How can I sign a file using RSA and SHA256 with .NET?

by

RSA + SHA256 can and will work…

Your later example may not work all the time, it should use the hash algorithm’s OID, rather than it’s name. As per your first example, this is obtained from a call to CryptoConfig.MapNameToOID(AlgorithmName) where AlgorithmName is what you are providing (i.e. “SHA256”).

First you are going to need is the certificate with the private key. I normally read mine from the LocalMachine or CurrentUser store by using a public key file (.cer) to identify the private key, and then enumerate the certificates and match on the hash…

X509Certificate2 publicCert = new X509Certificate2(@"C:\mycertificate.cer");

//Fetch private key from the local machine store
X509Certificate2 privateCert = null;
X509Store store = new X509Store(StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);
foreach( X509Certificate2 cert in store.Certificates)
{
    if (cert.GetCertHashString() == publicCert.GetCertHashString())
        privateCert = cert;
}

However you get there, once you’ve obtained a certificate with a private key we need to reconstruct it. This may be required due to the way the certificate creates it’s private key, but I’m not really sure why. Anyway, we do this by first exporting the key and then re-importing it using whatever intermediate format you like, the easiest is xml:

//Round-trip the key to XML and back, there might be a better way but this works
RSACryptoServiceProvider key = new RSACryptoServiceProvider();
key.FromXmlString(privateCert.PrivateKey.ToXmlString(true));

Once that is done we can now sign a piece of data as follows:

//Create some data to sign
byte[] data = new byte[1024];

//Sign the data
byte[] sig = key.SignData(data, CryptoConfig.MapNameToOID("SHA256"));

Lastly, the verification can be done directly with the certificate’s public key without need for the reconstruction as we did with the private key:

key = (RSACryptoServiceProvider)publicCert.PublicKey.Key;
if (!key.VerifyData(data, CryptoConfig.MapNameToOID("SHA256"), sig))
    throw new CryptographicException();

More Related Contents:

  1. Encrypt and decrypt a string in C#? [closed]
  2. How to read a PEM RSA private key from .NET
  3. C# version of OpenSSL EVP_BytesToKey method?
  4. Generate and Sign Certificate Request using pure .net Framework
  5. Which cryptographic hash function should I choose?
  6. Why use the C# class System.Random at all instead of System.Security.Cryptography.RandomNumberGenerator?
  7. Generate a self-signed certificate on the fly
  8. How to store/retrieve RSA public/private key
  9. OpenSSL encryption using .NET classes
  10. Encrypting/Decrypting large files (.NET)
  11. Password encryption/decryption code in .NET
  12. CryptographicException “Key not valid for use in specified state.” while trying to export RSAParameters of a X509 private key
  13. Import a Public key from somewhere else to CngKey?
  14. Return array from function.
  15. Check if the two Files exist in the folder
  16. Reading/writing an INI file
  17. Getting ServiceStack to retain type information
  18. Why does Boolean.ToString output “True” and not “true”
  19. Converting BitmapImage to Bitmap and vice versa
  20. How to add an extra button to the window’s title bar?
  21. Regarding local variable passing in Thread
  22. Integrating into Windows Explorer context menu
  23. C# / F# Performance comparison
  24. How to ensure a timestamp is always unique?
  25. Is it possible to create a new operator in c#?
  26. How can I test for negative zero?
  27. How to Change Pixel Color of an Image in C#.NET
  28. How to unit test if my object is really serializable?
  29. Why do both the abstract class and interface exist in C#?
  30. Workflow Design Dilemma – State Machine, yes or no

Leave a Comment