RE: Using the Public Key embedded in the Assembly?

From: Shawn Farkas [MS] (shawnfa_at_online.microsoft.com)
Date: 10/01/04

  • Next message: Chris L.: "ASP.NET Certificate Hell - 1024 bit? PFX linked to CSP?" 
    Date: Fri, 01 Oct 2004 21:51:18 GMT

    Hi Roland,

            Instead of parsing the blob yourself, I would instead try to put it in a
    key container, and then use the RSACryptoServiceProvider constructor that
    reads keys out of containers. If you're on Whidbey, you can use the new
    ImportCspBlob method on RSACryptoServiceProvider, but if you're on Everett
    you'll have to do a little more work.
            You can use the exposed StrongNameKeyInstall API. You can find:
                    * some details on using this API here:
    http://blogs.msdn.com/shawnfa/archive/2004/10/01/236773.aspx
                    * the P/Invoke declaration for it here:
    http://blogs.msdn.com/shawnfa/articles/236725.aspx
                    * and a sample of using it here;
    http://blogs.msdn.com/shawnfa/articles/236731.aspx
            Specifically, you'll want to look at the InstallKey method on line 149 of
    that last link.

            Once you've gotten a key into the key container, you can create a
    CspParameters object that specifies the key container name you installed
    to, and pass that object to the RSACryptoServiceProvider constructor.

            When you've finished your validation, the same links above will give a
    sample of the StrongNameKeyDelete API, which will remove the key container.

    -Shawn
    http://blogs.msdn.com/shawnfa
    --
    This posting is provided "AS IS" with no warranties, and confers no rights.
     

    Note:
    For the benefit of the community-at-large, all responses to this message
    are best directed to the newsgroup/thread from which they originated.
    --------------------
    > From: "roland" <roland.demeester@skynet.be>
    > Subject: Using the Public Key embedded in the Assembly?
    > Date: Fri, 1 Oct 2004 09:21:25 +0200
    > Lines: 48
    > X-Priority: 3
    > X-MSMail-Priority: Normal
    > X-Newsreader: Microsoft Outlook Express 6.00.2800.1437
    > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
    > Message-ID: <#T1kkd4pEHA.3252@TK2MSFTNGP14.phx.gbl>
    > Newsgroups: microsoft.public.dotnet.security
    > NNTP-Posting-Host: 46.180-201-80.adsl.skynet.be 80.201.180.46
    > Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
    > Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.security:7590
    > X-Tomcat-NG: microsoft.public.dotnet.security
    >
    > L.S.
    > I want to build-in a license scheme in my controls.
    > The concept is to have the public key embedded im my assembly; a
    > licenseprovider then retrieves this public key and uses it to verify the
    > signature of the license file. The license file is unique to each
    licensee,
    > so if the license file is going astray, I always can trace the source.
    >
    > This is how I implemented this:
    >
    > I used sn.exe to create an RSA keypair that I refer to in my assembly and
    I
    > stored this key pair (via sn. exe -i) in a named csp container. This
    embeds
    > the public key in my assembly. In my license file creation program I use
    an
    > RSACryptographicProvider based on cspParameters from this named container.
    > During execution I retrieve the public key from the assembly through
    > [Assembly].GetExecutingAssembly().getName.getPublicKey. This gives me a
    byte
    > array, 160 long. The problem is that the methods for verifying the
    signature
    > in a signedXML document are using a RSACryptographicProvider and not this
    > publicKey as a byte array. By browsing the user groups I found (was
    'told')
    > that I can retrieve the modulus and the exponent from this byte array: the
    > exponent should be equal to the last 3 elements and the modulus should be
    > 128 elements long and starting at 27th element.
    > This should make it possible to create such a provider and use it to
    verify
    > the signature.
    > 'Create a new instance of RSACryptoServiceProvider.
    > Dim _rsa As RSACryptoServiceProvider = New RSACryptoServiceProvider
    > Dim _RSAKeyInfo As RSAParameters = New RSAParameters
    > 'Set _RSAKeyInfo to the public key values.
    > _RSAKeyInfo.Modulus = _modulus '(a byte array extracted from the
    publickey
    > array)
    > _RSAKeyInfo.Exponent = _exponent '(idem)
    > 'Import key parameters into the provider.
    > _rsa.ImportParameters(_RSAKeyInfo)
    > ...
    > return signedXml.CheckSignature(_rsa)
    > But this doesn't work!
    > When I extract the public key by using ToXMLString(False) in both cases, I
    > get a totally different result for the public key: the modulus of the
    public
    > key retrieved from the csp container is only some 88 characters long,
    while
    > the one retrieved from the embedded public key in the assembly is some 160
    > characters long. Also the exponents are totally different (although their
    > length is the same: 3).
    >
    > Obviously I am doing something wrong. Can anybody point me to the
    solution?
    > Thanks in advance.
    >
    > Roland
    >
    >
    >

  • Next message: Chris L.: "ASP.NET Certificate Hell - 1024 bit? PFX linked to CSP?"

    Relevant Pages

    • Re: Using the Public Key embedded in the Assembly?
      ... assembly and to embed the public key in the assembly. ... When I send the assembly to a customer (together with the license file), ... and no csp container with such name and content exists on the machine of the ... > ImportCspBlob method on RSACryptoServiceProvider, ...
      (microsoft.public.dotnet.security)
    • Re: Suggested additional constructor for RSACryptoServiceProvider
      ... Since we're on the subject of the RSACryptoServiceProvider class, ... generates new RSA public/private transient key-pairs each time invoked. ... creates a persistent key container with the name ... >> constructors support initializing with existing RSA credentials using ...
      (microsoft.public.dotnet.security)
    • Unhadelded Exception Occurs When using RSACryptoServiceProvider
      ... Simply I am trying to use RSACryptoServiceProvider to generate a key ... encrypt it with my public key, send the encrypted data back for me to ... an unhandled exception is fired somewhere in the Crypto Service ... string encryptedData = GetSecureData; ...
      (microsoft.public.dotnet.framework.aspnet)
    • CryptImportKey Question
      ... I am having trouble attempting to use a public key that I have imported into ... public key if I use the handle that is returned by the CryptImportKey ... the key container and get the public key using the CryptGetUserKey function. ... CryptAcquireContext - opens the key container. ...
      (microsoft.public.platformsdk.security)
    • Re: More CryptImportKey/NTE_BAD_KEY issues
      ... > generate and maintain a selection of keys to be kept within our own keystore ... > for encrypting this data. ... >> key is apparently a public key that correspond to private key stored on ... >> computer A in a key container that you are opening with CryptAcquireContext ...
      (microsoft.public.platformsdk.security)