RE: Authenticode Certificate Asymmetric Encryption/Decryption Doesn't
- From: lelteto <lelteto@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 29 Oct 2007 16:16:01 -0700
1. The probable cause is that the authenticode certificate says that the
private key is for SIGNING only - and you try to use it for decryption.
2. What is the point of using private / public keys to encrypt / decrypt
data in your application if the PRIVATE KEY is stored inside your code?
- a cracker can find it, then calculate the public keay and can encrypt any
data of his choice (to replace your data - activa attack)
- the carcker can wait until the app decrypts the data then it is known and
can be saved from the app's memory (passive attack)
- decrypting with private key is SLOW
Can you tell WHY are you trying to do this strange encrypt / decrypt? What
is your threat model? (ie. what are you trying to protect from?)
If you really need to encrypt some data then just as well you can use
secret-key (eg. AES) encryption. The protection would be the same (as the key
embedded in your code anyway) - but AES at least would be much faster and
would allow any size data.
Laszlo Elteto
SafeNet, Inc.
"SugarDaddy" wrote:
I wrote an app to encrypt strings using the public key within an.
authenticode certificate purchased from Thawte. The app will also use
the private key to (attempt to) decrypt the resulting cypher text as
well.
The problem is, I get a "Bad key" message every time I try to
decrypt. The actual C# code is pretty simple:
public static byte[] EncryptStringAsym(string ptext, X509Certificate2
cert, out string error)
{
error = string.Empty;
byte[] encBytes = null;
try
{
RSACryptoServiceProvider rsa =
(RSACryptoServiceProvider)cert.PublicKey.Key;
encBytes = rsa.Encrypt(Encoding.UTF8.GetBytes(ptext),
false);
}
catch (Exception x)
{
error = x.Message;
}
return encBytes;
}
public static string DecryptStringAsym(byte[] ctext, X509Certificate2
cert, out string error)
{
error = string.Empty;
if (!cert.HasPrivateKey)
{
error = "Private key required to decrypt.";
return null;
}
byte[] decBytes = null;
try
{
RSACryptoServiceProvider rsa =
(RSACryptoServiceProvider)cert.PrivateKey;
decBytes = rsa.Decrypt(ctext, false);
}
catch (Exception x)
{
error = x.Message;
}
return (decBytes == null ? null :
Encoding.UTF8.GetString(decBytes));
}
I also generated a certificate using makecert to test it and it
decrypts the text just fine. I am aware of the block size issue. My
messages don't exceed the size of the block (on the authenticode it's
256, on the custom cert it's 128).
Any ideas on why this could be?
- Follow-Ups:
- References:
- Prev by Date: Authenticode Certificate Asymmetric Encryption/Decryption Doesn't Work
- Next by Date: Re: Secure IPC
- Previous by thread: Authenticode Certificate Asymmetric Encryption/Decryption Doesn't Work
- Next by thread: Re: Authenticode Certificate Asymmetric Encryption/Decryption Doesn't
- Index(es):
Relevant Pages
|
|
