mcs/class/corlib/System.Security.Cryptography/RSACryptoServiceProvider.cs

   1 //
   2 // RSACryptoServiceProvider.cs: Handles an RSA implementation.
   3 //
   4 // Authors:
   5 //      Sebastien Pouliot <sebastien@ximian.com>
   6 //      Ben Maurer (bmaurer@users.sf.net)
   7 //
   8 // (C) 2002, 2003 Motus Technologies Inc. (http://www.motus.com)
   9 // Portions (C) 2003 Ben Maurer
  10 // Copyright (C) 2004-2005 Novell, Inc (http://www.novell.com)
  11 //
  12 // Permission is hereby granted, free of charge, to any person obtaining
  13 // a copy of this software and associated documentation files (the
  14 // "Software"), to deal in the Software without restriction, including
  15 // without limitation the rights to use, copy, modify, merge, publish,
  16 // distribute, sublicense, and/or sell copies of the Software, and to
  17 // permit persons to whom the Software is furnished to do so, subject to
  18 // the following conditions:
  19 //
  20 // The above copyright notice and this permission notice shall be
  21 // included in all copies or substantial portions of the Software.
  22 //
  23 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  27 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  28 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  29 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  30 //
  31
  32 using System.IO;
  33 using System.Runtime.InteropServices;
  34
  35 using Mono.Security.Cryptography;
  36
  37 namespace System.Security.Cryptography {
  38
  39         [ComVisible (true)]
  40         public sealed class RSACryptoServiceProvider : RSA, ICspAsymmetricAlgorithm {
  41                 private const int PROV_RSA_FULL = 1;    // from WinCrypt.h
  42                 private const int AT_KEYEXCHANGE = 1;
  43                 private const int AT_SIGNATURE = 2;
  44
  45                 private KeyPairPersistence store;
  46                 private bool persistKey;
  47                 private bool persisted;
  48
  49                 private bool privateKeyExportable = true;
  50                 private bool m_disposed;
  51
  52                 private RSAManaged rsa;
  53
  54                 public RSACryptoServiceProvider ()
  55                         : this (1024)
  56                 {
  57                         // Here it's not clear if we need to generate a keypair
  58                         // (note: MS implementation generates a keypair in this case).
  59                         // However we:
  60                         // (a) often use this constructor to import an existing keypair.
  61                         // (b) take a LOT of time to generate the RSA keypair
  62                         // So we'll generate the keypair only when (and if) it's being
  63                         // used (or exported). This should save us a lot of time (at
  64                         // least in the unit tests).
  65                 }
  66
  67                 public RSACryptoServiceProvider (CspParameters parameters)
  68                         : this (1024, parameters)
  69                 {
  70                         // no keypair generation done at this stage
  71                 }
  72
  73                 public RSACryptoServiceProvider (int dwKeySize)
  74                 {
  75                         // Here it's clear that we need to generate a new keypair
  76                         Common (dwKeySize, false);
  77                         // no keypair generation done at this stage
  78                 }
  79
  80                 public RSACryptoServiceProvider (int dwKeySize, CspParameters parameters)
  81                 {
  82                         bool has_parameters = parameters != null;
  83                         Common (dwKeySize, has_parameters);
  84                         if (has_parameters)
  85                                 Common (parameters);
  86                         // no keypair generation done at this stage
  87                 }
  88
  89                 void Common (int dwKeySize, bool parameters)
  90                 {
  91                         // Microsoft RSA CSP can do between 384 and 16384 bits keypair
  92                         LegalKeySizesValue = new KeySizes [1];
  93                         LegalKeySizesValue [0] = new KeySizes (384, 16384, 8);
  94                         base.KeySize = dwKeySize;
  95
  96                         rsa = new RSAManaged (KeySize);
  97                         rsa.KeyGenerated += new RSAManaged.KeyGeneratedEventHandler (OnKeyGenerated);
  98
  99                         persistKey = parameters;
 100                         if (parameters)
 101                                 return;
 102
 103                         // no need to load - it cannot exists
 104                         var p = new CspParameters (PROV_RSA_FULL);
 105                         if (useMachineKeyStore)
 106                                 p.Flags |= CspProviderFlags.UseMachineKeyStore;
 107                         store = new KeyPairPersistence (p);
 108                 }
 109
 110                 void Common (CspParameters p)
 111                 {
 112                         store = new KeyPairPersistence (p);
 113                         bool exists = store.Load ();
 114                         bool required = (p.Flags & CspProviderFlags.UseExistingKey) != 0;
 115
 116                         if (required && !exists)
 117                                 throw new CryptographicException ("Keyset does not exist");
 118
 119                         if (store.KeyValue != null) {
 120                                 persisted = true;
 121                                 FromXmlString (store.KeyValue);
 122                         }
 123                 }
 124
 125                 private static bool useMachineKeyStore;
 126
 127                 public static bool UseMachineKeyStore {
 128                         get { return useMachineKeyStore; }
 129                         set { useMachineKeyStore = value; }
 130                 }
 131
 132                 ~RSACryptoServiceProvider ()
 133                 {
 134                         // Zeroize private key
 135                         Dispose (false);
 136                 }
 137
 138                 public override string KeyExchangeAlgorithm {
 139                         get { return "RSA-PKCS1-KeyEx"; }
 140                 }
 141
 142                 public override int KeySize {
 143                         get {
 144                                 if (rsa == null)
 145                                       return KeySizeValue;
 146                                 else
 147                                       return rsa.KeySize;
 148                         }
 149                 }
 150
 151                 public bool PersistKeyInCsp {
 152                         get { return persistKey; }
 153                         set {
 154                                 persistKey = value;
 155                                 if (persistKey)
 156                                         OnKeyGenerated (rsa, null);
 157                         }
 158                 }
 159
 160                 [ComVisible (false)]
 161                 public bool PublicOnly {
 162                         get { return rsa.PublicOnly; }
 163                 }
 164
 165                 public override string SignatureAlgorithm {
 166                         get { return "http://www.w3.org/2000/09/xmldsig#rsa-sha1"; }
 167                 }
 168
 169                 public byte[] Decrypt (byte[] rgb, bool fOAEP)
 170                 {
 171                         if (m_disposed)
 172                                 throw new ObjectDisposedException ("rsa");
 173                         // choose between OAEP or PKCS#1 v.1.5 padding
 174                         AsymmetricKeyExchangeDeformatter def = null;
 175                         if (fOAEP)
 176                                 def = new RSAOAEPKeyExchangeDeformatter (rsa);
 177                         else
 178                                 def = new RSAPKCS1KeyExchangeDeformatter (rsa);
 179
 180                         return def.DecryptKeyExchange (rgb);
 181                 }
 182
 183                 // NOTE: Unlike MS we need this method
 184                 // LAMESPEC: Not available from MS .NET framework but MS don't tell
 185                 // why! DON'T USE IT UNLESS YOU KNOW WHAT YOU ARE DOING!!! You should
 186                 // only encrypt/decrypt session (secret) key using asymmetric keys.
 187                 // Using this method to decrypt data IS dangerous (and very slow).
 188                 public override byte[] DecryptValue (byte[] rgb)
 189                 {
 190                         if (!rsa.IsCrtPossible)
 191                                 throw new CryptographicException ("Incomplete private key - missing CRT.");
 192
 193                         return rsa.DecryptValue (rgb);
 194                 }
 195
 196                 public byte[] Encrypt (byte[] rgb, bool fOAEP)
 197                 {
 198                         // choose between OAEP or PKCS#1 v.1.5 padding
 199                         AsymmetricKeyExchangeFormatter fmt = null;
 200                         if (fOAEP)
 201                                 fmt = new RSAOAEPKeyExchangeFormatter (rsa);
 202                         else
 203                                 fmt = new RSAPKCS1KeyExchangeFormatter (rsa);
 204
 205                         return fmt.CreateKeyExchange (rgb);
 206                 }
 207
 208                 // NOTE: Unlike MS we need this method
 209                 // LAMESPEC: Not available from MS .NET framework but MS don't tell
 210                 // why! DON'T USE IT UNLESS YOU KNOW WHAT YOU ARE DOING!!! You should
 211                 // only encrypt/decrypt session (secret) key using asymmetric keys.
 212                 // Using this method to encrypt data IS dangerous (and very slow).
 213                 public override byte[] EncryptValue (byte[] rgb)
 214                 {
 215                         return rsa.EncryptValue (rgb);
 216                 }
 217
 218                 public override RSAParameters ExportParameters (bool includePrivateParameters)
 219                 {
 220                         if ((includePrivateParameters) && (!privateKeyExportable))
 221                                 throw new CryptographicException ("cannot export private key");
 222
 223                         return rsa.ExportParameters (includePrivateParameters);
 224                 }
 225
 226                 public override void ImportParameters (RSAParameters parameters)
 227                 {
 228                         rsa.ImportParameters (parameters);
 229                 }
 230
 231                 private HashAlgorithm GetHash (object halg)
 232                 {
 233                         if (halg == null)
 234                                 throw new ArgumentNullException ("halg");
 235
 236                         HashAlgorithm hash = null;
 237                         if (halg is String)
 238                                 hash = GetHashFromString ((string) halg);
 239                         else if (halg is HashAlgorithm)
 240                                 hash = (HashAlgorithm) halg;
 241                         else if (halg is Type)
 242                                 hash = (HashAlgorithm) Activator.CreateInstance ((Type)halg);
 243                         else
 244                                 throw new ArgumentException ("halg");
 245
 246                         if (hash == null)
 247                                 throw new ArgumentException (
 248                                                 "Could not find provider for halg='" + halg + "'.",
 249                                                 "halg");
 250
 251                         return hash;
 252                 }
 253
 254                 private HashAlgorithm GetHashFromString (string name)
 255                 {
 256                         HashAlgorithm hash = HashAlgorithm.Create (name);
 257                         if (hash != null)
 258                                 return hash;
 259                         try {
 260                                 return HashAlgorithm.Create (GetHashNameFromOID (name));
 261                         } catch (CryptographicException e) {
 262                                 throw new ArgumentException (e.Message, "halg", e);
 263                         }
 264                 }
 265
 266                 // NOTE: this method can work with ANY configured (OID in machine.config)
 267                 // HashAlgorithm descendant
 268                 public byte[] SignData (byte[] buffer, object halg)
 269                 {
 270                         if (buffer == null)
 271                                 throw new ArgumentNullException ("buffer");
 272                         return SignData (buffer, 0, buffer.Length, halg);
 273                 }
 274
 275                 // NOTE: this method can work with ANY configured (OID in machine.config)
 276                 // HashAlgorithm descendant
 277                 public byte[] SignData (Stream inputStream, object halg)
 278                 {
 279                         HashAlgorithm hash = GetHash (halg);
 280                         byte[] toBeSigned = hash.ComputeHash (inputStream);
 281                         return PKCS1.Sign_v15 (this, hash, toBeSigned);
 282                 }
 283
 284                 // NOTE: this method can work with ANY configured (OID in machine.config)
 285                 // HashAlgorithm descendant
 286                 public byte[] SignData (byte[] buffer, int offset, int count, object halg)
 287                 {
 288                         HashAlgorithm hash = GetHash (halg);
 289                         byte[] toBeSigned = hash.ComputeHash (buffer, offset, count);
 290                         return PKCS1.Sign_v15 (this, hash, toBeSigned);
 291                 }
 292
 293                 private string GetHashNameFromOID (string oid)
 294                 {
 295                         switch (oid) {
 296                         case "1.3.14.3.2.26":
 297                                 return "SHA1";
 298                         case "1.2.840.113549.2.5":
 299                                 return "MD5";
 300                         case "2.16.840.1.101.3.4.2.1":
 301                                 return "SHA256";
 302                         case "2.16.840.1.101.3.4.2.2":
 303                                 return "SHA384";
 304                         case "2.16.840.1.101.3.4.2.3":
 305                                 return "SHA512";
 306                         default:
 307                                 throw new CryptographicException (oid + " is an unsupported hash algorithm for RSA signing");
 308                         }
 309                 }
 310
 311                 public byte[] SignHash (byte[] rgbHash, string str)
 312                 {
 313                         if (rgbHash == null)
 314                                 throw new ArgumentNullException ("rgbHash");
 315                         // Fx 2.0 defaults to the SHA-1
 316                         string hashName = (str == null) ? "SHA1" : GetHashNameFromOID (str);
 317                         HashAlgorithm hash = HashAlgorithm.Create (hashName);
 318                         return PKCS1.Sign_v15 (this, hash, rgbHash);
 319                 }
 320
 321                 // NOTE: this method can work with ANY configured (OID in machine.config)
 322                 // HashAlgorithm descendant
 323                 public bool VerifyData (byte[] buffer, object halg, byte[] signature)
 324                 {
 325                         if (buffer == null)
 326                                 throw new ArgumentNullException ("buffer");
 327                         if (signature == null)
 328                                 throw new ArgumentNullException ("signature");
 329
 330                         HashAlgorithm hash = GetHash (halg);
 331                         byte[] toBeVerified = hash.ComputeHash (buffer);
 332                         return PKCS1.Verify_v15 (this, hash, toBeVerified, signature);
 333                 }
 334
 335                 public bool VerifyHash (byte[] rgbHash, string str, byte[] rgbSignature)
 336                 {
 337                         if (rgbHash == null)
 338                                 throw new ArgumentNullException ("rgbHash");
 339                         if (rgbSignature == null)
 340                                 throw new ArgumentNullException ("rgbSignature");
 341                         // Fx 2.0 defaults to the SHA-1
 342                         string hashName = (str == null) ? "SHA1" : GetHashNameFromOID (str);
 343                         HashAlgorithm hash = HashAlgorithm.Create (hashName);
 344                         return PKCS1.Verify_v15 (this, hash, rgbHash, rgbSignature);
 345                 }
 346
 347                 protected override void Dispose (bool disposing)
 348                 {
 349                         if (!m_disposed) {
 350                                 // the key is persisted and we do not want it persisted
 351                                 if ((persisted) && (!persistKey)) {
 352                                         store.Remove ();        // delete the container
 353                                 }
 354                                 if (rsa != null)
 355                                         rsa.Clear ();
 356                                 // call base class
 357                                 // no need as they all are abstract before us
 358                                 m_disposed = true;
 359                         }
 360                 }
 361
 362                 // private stuff
 363
 364                 private void OnKeyGenerated (object sender, EventArgs e)
 365                 {
 366                         // the key isn't persisted and we want it persisted
 367                         if ((persistKey) && (!persisted)) {
 368                                 // save the current keypair
 369                                 store.KeyValue = this.ToXmlString (!rsa.PublicOnly);
 370                                 store.Save ();
 371                                 persisted = true;
 372                         }
 373                 }
 374                 // ICspAsymmetricAlgorithm
 375
 376                 [ComVisible (false)]
 377                 public CspKeyContainerInfo CspKeyContainerInfo {
 378                         get {
 379                                 return new CspKeyContainerInfo(store.Parameters);
 380                         }
 381                 }
 382
 383                 [ComVisible (false)]
 384                 public byte[] ExportCspBlob (bool includePrivateParameters)
 385                 {
 386                         byte[] blob = null;
 387                         if (includePrivateParameters)
 388                                 blob = CryptoConvert.ToCapiPrivateKeyBlob (this);
 389                         else
 390                                 blob = CryptoConvert.ToCapiPublicKeyBlob (this);
 391
 392                         // ALGID (bytes 4-7) - default is KEYX
 393                         // 00 24 00 00 (for CALG_RSA_SIGN)
 394                         // 00 A4 00 00 (for CALG_RSA_KEYX)
 395                         blob [5] = (byte) (((store != null) && (store.Parameters.KeyNumber == AT_SIGNATURE)) ? 0x24 : 0xA4);
 396                         return blob;
 397                 }
 398
 399                 [ComVisible (false)]
 400                 public void ImportCspBlob (byte[] keyBlob)
 401                 {
 402                         if (keyBlob == null)
 403                                 throw new ArgumentNullException ("keyBlob");
 404
 405                         RSA rsa = CryptoConvert.FromCapiKeyBlob (keyBlob);
 406                         if (rsa is RSACryptoServiceProvider) {
 407                                 // default (if no change are present in machine.config)
 408                                 RSAParameters rsap = rsa.ExportParameters (!(rsa as RSACryptoServiceProvider).PublicOnly);
 409                                 ImportParameters (rsap);
 410                         } else {
 411                                 // we can't know from RSA if the private key is available
 412                                 try {
 413                                         // so we try it...
 414                                         RSAParameters rsap = rsa.ExportParameters (true);
 415                                         ImportParameters (rsap);
 416                                 }
 417                                 catch {
 418                                         // and fall back
 419                                         RSAParameters rsap = rsa.ExportParameters (false);
 420                                         ImportParameters (rsap);
 421                                 }
 422                         }
 423
 424                         var p = new CspParameters (PROV_RSA_FULL);
 425                         p.KeyNumber = keyBlob [5] == 0x24 ? AT_SIGNATURE : AT_KEYEXCHANGE;
 426                         if (useMachineKeyStore)
 427                                 p.Flags |= CspProviderFlags.UseMachineKeyStore;
 428                         store = new KeyPairPersistence (p);
 429                 }
 430         }
 431 }