c# - 导入 RSA CngKey 并存储在 MicrosoftSoftwareKeyStorageProvider 中

Question

我有一个导出的 RSAParameters 私钥，我想将其导入另一台机器。我可以将新 key 保存到本地机器或用户容器中，但我无法尝试导入现有 key 。

下面的代码将生成一个新的 key 对，我知道我可以直接在容器中生成一个新的 key - 但我希望能够生成一个 key 并将同一个 key 导入到几台不同的计算机中.

我如何获取 RSAParameters 或 XML 字符串(其中之一)并将其导入本地用户(或机器)容器？

    public async Task<KeyGenerationResult> GenerateNewKeyAsync(int keySize)
    {
        var csp = new RSACng(keySize);

        var privKey = await Task.Run(() => csp.ExportParameters(includePrivateParameters: true));
        var pubKey = csp.ExportParameters(includePrivateParameters: false);

        var pubKeyString = exportKeyToString(pubKey);
        var privKeyString = exportKeyToString(privKey);

        return new KeyGenerationResult
        {
            PrivateKey = privKey,
            PublicKey = pubKey,
            PrivateKeyCleartext = privKeyString,
            PublicKeyCleartext = pubKeyString
        };
    }

    private static string exportKeyToString(RSAParameters key)
    {
        string keyString;
        var sw = new StringWriter();
        var xs = new XmlSerializer(typeof(RSAParameters));
        xs.Serialize(sw, key);
        keyString = sw.ToString();
        return keyString;
    }

    public void SavePrivateKeyToLocalMachine(RSAParameters privateKey, string keyName)
    {
       //Stuck here. :(
    }

CngKey.Import() 采用 byte[]，这看起来很有希望，但我一直无法找到任何方法来创建 CngKey.Import() 所需的 byte[]。

        var d = new RSACryptoServiceProvider();
        d.ImportParameters(privateKey);
        var keyBlob = d.ExportCspBlob(true);
        var key = CngKey.Import(keyBlob, CngKeyBlobFormat.Pkcs8PrivateBlob);

这让我得到一个 byte[]，但无论我使用什么 CngKeyBlobFormat，我都会得到一个异常。我卡住了。

更新

我找到了一种使用

获取 byte[] 的方法

 var cp = new CngKeyCreationParameters();
 cp.KeyUsage = CngKeyUsages.AllUsages;
 cp.ExportPolicy = CngExportPolicies.AllowPlaintextExport | CngExportPolicies.AllowExport | CngExportPolicies.AllowArchiving | CngExportPolicies.AllowPlaintextArchiving;
 cp.Parameters.Add(new CngProperty("Length", BitConverter.GetBytes(keySize), CngPropertyOptions.None));
 var key = CngKey.Create(CngAlgorithm.Rsa, null, cp);
 var bytes = key.Export(CngKeyBlobFormat.{I have tried them all});

这段代码看起来应该让我导入字节[]

 /* try to save this key to the local user container */
 var keyParameters = new CngKeyCreationParameters()
 {
     KeyCreationOptions = CngKeyCreationOptions.OverwriteExistingKey,
     Provider = CngProvider.MicrosoftSoftwareKeyStorageProvider,
     KeyUsage = CngKeyUsages.AllUsages,
     ExportPolicy = CngExportPolicies.AllowPlaintextExport
 };
 keyParameters.KeyCreationOptions = CngKeyCreationOptions.None;
 keyParameters.Parameters.Add(new CngProperty("Length", BitConverter.GetBytes(keySize), CngPropertyOptions.None));
 keyParameters.Parameters.Add(new CngProperty(blobType.Format, bytes, CngPropertyOptions.None));

 var newKey = CngKey.Create(CngAlgorithm.Rsa, "MyTestName", keyParameters);

...但是再一次，没有骰子。无论我尝试什么 CngKeyBlobFormat，它们都给我异常，我无法将 key 导入本地 key 存储提供程序。

我需要什么样的设置和参数组合才能完成这项工作？

Answer 1

好吧，我终于让它工作了。这是最终确定下来的代码。

public class KeyGenerationResult
{
    public RSAParameters PublicKey { get; set; }
    public string PublicKeyCleartext { get; set; }
    public string PrivateKeyCleartext { get; set; }
    public byte[] PrivateBytes { get; set; }
    public int KeySize { get; set; }
    public CngKeyBlobFormat BlobFormat { get; set; }
}

    public async Task<KeyGenerationResult> GenerateNewKeyAsync(int keySize)
    {
        var cp = new CngKeyCreationParameters();
        cp.KeyUsage = CngKeyUsages.AllUsages;
        cp.ExportPolicy = CngExportPolicies.AllowPlaintextExport | CngExportPolicies.AllowExport | CngExportPolicies.AllowArchiving | CngExportPolicies.AllowPlaintextArchiving;
        cp.Parameters.Add(new CngProperty("Length", BitConverter.GetBytes(keySize), CngPropertyOptions.None));
        var key = await Task.Run(() => CngKey.Create(CngAlgorithm.Rsa, null, cp)).ConfigureAwait(false);
        var blobType = CngKeyBlobFormat.GenericPrivateBlob;
        var bytes = await Task.Run(() => key.Export(blobType)).ConfigureAwait(false);

        var rsa = new RSACng(key);
        var pubKey = rsa.ExportParameters(includePrivateParameters: false);
        var pubKeyString = exportKeyToString(pubKey);

        return new KeyGenerationResult
        {
            PublicKey = pubKey,
            PrivateKeyCleartext = Convert.ToBase64String(bytes),
            PublicKeyCleartext = pubKeyString,
            PrivateBytes = bytes,
            BlobFormat = blobType,
            KeySize = keySize
        };
    }

    private static string exportKeyToString(RSAParameters key)
    {
        string keyString;
        var sw = new StringWriter();
        var xs = new XmlSerializer(typeof(RSAParameters));
        xs.Serialize(sw, key);
        keyString = sw.ToString();
        return keyString;
    }

    public void SavePrivateKeyToLocalMachine(KeyGenerationResult keyData, string keyName)
    {
        var myKSP = CngProvider.MicrosoftSoftwareKeyStorageProvider;
        const bool MachineKey = false;

        if (!CngKey.Exists(keyName, myKSP))
        {
            var keyParams = new CngKeyCreationParameters
            {
                ExportPolicy = CngExportPolicies.AllowPlaintextExport,
                KeyCreationOptions = (MachineKey) ? CngKeyCreationOptions.MachineKey : CngKeyCreationOptions.None,
                Provider = myKSP
            };
            keyParams.Parameters.Add(new CngProperty("Length", BitConverter.GetBytes(keyData.KeySize), CngPropertyOptions.None));
            keyParams.Parameters.Add(new CngProperty(keyData.BlobFormat.Format, keyData.PrivateBytes, CngPropertyOptions.None));

            CngKey.Create(CngAlgorithm.Rsa, keyName, keyParams);
        }
        else
        {
            throw new CryptographicException($"The key with the name '{keyName}' already exists!");
        }
    }