Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

implement RSA in .NET core

I'm trying to encrypt and decrypt some data with RSA. I've looked up teh RSA class but I'm only seeing the abstract class https://msdn.microsoft.com/en-us/library/system.security.cryptography.rsa(v=vs.110).aspx

I've read that the RSA class in DNX5 is different from the one in .net 4.6.1 Is that a different one than what I'm seeing? If so where can I find the documentation to use that one? It also appears that RSACryptoServiceProvider is not working in .net core and I only have access to the RSA abstract class.

like image 810
mysticalstick Avatar asked Feb 01 '17 18:02

mysticalstick


People also ask

Why is RSA not used anymore?

The problem with RSA is that as these keys get longer, the increase in security isn't commensurate to the increase in computational power it takes to use them. It's just not sustainable. The CAB Forum just mandated that keys used for signing software must now be at least 3072-bit in length if you're using RSA.

Can RSA be used for key generation?

Key generation. The keys for the RSA algorithm are generated in the following way: Choose two distinct prime numbers p and q. For security purposes, the integers p and q should be chosen at random and should be similar in magnitude but differ in length by a few digits to make factoring harder.


2 Answers

You should avoid using RSACryptoServiceProvider if you can. It only works on Windows (and it's the less good RSA implementation on Windows). Stick to the RSA base class, and create new instances via RSA.Create()

Ephemeral Keys (Creation)

.NET Core

using (RSA rsa = RSA.Create()) {     rsa.KeySize = desiredKeySizeInBits;      // when the key next gets used it will be created at that keysize.     DoStuffWithThePrivateKey(rsa); } 

.NET Framework

Unfortunately, the default for RSA.Create() on .NET Framework is RSACryptoServiceProvider, which doesn't respect set_KeySize. So if you need ephemeral keys you'll need to use different code on .NET Framework vs .NET Core:

using (RSA rsa = new RSACng()) {     rsa.KeySize = desiredKeySizeInBits;      DoStuffWithThePrivateKey(rsa); } 

Or, if you need to support versions earlier than 4.6 (where RSACng didn't exist) / 4.6.2 (where most of the .NET Framework worked happily with RSACng objects instead of RSACryptoServiceProvider objects) you can continue to use the older implementation:

using (RSA rsa = new RSACryptoServiceProvider(desiredKeySizeInBits)) {     // Since before net46 the Encrypt/Decrypt, SignData/VerifyData, SignHash/VerifyHash     // methods were not defined at the RSA base class, you might need to keep this strongly     // typed as RSACryptoServiceProvider.     DoStuffWithThePrivateKey(rsa); } 

Ephemeral Keys (Import)

Even though RSACng, in general, is easier to work with than RSACryptoServiceProvider, RSACryptoServiceProvider should work fine in this context, so RSA.Create() is good on all platforms:

using (RSA rsa = RSA.Create()) {     rsa.ImportParameters(rsaParameters);      DoStuffWithWhateverKindOfKeyYouImported(rsa); } 

From a certificate:

.NET Core 1.0+, .NET Framework 4.6+

using (RSA rsa = cert.GetRSAPublicKey()) {     DoStuffWithThePublicKey(rsa); } 

or

using (RSA rsa = cert.GetRSAPrivateKey()) {     DoStuffWithThePrivateKey(rsa); } 

.NET Framework < 4.6

// Do NOT put this in a using block, since the object is shared by all callers: RSA rsaPrivate = (RSA)cert.PrivateKey; DoStuffWithThePrivateKey(rsaPrivate);  // Do NOT put this in a using block, since the object is shared by all callers: RSA rsaPublicOnly = (RSA)cert.PublicKey.Key; DoStuffWithThePublicKey(rsaPublic); 

Using Named/Persisted Keys (Windows-only)

I was going to include some samples about RSACryptoServiceProvider (WinXP+/CAPI) and RSACng (Win7+/CNG) creating/opening named keys, but that's not a very common scenario in .NET; and it certainly isn't portable (portability to other OSes being one of the more compelling arguments for .NET Core).

Referencing things.

For .NET Core 1.0 and 1.1, you get access to the RSA base class from the System.Security.Cryptography.Algorithms package. In .NET Core 2.0 it will be included in the netstandard package reference.

If you need to do complex interop with the OS you can reference System.Security.Cryptography.Cng (Windows CNG), System.Security.Cryptography.Csp (Windows CAPI/CryptoServiceProvider), or System.Security.Cryptography.OpenSsl (Linux OpenSSL, macOS OpenSSL) and get access to the interop-enabled classes (RSACng, RSACryptoServiceProvider, RSAOpenSsl). But, really, you shouldn't do that.

What does RSA.Create() return?

  • .NET Framework: RSACryptoServiceProvider, unless changed by CryptoConfig.
  • .NET Core (Windows): A private class which implements RSA via CNG, you can't cast it to any more specific type.
  • .NET Core (Linux): A private class which implements RSA via OpenSSL, you can't cast it to any more specific type.
  • .NET Core (macOS): A private class which implements RSA via OpenSSL, you can't cast it to any more specific type. (This should be via SecureTransforms in the next release of .NET Core)
like image 143
bartonjs Avatar answered Oct 11 '22 08:10

bartonjs


You will need to use the dotnetcore library instead. Add the System.Security.Cryptography.Algorithms Nuget package to your project. You can find it here: System.Security.Cryptography.Algorithms

It provides all the common Algorithms for your project.

Here is the RSACryptoServiceProvider class that you would use for the Encrypt() and Decrypt() methods.

like image 43
truemedia Avatar answered Oct 11 '22 08:10

truemedia