Using the Public Key embedded in the Assembly?

From: roland (roland.demeester_at_skynet.be)
Date: 10/01/04 

Date: Fri, 1 Oct 2004 09:21:25 +0200

L.S.
I want to build-in a license scheme in my controls.
The concept is to have the public key embedded im my assembly; a
licenseprovider then retrieves this public key and uses it to verify the
signature of the license file. The license file is unique to each licensee,
so if the license file is going astray, I always can trace the source.

This is how I implemented this:

I used sn.exe to create an RSA keypair that I refer to in my assembly and I
stored this key pair (via sn. exe -i) in a named csp container. This embeds
the public key in my assembly. In my license file creation program I use an
RSACryptographicProvider based on cspParameters from this named container.
During execution I retrieve the public key from the assembly through
[Assembly].GetExecutingAssembly().getName.getPublicKey. This gives me a byte
array, 160 long. The problem is that the methods for verifying the signature
in a signedXML document are using a RSACryptographicProvider and not this
publicKey as a byte array. By browsing the user groups I found (was 'told')
that I can retrieve the modulus and the exponent from this byte array: the
exponent should be equal to the last 3 elements and the modulus should be
128 elements long and starting at 27th element.
This should make it possible to create such a provider and use it to verify
the signature.
  'Create a new instance of RSACryptoServiceProvider.
  Dim _rsa As RSACryptoServiceProvider = New RSACryptoServiceProvider
  Dim _RSAKeyInfo As RSAParameters = New RSAParameters
  'Set _RSAKeyInfo to the public key values.
  _RSAKeyInfo.Modulus = _modulus '(a byte array extracted from the publickey
array)
  _RSAKeyInfo.Exponent = _exponent '(idem)
  'Import key parameters into the provider.
  _rsa.ImportParameters(_RSAKeyInfo)
  ...
  return signedXml.CheckSignature(_rsa)
But this doesn't work!
When I extract the public key by using ToXMLString(False) in both cases, I
get a totally different result for the public key: the modulus of the public
key retrieved from the csp container is only some 88 characters long, while
the one retrieved from the embedded public key in the assembly is some 160
characters long. Also the exponents are totally different (although their
length is the same: 3).

Obviously I am doing something wrong. Can anybody point me to the solution?
Thanks in advance.

Roland

Relevant Pages

  • RSA frustrations - encrypt with private, decrypt with public - possible?
    ... -User with name "Foo" requests license. ... -User has public key, ... sufficient - I want to encrypt / decrypt a small amount of arbitrary ... "distribute private key, ...
    (microsoft.public.security)
  • RSA frustrations - encrypt with private, decrypt with public - possible?
    ... -User with name "Foo" requests license. ... -User has public key, ... sufficient - I want to encrypt / decrypt a small amount of arbitrary ... "distribute private key, ...
    (microsoft.public.dotnet.security)
  • Re: PKI confusion...
    ... Your program will embed the public key in the library. ... verify the license file is valid. ... The most simple to understand are jump networks - is a lot of extra ... Another method is to encode the license into the call tree, ...
    (microsoft.public.dotnet.security)
  • Re: Using the Public Key embedded in the Assembly?
    ... Why are you using a different source (CSP vs assembly signature) for the ... license signing and verification? ... Why not read the public key from your ... > that I can retrieve the modulus and the exponent from this byte array: ...
    (microsoft.public.dotnet.security)
  • Private key different; Public key same on Different Machines
    ... marketing and sales people can use to sign license requests. ... Since I'm using the RSA CSP and extracting the public key from the key ... KeyPair.snk" some time back and installed into a machine key container on ... be shared by all assemblies we produce). ...
    (microsoft.public.dotnet.security)
Quantcast