Re: Problems with public key decryption with RSA
- From: Rajesh.Thareja <Rajesh.Thareja.23v2yo@xxxxxxxxxxxx>
- Date: Sun, 26 Feb 2006 01:51:31 -0600
Hi,
I am also working the similar solution. That is I want to encrypt the
data with the private key (from smart card) and decrypt the data usnig
the public key in a web service.
To do this, I am using the CryptoAPI. And right now I am trying to do
this without using the web server, but implement as form based
applicaiton.
I have been able to encrypt with the private key and decrypt with the
public kye on machine. But when I take that code on any other machine,
the decryption fails.
I am pasting the code I am using for decryption below, any Idea on how
to go about it.
//--------------
hSysStore = CertOpenSystemStore(IntPtr.Zero,
HeaderConstants.OtherStore) ; // MyStore
// Finding the certificate in store for the using subject string
"rachit"
// This function returns handle to the certificate
pDesiredCert = CertFindCertificateInStore(hSysStore,
HeaderConstants.X509_ASN_ENCODING, 0,
HeaderConstants.CERT_FIND_SUBJECT_STR, "rachit", pDesiredCert);
resultPK=CryptAcquireCertificatePrivateKey( // gets the acquires the
private key for the specified certificate
pDesiredCert,
HeaderConstants.CRYPT_ACQUIRE_USE_PROV_INFO_FLAG|HeaderConstants.CRYPT_ACQUIRE_COMPARE_KEY_FLAG,
0,
ref hKey, //Pointer to the returned HCRYPTPROV value
ref dwKeySpec, // Pointer to a uint value identifying the private key
to use from the acquired provider's key container. It can be
AT_KEYEXCHANGE or AT_SIGNATURE.
ref fCallerFreeProv);
//Retrieves a handle of one of a user's two public/private key pairs.
resultPK = CryptGetUserKey(hKey,dwKeySpec,ref hPublicKey);
buffer = new byte[dataLength];
Buffer.BlockCopy(data, 0, buffer, 0, data.Length);
dataLength = (uint)data.Length;
bufLength = (uint)buffer.Length;
CryptDecrypt(hPublicKey, IntPtr.Zero, true, 0, buffer, ref
dataLength);
//--------------
Rajesh
jared wrote:
*a1. Generate a random symmetric key on the server.
a2. Encrypt the symmetric key with the server's own public key.
a3. Sign the encrypted key blob with the server's own private key.
a4. Store the signed, encrypted blob someplace.
-----------------
To encrypt a package:
e1. retrieve what you believe to be the signed, encrypted symmetric
keyblob.
e2. verify the signature on the key blob using the server's public
key
e3. if the signature is valid, decrypt the symmetric key using the
server's public key.
e4. use the plaintext symmetric key to encrypt the data you want to
send to the client.
e5. erase the plaintext symmetric key from memory
e6.store a signed md5 hash of the encrypted client data
e7. store the encrypted client data
---------------
To send a formerly encrypted package to a client:
s1. retrieve the encrypted client data and your signed hash of it
s2. verify the integrity of the encrypted client data
s3. initiate Diffie Hellman key agreement between the server and
client, the result of which will be your key transport session key
s4. use e1, e2, e3 above to get a plaintext version of your
symmetric
data encryption key
s5. re-encrypt the symmetric data encryption key using the key
transport session key agreed upon via diffie hellman
s6. send the encrypted symmetric data encryption key to the client
machine
s7. erase the plaintext data encryption key from memory
s8. erase the key transport session key from memory
-----------
The client machine should decrypt the symmetric key using its copy
of
the key transport session key, decrypt the data you just sent it,
and
erase both keys from memory as soon as possible. Your secret
symmetric
key should never reside anywhere in plaintext when it is not
actually
in use, and should only be stored protected by the server's private
key
(which itself, ideally, will only exist in hardware).
The hard part is implementing Diffie Hellman, and I'm guessing
there's
a good free implementation available.
Cheers- *
--
Rajesh.Thareja
------------------------------------------------------------------------
Posted via http://www.mcse.ms
------------------------------------------------------------------------
View this thread: http://www.mcse.ms/message1384679.html
.
- Prev by Date: Re: Usernametoken can't beused inweb services that are invoked bywebcl
- Next by Date: Permissions on dynamically loaded assembly?
- Previous by thread: Usernametoken can't beused inweb services that are invoked bywebcl
- Next by thread: Permissions on dynamically loaded assembly?
- Index(es):
Relevant Pages
|
