RSA signing with imported private key

Question

I bought an SSL certificate b/c arvixe does not support self-signed ones. I have a private key in a .pem file which I'd like to use to RSA sign bank transaction parameters. So far, I have not found a way it can be done.

certificate.PrivateKey throws a Keyset not found exception. Using bouncy castle to import the private key (.pem) file works fine, right up to the point where I need to convert to RSACryptoServiceProvider. At that point, DotNetUtilities.ToRSA throws a File Not Found exception. There must be a better way to do this!!!

Here is the relevant snippet from my code:

            public string SignRsa(string stringToSign)
        {
            var encoder = new ASCIIEncoding();
            var binData = encoder.GetBytes(stringToSign);
            byte[] binSignature;

            if (Request.Url.OriginalString.IndexOf("localhost", StringComparison.Ordinal) < 0)
            {
                var store = new X509Store(StoreLocation.LocalMachine);
                store.Open(OpenFlags.ReadOnly);
                var certificates = store.Certificates;
                var signed = string.Empty;
                X509Certificate2 ipCert = certificates.Find(X509FindType.FindBySubjectName, "www.ingyenpiac.com", false).OfType<X509Certificate2>().First();
                RSACryptoServiceProvider rsaCsp;
                if (ipCert != null)
                {
                    AsymmetricCipherKeyPair keyPair;
                    using (var reader = System.IO.File.OpenText(Server.MapPath("~/App_Data/private_key.pem"))) // file containing RSA PKCS1 private key
                        keyPair = (AsymmetricCipherKeyPair)new PemReader(reader).ReadObject();
                    PrivateKeyInfo privateKeyInfo = PrivateKeyInfoFactory.CreatePrivateKeyInfo(keyPair.Private);
                    byte[] serializedPrivateBytes = privateKeyInfo.ToAsn1Object().GetDerEncoded();
                    string serializedPrivate = Convert.ToBase64String(serializedPrivateBytes);
                    SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(keyPair.Public);
                    byte[] serializedPublicBytes = publicKeyInfo.ToAsn1Object().GetDerEncoded();
                    string serializedPublic = Convert.ToBase64String(serializedPublicBytes);
                    RsaPrivateCrtKeyParameters privateKey = (RsaPrivateCrtKeyParameters)PrivateKeyFactory.CreateKey(Convert.FromBase64String(serializedPrivate));
                    RsaKeyParameters publicKey = (RsaKeyParameters)PublicKeyFactory.CreateKey(Convert.FromBase64String(serializedPublic));
                    var kpp = keyPair.Private as RsaPrivateCrtKeyParameters;
                    var ppk = DotNetUtilities.ToRSA(kpp); //   <==== File not found exception!!!! WTF???
                    RSACryptoServiceProvider tempRcsp = (RSACryptoServiceProvider)ppk;
                    RSACryptoServiceProvider rcsp = new RSACryptoServiceProvider(new CspParameters(1, "Microsoft Strong Cryptographic Provider", new Guid().ToString(), new CryptoKeySecurity(), null));
                    rcsp.ImportCspBlob(tempRcsp.ExportCspBlob(true));
                    ipCert.PrivateKey = rcsp;
                    if (ipCert.Verify())
                    {
                        rsaCsp = (RSACryptoServiceProvider)ipCert.PrivateKey;
                    }
                    else
                        throw new ApplicationException("Certificate failed to verify.");
                }
                else
                    throw new ApplicationException("SignRsa: No certifciate found");
                using (var sha = new SHA1CryptoServiceProvider())
                {
                    binSignature = rsaCsp.SignData(binData, sha);
                }
                if (rsaCsp.VerifyData(binData, new SHA1CryptoServiceProvider(), binSignature))
                    signed = BitConverter.ToString(binSignature).Replace("-", string.Empty);
                store.Close();
                return signed;
            }
return null;
}

I sure hope someone can help me with this!

Answer 1

With .NET 4.6 this code can get simplified a bit:

public string SignRsa(string stringToSign)
{
    var signed = string.Empty;

    using (var ipCert = new X509Certificate2(Server.MapPath("~/App_Data/pfxFile.pfx"), "password"))
    using (var RSA = ipCert.GetRSAPrivateKey())
    {
        // Note, if the cert was not RSA, or had no private key, RSA
        // will be null.  But you didn't check it, so I won't.
        var binData = System.Text.Encoding.ASCII.GetBytes(stringToSign);
        byte[] binSignature = RSA.SignData(binData, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);

        // Not sure why you want to re-verify the signature, but OK:
        if (RSA.VerifyData(binData, binSignature, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1))
            signed = BitConverter.ToString(binSignature).Replace("-", string.Empty);

        return signed;
    }
}