Ok, let's get started... step 1 will be to create a test certificate that you can use for testing all of this out. Open the "Developer Command Prompt" which is located in the Visual Studios program folder. If you can't find that, google makecert.exe and pvk2pfx.exe to find out where they are located and then copy them to a location where you can save certificates. Once you have the command prompt open and have access to makecert and pvk2pfx, issue the following commands. You can adjust the dates as desired, but keep the names (or adjust the name in the test code we will write below).
makecert.exe -sv TestCertificate.pvk -n "CN=TestCertificate"
TestCertificate.cer -sky Exchange -pe
-b 10/27/2012 -e 10/27/2020 -r
pvk2pfx.exe -pvk TestCertificate.pvk -spc TestCertificate.cer
-pfx TestCertificate.pfx
Next up, let's add a utility that we will use for other cryptographic work... I have created a folder named "encryption" where my classes will go... it is up to you how you want to organize your code. Add a new class file called CryptoUtilities.cs and add the following code:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading.Tasks;
namespace BlogSandbox.encryption
{
public class CryptoUtilities
{
// make sure certName passed in starts with 'CN='
public static X509Certificate2 GetCertFromStore(
StoreName storeName,
string certName)
{
X509Store store = new X509Store(storeName);
store.Open(OpenFlags.ReadOnly);
X509Certificate2Collection currentValidCerts =
store.Certificates.Find(
X509FindType.FindByTimeValid,
DateTime.Now,
false);
X509Certificate2Collection certs =
currentValidCerts.Find(
X509FindType.FindBySubjectDistinguishedName,
certName,
false);
// check certs count and throw error if 0 if desired
return certs[0];
}
}
}
Create a new class called DigitilSignature.cs and add the following code to it:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading.Tasks;
namespace BlogSandbox.encryption
{
class DigitalSignature
{
private const string DefaultAlgName = "sha1";
public static byte[] SignMessage(
StoreName storeName,
string certName,
string algName,
byte[] message)
{
X509Certificate2 x509Cert =
CryptoUtilities.GetCertFromStore(
storeName,
certName);
RSACryptoServiceProvider digSigProvider =
x509Cert.PrivateKey as RSACryptoServiceProvider;
// if no provider and no private key
// check for and throw exception
return digSigProvider.SignData(
message,
CryptoConfig.MapNameToOID(algName));
}
public static byte[] SignMessage(
StoreName storeName,
string certName,
byte[] message)
{
return SignMessage(storeName,
certName,
DefaultAlgName,
message);
}
public static bool VerifySignature(
StoreName storeName,
string certName,
string algName,
byte[] message,
byte[] signature)
{
X509Certificate2 x509Cert =
CryptoUtilities.GetCertFromStore(
storeName,
certName);
RSACryptoServiceProvider digSigProvider =
x509Cert.PrivateKey as RSACryptoServiceProvider;
// if no provider and no private key
// check for and throw exception
return digSigProvider.VerifyData(
message,
CryptoConfig.MapNameToOID(algName),
signature);
}
public static bool VerifySignature(
StoreName storeName,
string certName,
byte[] message,
byte[] signature)
{
return VerifySignature(storeName,
certName,
DefaultAlgName,
message,
signature);
}
}
}
Ok, the final code for this post is a simple method to execute a test on this code.
using BlogSandbox.command;
using BlogSandbox.encryption;
using System;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace BlogSandbox
{
class Program
{
static void Main(string[] args)
{
string textToSign = "Sign this text";
byte[] signature = DigitalSignature.SignMessage(
StoreName.My,
"CN=TestCertificate",
Encoding.UTF8.GetBytes(textToSign));
bool verified = DigitalSignature.VerifySignature(
StoreName.My,
"CN=TestCertificate",
Encoding.UTF8.GetBytes(textToSign),
signature);
Console.WriteLine("Verified? " + verified);
Thread.Sleep(20000);
}
}
}
In the next few blog posts (I will try to wrap them up over the next few weeks) I will show you how to handle the symmetric encryption of your message, followed by the asymmetric encryption of the keys. Once I have done that, I will go over how to put it all together to create a single message that you can send across the network/intranet/internet.
