicKey))
        {
            var keyParameter = (AsymmetricKeyParameter)new PemReader(txtreader).ReadObject();

            encryptEngine.Init(true, keyParameter);
        }

        var encrypted = Convert.ToBase64String(encryptEngine.ProcessBlock(bytesToEncrypt, 0, bytesToEncrypt.Length));
        return encrypted;

    }

    public string RsaEncryptWithPrivate(string clearText, string privateKey)
    {
        var bytesToEncrypt = Encoding.UTF8.GetBytes(clearText);

        var encryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(privateKey))
        {
            var keyPair = (AsymmetricCipherKeyPair)new PemReader(txtreader).ReadObject();

            encryptEngine.Init(true, keyPair.Private);
        }

        var encrypted = Convert.ToBase64String(encryptEngine.ProcessBlock(bytesToEncrypt, 0, bytesToEncrypt.Length));
        return encrypted;
    }


    // Decryption: 

    public string RsaDecryptWithPrivate(string base64Input, string privateKey)
    {
        var bytesToDecrypt = Convert.FromBase64String(base64Input);

        AsymmetricCipherKeyPair keyPair;
        var decryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(privateKey))
        {
            keyPair = (AsymmetricCipherKeyPair)new PemReader(txtreader).ReadObject();

            decryptEngine.Init(false, keyPair.Private);
        }

        var decrypted = Encoding.UTF8.GetString(decryptEngine.ProcessBlock(bytesToDecrypt, 0, bytesToDecrypt.Length));
        return decrypted;
    }

    public string RsaDecryptWithPublic(string base64Input, string publicKey)
    {
        var bytesToDecrypt = Convert.FromBase64String(base64Input);

        var decryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(publicKey))
        {
            var keyParameter = (AsymmetricKeyParameter)new PemReader(txtreader).ReadObject();

            decryptEngine.Init(false, keyParameter);
        }

        var decrypted = Encoding.UTF8.GetString(decryptEngine.ProcessBlock(bytesToDecrypt, 0, bytesToDecrypt.Length));
        return decrypted;
    }
}