使用证书解密加密密钥在 .NET 中不起作用但在 SOAP UI 中起作用

Question

我试图弄清楚为什么我似乎无法使用 X509 证书从 .NET 解密加密密钥。

    encryptedKey = "jW3VDsUZWIdzfZ1bPN3iKI2Pf9u22kUax0DFnF3A9H+nvcBQuVC2efw1FYGm5/AvnN27kXqA4PyCqcQLp/tguVqHtzdR7mJtkTCyY8TUoAej2Mqzv2uiEKULB/8rlPDl2DOkSMGJqieenAG/7gZjWhlU0eYrlcMi5dtAnPFTfy+LvtJ6bbGEDgy4FhoT49T6sO0kjBJHp5YI0p/CeEuc+WMT/BMGG1YuDPswltj0VzeaE3KbHSLvJPjGCQ3U0YkUWm8h9zM22S/mRvfMhEu1aRdQpojGUiSLKUJyotNu8fRulKeB1TVuE7AlDGrbAUsRtU+y6PdLMcEHW+BRq5Uouw==";

    var encryptedKeyByte = Convert.FromBase64String(encryptedKey);

    var clientCert = new X509Certificate2(@"C:\certificates\xxxxx.pfx", "xxxx");
    var rsa = (RSACryptoServiceProvider)clientCert.PrivateKey;
    byte[] key = rsa.Decrypt(encryptedKeyByte, false);

当我尝试运行代码的最后一行rsa.Decrypt(encryptedKeyByte, false)时出现的错误

参数不正确。

在 SOAP UI 中，我使用相同的证书进行解密。我只需要将文件 pfx 转换为 jks 文件即可使其在 SOAP UI 中工作。但除此之外，设置对我来说是一样的。 这是 SOAP UI 设置的屏幕截图。我猜 SOAP UI 设置中的签名密钥库不用于解密过程。 SOAP UI 中的解密密钥库设置是我在 .NET 中使用的设置。只有在 .NET 中它是一个 pfx 文件。

这是来自 MMC 的证书详细信息

堆栈跟踪错误：

服务器堆栈跟踪：

   at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
   at System.Security.Cryptography.RSACryptoServiceProvider.DecryptKey(SafeKeyHandle pKeyContext, Byte[] pbEncryptedKey, Int32 cbEncryptedKey, Boolean fOAEP, ObjectHandleOnStack ohRetDecryptedKey)
   at System.Security.Cryptography.RSACryptoServiceProvider.Decrypt(Byte[] rgb, Boolean fOAEP)
   at Microsoft.Austria.WcfHelpers.SoapWithAttachments.SwaEncoder.ReadMessage(Stream stream, Int32 maxSizeOfHeaders, String contentType) in C:\Crap\Stuff\CARES\Microsoft.Austria.WcfHelpers.SoapWithAttachments\SwaEncoder.cs:line 503
   at Microsoft.Austria.WcfHelpers.SoapWithAttachments.SwaEncoder.ReadMessage(Stream stream, Int32 maxSizeOfHeaders, String contentType) in C:\Crap\Stuff\CARES\Microsoft.Austria.WcfHelpers.SoapWithAttachments\SwaEncoder.cs:line 458
   at Microsoft.Austria.WcfHelpers.SoapWithAttachments.SwaEncoder.ReadMessage(ArraySegment`1 buffer, BufferManager bufferManager, String contentType) in C:\Crap\Stuff\CARES\Microsoft.Austria.WcfHelpers.SoapWithAttachments\SwaEncoder.cs:line 126
   at System.ServiceModel.Channels.HttpInput.DecodeBufferedMessage(ArraySegment`1 buffer, Stream inputStream)
   at System.ServiceModel.Channels.HttpInput.ReadBufferedMessage(Stream inputStream)
   at System.ServiceModel.Channels.HttpInput.ParseIncomingMessage(HttpRequestMessage httpRequestMessage, Exception& requestException)
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
   at System.ServiceModel.Channels.RequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Dispatcher.RequestChannelBinder.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 

Answer 1

这门课可能对你有帮助吗：

public class TFRSAEncryption
{
    public string RsaEncryptWithPublic(string clearText, string publicKey)
    {
        var bytesToEncrypt = Encoding.UTF8.GetBytes(clearText);

        var encryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(publicKey))
        {
            var keyParameter = (AsymmetricKeyParameter)new PemReader(txtreader).ReadObject();

            encryptEngine.Init(true, keyParameter);
        }

        var encrypted = Convert.ToBase64String(encryptEngine.ProcessBlock(bytesToEncrypt, 0, bytesToEncrypt.Length));
        return encrypted;

    }

    public string RsaEncryptWithPrivate(string clearText, string privateKey)
    {
        var bytesToEncrypt = Encoding.UTF8.GetBytes(clearText);

        var encryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(privateKey))
        {
            var keyPair = (AsymmetricCipherKeyPair)new PemReader(txtreader).ReadObject();

            encryptEngine.Init(true, keyPair.Private);
        }

        var encrypted = Convert.ToBase64String(encryptEngine.ProcessBlock(bytesToEncrypt, 0, bytesToEncrypt.Length));
        return encrypted;
    }


    // Decryption: 

    public string RsaDecryptWithPrivate(string base64Input, string privateKey)
    {
        var bytesToDecrypt = Convert.FromBase64String(base64Input);

        AsymmetricCipherKeyPair keyPair;
        var decryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(privateKey))
        {
            keyPair = (AsymmetricCipherKeyPair)new PemReader(txtreader).ReadObject();

            decryptEngine.Init(false, keyPair.Private);
        }

        var decrypted = Encoding.UTF8.GetString(decryptEngine.ProcessBlock(bytesToDecrypt, 0, bytesToDecrypt.Length));
        return decrypted;
    }

    public string RsaDecryptWithPublic(string base64Input, string publicKey)
    {
        var bytesToDecrypt = Convert.FromBase64String(base64Input);

        var decryptEngine = new Pkcs1Encoding(new RsaEngine());

        using (var txtreader = new StringReader(publicKey))
        {
            var keyParameter = (AsymmetricKeyParameter)new PemReader(txtreader).ReadObject();

            decryptEngine.Init(false, keyParameter);
        }

        var decrypted = Encoding.UTF8.GetString(decryptEngine.ProcessBlock(bytesToDecrypt, 0, bytesToDecrypt.Length));
        return decrypted;
    }
}

Answer 2

该错误使我相信加密数据无法使用指定的方法解密。您可以在专门使用 .GetRSAPrivateKey() 的地方尝试这种方式，然后使用正确的填充方法进行解密。

据我所知，没有办法知道正在使用哪种填充方法，但您可以遍历选项并查看是否适合您。

var certPath = @"c:\code\temp\xxxxxxxxx.pfx";
var cert = new X509Certificate2(certPath, "xxxxxxx");
var decryptedData = cert.GetRSAPrivateKey().Decrypt(encryptedByteInfo, RSAEncryptionPadding.OaepSHA1);

本文列出填充方法：https://msdn.microsoft.com/en-us/library/system.security.cryptography.rsaencryptionpadding(v=vs.110).aspx