700字范文 > .NET Core 使用RSA算法加密/解密/签名/验证签名

.NET Core 使用RSA算法加密/解密/签名/验证签名

时间：2021-04-22 14:40:20

前言

前不久移植了支付宝官方的SDK，以适用 Core使用支付宝支付，但是最近有好几位用户反应在Linux下使用会出错，调试发现是RSA加密的错误，下面具体讲一讲。

RSA在.NET Core的改动

以前我们使用RSA加密主要是使用RSACryptoServiceProvider这个类，在.NET Core中也有这个类，但是这个类并不支持跨平台，所以如果你是用这个类来进行加/解密在windows上运行是完全没有错误的，但是只要你一放到Linux下就会出现异常。

查阅资料得知，要解决这个问题，需要改用System.Security.Cryptography.RSA.Create()工厂方法，使用它之后，在 Windows 上创建的是System.Security.Cryptography.RSACng的实例，在 Mac 与 Linux 上创建的是System.Security.Cryptography.RSAOpenSsl的实例，它们都继承自System.Security.Cryptography.RSA抽象类。

RSACng：

相关资料：/zh-cn/dotnet/api/system.security.cryptography.rsacng?view=netcore-2.0

RSAOpenSsl ：

相关资料：/zh-cn/dotnet/api/system.security.cryptography.rsaopenssl?view=netcore-2.0

在Windows上的调试截图：

在Mac上使用Visual studio For Mac 调试截图：

RSA公钥/私钥说明

这里的RSA加密/解密主要是针对于由OpenSSL生成的公钥/私钥字符串。ssh-keygen -t rsa 命令生成的公钥私钥是不行的。

公钥示例：

-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7PyjMEuniN6BPn8oqzIZ6AO1NjSTO9R3adCCIwKfKIEoWXXM+tHDpktdPKSaAsWJPTNAGvEvtxOfzXib/EMXKqD0eUy5MatfpRjRdf1hJVimmfrb09Qx2j7CsKLy7nD23m4xubdYBwvkjMwt/L3JxB5D6qryW1wei/j1c+/OCxQIDAQAB-----END PUBLIC KEY-----

私钥示例：

公钥/私钥生成

Windows&MAC_OSX可以使用有支付宝开发的RSA密钥生成工具：

使用此工具生成的时候一定要选择，PKCS1

下载地址：https://doc./docs/doc.htm?treeId=291&articleId=105971&docType=1

此外还可以使用OpenSSL工具命令来生成：https://doc./docs/doc.htm?articleId=106130&docType=1

.NET Core 中的使用

这里要讲一下RSA2算法。

什么是RSA2 ？RSA2 是在原来SHA1WithRSA签名算法的基础上，新增了支持SHA256WithRSA的签名算法。该算法比SHA1WithRSA有更强的安全能力。

签名的作用:保证数据完整性,机密性和发送方角色的不可抵赖性

这里来一发干货，我已经封装好的RSA/RSA2算法，支持加密/解密/签名/验证签名。

/// <summary>

/// RSA加解密使用OpenSSL的公钥加密/私钥解密

/// 作者：李志强

/// 创建时间：10月30日15:50:14

/// QQ:501232752

/// </summary>

public class RSAHelper{

private readonly RSA _privateKeyRsaProvider;

private readonly RSA _publicKeyRsaProvider;

private readonly HashAlgorithmName _hashAlgorithmName;

private readonly Encoding _encoding; /// <summary>/// 实例化RSAHelper/// </summary>/// <param name="rsaType">加密算法类型 RSA SHA1;RSA2 SHA256 密钥长度至少为2048</param>/// <param name="encoding">编码类型</param>/// <param name="privateKey">私钥</param>/// <param name="publicKey">公钥</param>public RSAHelper(RSAType rsaType, Encoding encoding, string privateKey, string publicKey = null) {_encoding = encoding;

if (!string.IsNullOrEmpty(privateKey)){_privateKeyRsaProvider = CreateRsaProviderFromPrivateKey(privateKey);} if (!string.IsNullOrEmpty(publicKey)){_publicKeyRsaProvider = CreateRsaProviderFromPublicKey(publicKey);}_hashAlgorithmName = rsaType == RSAType.RSA ? HashAlgorithmName.SHA1 : HashAlgorithmName.SHA256;} #region 使用私钥签名/// <summary>/// 使用私钥签名/// </summary>/// <param name="data">原始数据</param>/// <returns></returns>public string Sign(string data) {

byte[] dataBytes = _encoding.GetBytes(data);

var signatureBytes = _privateKeyRsaProvider.SignData(dataBytes, _hashAlgorithmName, RSASignaturePadding.Pkcs1);

return Convert.ToBase64String(signatureBytes);} #endregion#region 使用公钥验证签名/// <summary>/// 使用公钥验证签名/// </summary>/// <param name="data">原始数据</param>/// <param name="sign">签名</param>/// <returns></returns>public bool Verify(string data,string sign) {

byte[] dataBytes = _encoding.GetBytes(data);

byte[] signBytes = Convert.FromBase64String(sign);

var verify = _publicKeyRsaProvider.VerifyData(dataBytes, signBytes, _hashAlgorithmName, RSASignaturePadding.Pkcs1);

return verify;} #endregion#region 解密public string Decrypt(string cipherText) { if (_privateKeyRsaProvider == null){

throw new Exception("_privateKeyRsaProvider is null");}

return Encoding.UTF8.GetString(_privateKeyRsaProvider.Decrypt(Convert.FromBase64String(cipherText), RSAEncryptionPadding.Pkcs1));} #endregion#region 加密public string Encrypt(string text) {

if (_publicKeyRsaProvider == null){

throw new Exception("_publicKeyRsaProvider is null");}

return Convert.ToBase64String(_publicKeyRsaProvider.Encrypt(Encoding.UTF8.GetBytes(text), RSAEncryptionPadding.Pkcs1));} #endregion#region 使用私钥创建RSA实例public RSA CreateRsaProviderFromPrivateKey(string privateKey) { var privateKeyBits = Convert.FromBase64String(privateKey);

var rsa = RSA.Create();

var rsaParameters = new RSAParameters();

using (BinaryReader binr = new BinaryReader(new MemoryStream(privateKeyBits))){byte bt = 0;

ushort twobytes = 0;twobytes = binr.ReadUInt16();

if (twobytes == 0x8130)binr.ReadByte();

else if (twobytes == 0x8230)binr.ReadInt16();

elsethrow new Exception("Unexpected value read binr.ReadUInt16()");twobytes = binr.ReadUInt16();

if (twobytes != 0x0102)

throw new Exception("Unexpected version");bt = binr.ReadByte();

if (bt != 0x00)

throw new Exception("Unexpected value read binr.ReadByte()");rsaParameters.Modulus = binr.ReadBytes(GetIntegerSize(binr));rsaParameters.Exponent = binr.ReadBytes(GetIntegerSize(binr));rsaParameters.D = binr.ReadBytes(GetIntegerSize(binr));rsaParameters.P = binr.ReadBytes(GetIntegerSize(binr));rsaParameters.Q = binr.ReadBytes(GetIntegerSize(binr));rsaParameters.DP = binr.ReadBytes(GetIntegerSize(binr));rsaParameters.DQ = binr.ReadBytes(GetIntegerSize(binr));rsaParameters.InverseQ = binr.ReadBytes(GetIntegerSize(binr));}rsa.ImportParameters(rsaParameters);

return rsa;} #endregion#region 使用公钥创建RSA实例public RSA CreateRsaProviderFromPublicKey(string publicKeyString) { // encoded OID sequence for PKCS #1 rsaEncryption szOID_RSA_RSA = "1.2.840.113549.1.1.1"byte[] seqOid = { 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00 };

byte[] seq = new byte[15];

var x509Key = Convert.FromBase64String(publicKeyString); // --------- Set up stream to read the asn.1 encoded SubjectPublicKeyInfo blob ------using (MemoryStream mem = new MemoryStream(x509Key)){using (BinaryReader binr = new BinaryReader(mem)) //wrap Memory Stream with BinaryReader for easy reading{ byte bt = 0; ushort twobytes = 0;twobytes = binr.ReadUInt16(); if (twobytes == 0x8130) //data read as little endian order (actual data order for Sequence is 30 81)binr.ReadByte(); //advance 1 byteelse if (twobytes == 0x8230)binr.ReadInt16(); //advance 2 byteselsereturn null;seq = binr.ReadBytes(15); //read the Sequence OIDif (!CompareBytearrays(seq, seqOid)) //make sure Sequence for OID is correctreturn null;twobytes = binr.ReadUInt16(); if (twobytes == 0x8103) //data read as little endian order (actual data order for Bit String is 03 81)binr.ReadByte(); //advance 1 byteelse if (twobytes == 0x8203)binr.ReadInt16(); //advance 2 byteselsereturn null;bt = binr.ReadByte(); if (bt != 0x00) //expect null byte nextreturn null;twobytes = binr.ReadUInt16(); if (twobytes == 0x8130) //data read as little endian order (actual data order for Sequence is 30 81)binr.ReadByte(); //advance 1 byteelse if (twobytes == 0x8230)binr.ReadInt16(); //advance 2 bytes elsereturn null; twobytes = binr.ReadUInt16();

byte lowbyte = 0x00;

byte highbyte = 0x00;

if (twobytes == 0x8102) //data read as little endian order (actual data order for Integer is 02 81)lowbyte = binr.ReadByte(); // read next bytes which is bytes in modulus else if (twobytes == 0x8202) {highbyte = binr.ReadByte(); //advance 2 byteslowbyte = binr.ReadByte(); } elsereturn null;

byte[] modint = { lowbyte, highbyte, 0x00, 0x00 }; //reverse byte order since asn.1 key uses big endian order int modsize = BitConverter.ToInt32(modint, 0); int firstbyte = binr.PeekChar();

if (firstbyte == 0x00) { //if first byte (highest order) of modulus is zero, don't include itbinr.ReadByte(); //skip this null bytemodsize -= 1; //reduce modulus buffer size by 1 } byte[] modulus = binr.ReadBytes(modsize); //read the modulus bytes if (binr.ReadByte() != 0x02)

//expect an Integer for the exponent datareturn null;

int expbytes = (int)binr.ReadByte();

// should only need one byte for actual exponent data (for all useful values) byte[] exponent = binr.ReadBytes(expbytes); // ------- create RSACryptoServiceProvider instance and initialize with public key ----- var rsa = RSA.Create(); RSAParameters rsaKeyInfo = new RSAParameters {Modulus = modulus,Exponent = exponent }; rsa.ImportParameters(rsaKeyInfo);

return rsa;} } } #endregion #region 导入密钥算法 private int GetIntegerSize(BinaryReader binr) {

byte bt = 0; int count = 0; bt = binr.ReadByte();

if (bt != 0x02)

return 0; bt = binr.ReadByte();

if (bt == 0x81)count = binr.ReadByte();

else if (bt == 0x82) {

var highbyte = binr.ReadByte();

var lowbyte = binr.ReadByte();

byte[] modint = { lowbyte, highbyte, 0x00, 0x00 };count = BitConverter.ToInt32(modint, 0); }

else {count = bt; }

while (binr.ReadByte() == 0x00) {count -= 1; } binr.BaseStream.Seek(-1, SeekOrigin.Current);

return count; }

private bool CompareBytearrays(byte[] a, byte[] b) {

if (a.Length != b.Length)

return false;

int i = 0;

foreach (byte c in a) {

if (c != b[i])

return false;i++; } return true; } #endregion}

/// <summary>

/// RSA算法类型

/// </summary>

public enum RSAType {

/// <summary> /// SHA1 /// </summary> RSA = 0, /// <summary> /// RSA2 密钥长度至少为2048 /// SHA256 /// </summary> RSA2 }

使用：

static void Main(string[] args){ //2048 公钥string publicKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoQh0wEqx/R2H1v00IU12Oc30fosRC/frhH89L6G+fzeaqI19MYQhEPMU13wpeqRONCUta+2iC1sgCNQ9qGGf19yGdZUfueaB1Nu9rdueQKXgVurGHJ+5N71UFm+OP1XcnFUCK4wT5d7ZIifXxuqLehP9Ts6sNjhVfa+yU+VjF5HoIe69OJEPo7OxRZcRTe17khc93Ic+PfyqswQJJlY/bgpcLJQnM+QuHmxNtF7/FpAx9YEQsShsGpVo7JaKgLo+s6AFoJ4QldQKir2vbN9vcKRbG3piElPilWDpjXQkOJZhUloh/jd7QrKFimZFldJ1r6Q59QYUyGKZARUe0KZpMQIDAQAB"; //2048 私钥string privateKey = "MIIEpAIBAAKCAQEAoQh0wEqx/R2H1v00IU12Oc30fosRC/frhH89L6G+fzeaqI19MYQhEPMU13wpeqRONCUta+2iC1sgCNQ9qGGf19yGdZUfueaB1Nu9rdueQKXgVurGHJ+5N71UFm+OP1XcnFUCK4wT5d7ZIifXxuqLehP9Ts6sNjhVfa+yU+VjF5HoIe69OJEPo7OxRZcRTe17khc93Ic+PfyqswQJJlY/bgpcLJQnM+QuHmxNtF7/FpAx9YEQsShsGpVo7JaKgLo+s6AFoJ4QldQKir2vbN9vcKRbG3piElPilWDpjXQkOJZhUloh/jd7QrKFimZFldJ1r6Q59QYUyGKZARUe0KZpMQIDAQABAoIBAQCRZLUlOUvjIVqYvhznRK1OG6p45s8JY1r+UnPIId2Bt46oSLeUkZvZVeCnfq9k0Bzb8AVGwVPhtPEDh73z3dEYcT/lwjLXAkyPB6gG5ZfI/vvC/k7JYV01+neFmktw2/FIJWjEMMF2dvLNZ/Pm4bX1Dz9SfD/45Hwr8wqrvRzvFZsj5qqOxv9RPAudOYwCwZskKp/GF+L+3Ycod1Wu98imzMZUH+L5dQuDGg3kvf3ljIAegTPoqYBg0imNPYY/EGoFKnbxlK5S5/5uAFb16dGJqAz3XQCz9Is/IWrOTu0etteqV2Ncs8uqPdjed+b0j8CMsr4U1xjwPQ8WwdaJtTkRAoGBANAndgiGZkCVcc9975/AYdgFp35W6D+hGQAZlL6DmnucUFdXbWa/x2rTSEXlkvgk9X/PxOptUYsLJkzysTgfDywZwuIXLm9B3oNmv3bVgPXsgDsvDfaHYCgz0nHK6NSrX2AeX3yO/dFuoZsuk+J+UyRigMqYj0wjmxUlqj183hinAoGBAMYMOBgF77OXRII7GAuEut/nBeh2sBrgyzR7FmJMs5kvRh6Ck8wp3ysgMvX4lxh1ep8iCw1R2cguqNATr1klOdsCTOE9RrhuvOp3JrYzuIAK6MpH/uBICy4w1rW2+gQySsHcH40r+tNaTFQ7dQ1tef//iy/IW8v8i0t+csztE1JnAoGABdtWYt8FOYP688+jUmdjWWSvVcq0NjYeMfaGTOX/DsNTL2HyXhW/Uq4nNnBDNmAz2CjMbZwt0y+5ICkj+2REVQVUinAEinTcAe5+LKXNPx4sbX3hcrJUbk0m+rSu4G0B/f5cyXBsi9wFCAzDdHgBduCepxSr04Sc9Hde1uQQi7kCgYB0U20HP0Vh+TG2RLuE2HtjVDD2L/CUeQEiXEHzjxXWnhvTg+MIAnggvpLwQwmMxkQ2ACr5sd/3YuCpB0bxV5o594nsqq9FWVYBaecFEjAGlWHSnqMoXWijwu/6X/VOTbP3VjH6G6ECT4GR4DKKpokIQrMgZ9DzaezvdOA9WesFdQKBgQCWfeOQTitRJ0NZACFUn3Fs3Rvgc9eN9YSWj4RtqkmGPMPvguWo+SKhlk3IbYjrRBc5WVOdoX8JXb2/+nAGhPCuUZckWVmZe5pMSr4EkNQdYeY8kOXGSjoTOUH34ZdKeS+e399BkBWIiXUejX/Srln0H4KoHnTWgxwNpTsBCgXu8Q=="; var rsa = new RSAHelper(RSAType.RSA2,Encoding.UTF8, privateKey, publicKey); string str = "博客园 /";Console.WriteLine("原始字符串："+str); //加密string enStr = rsa.Encrypt(str);Console.WriteLine("加密字符串："+enStr); //解密string deStr = rsa.Decrypt(enStr);Console.WriteLine("解密字符串："+deStr); //私钥签名string signStr = rsa.Sign(str);Console.WriteLine("字符串签名：" + signStr); //公钥验证签名bool signVerify = rsa.Verify(str,signStr);Console.WriteLine("验证签名：" + signVerify);Console.ReadKey();}

运行：