BouncyCastle AT_SIGNATUREのKeySpecを変更する

Question

BouncyCastleのC＃APIを使用してCA証明書と自己署名証明書を生成する素晴らしい例が見つかりました。

しかし、私はKEYSPEC = 2（CERT_KEY_PROV_INFO_PROP_ID用AT_SIGNATURE）及びません。このコードは、現在提供して0のKeyspec必要があります：私はすべてのオンラインの例を見つけることができません

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Text; 
using System.Threading.Tasks; 


//Downloaded using nuget, source: http://www.bouncycastle.org/csharp/ 
//Library is open-source. 

namespace CertificateToolLibrary 
{ 
using System; 
using System.Security.Cryptography; 
using System.Security.Cryptography.X509Certificates; 
using Org.BouncyCastle.Asn1; 
using Org.BouncyCastle.Asn1.X9; 
using Org.BouncyCastle.Asn1.Pkcs; 
using Org.BouncyCastle.Asn1.X509; 
using Org.BouncyCastle.Crypto; 
using Org.BouncyCastle.Crypto.Generators; 
using Org.BouncyCastle.Crypto.Parameters; 
using Org.BouncyCastle.Crypto.Prng; 
using Org.BouncyCastle.Math; 
using Org.BouncyCastle.OpenSsl; 
using Org.BouncyCastle.Pkcs; 
using Org.BouncyCastle.Security; 
using Org.BouncyCastle.Utilities; 
using Org.BouncyCastle.X509.Extension; 
using Org.BouncyCastle.X509; 

public class X509Certificate2Builder 
{ 
    public string SubjectName 
    { set { _subjectName = value; } } 

    public string SubjectAlternativeName 
    { set { _subjectAlternativeName = value; } } 

    public string IssuerName 
    { set { _issuerName = value; } } 

    public AsymmetricAlgorithm IssuerPrivateKey 
    { set { _issuerPrivateKey = value; } } 

    public X509Certificate2 Issuer 
    { 
     set 
     { 
      _issuer = value; 
      _issuerName = value.IssuerName.Name; 
      if (value.HasPrivateKey) 
       _issuerPrivateKey = value.PrivateKey; 
     } 
    } 

    public int? KeyStrength 
    { set { _keyStrength = value ?? 2048; } } 

    public DateTime? NotBefore 
    { set { _notBefore = value; } } 

    public DateTime? NotAfter 
    { set { _notAfter = value; } } 

    public bool Intermediate 
    { set { _intermediate = value; } } 

    private string _subjectName; 
    private string _subjectAlternativeName; 
    private X509Certificate2 _issuer; 
    private string _issuerName; 
    private AsymmetricAlgorithm _issuerPrivateKey; 
    private int _keyStrength = 2048; 
    private DateTime? _notBefore; 
    private DateTime? _notAfter; 
    private bool _intermediate = true; 

    public X509Certificate2 Build() 
    { 
     // Generating Random Numbers 
     var randomGenerator = new CryptoApiRandomGenerator(); 
     var random = new SecureRandom(randomGenerator); 

     // The Certificate Generator 
     var certificateGenerator = new X509V3CertificateGenerator(); 

     // Serial Number 
     var serialNumber = BigIntegers.CreateRandomInRange(BigInteger.One, BigInteger.ValueOf(long.MaxValue), random); 
     certificateGenerator.SetSerialNumber(serialNumber); 

     // Signature Algorithm 
     certificateGenerator.SetSignatureAlgorithm("SHA512WithRSA"); 

     // Issuer and Subject Name 
     certificateGenerator.SetIssuerDN(new X509Name(_issuerName ?? _subjectName)); 
     certificateGenerator.SetSubjectDN(new X509Name(_subjectName)); 

     //Subject Alternative Name 
     if (!(String.IsNullOrEmpty(_subjectAlternativeName))) 
     { 
      //Here we signify ip address instead of DNS SAN. This could be condition upon further development. 
      GeneralNames subjectAltName = new GeneralNames(new GeneralName(GeneralName.IPAddress, _subjectAlternativeName)); 
      certificateGenerator.AddExtension(X509Extensions.SubjectAlternativeName, false, subjectAltName); 
     } 

     // Authority Key Identifier 
     if (_issuer != null) 
     { 
      var authorityKeyIdentifier = new AuthorityKeyIdentifierStructure(DotNetUtilities.FromX509Certificate(_issuer)); 
      certificateGenerator.AddExtension(X509Extensions.AuthorityKeyIdentifier.Id, false, authorityKeyIdentifier); 

      //var subjectKeyIdentifier = new SubjectKeyIdentifier(DotNetUtilities.FromX509Certificate(_issuer)); 
      //certificateGenerator.AddExtension(X509Extensions.SubjectKeyIdentifier.Id, false, subjectKeyIdentifier); 
      //certificateGenerator.addExtension(X509Extensions.SubjectKeyIdentifier.Id, false, new SubjectKeyIdentifierStructure(keyPair.getPublic())); 
     } 

     // Basic Constraints - certificate is allowed to be used as intermediate. 
     certificateGenerator.AddExtension(X509Extensions.BasicConstraints, false, new BasicConstraints(_intermediate)); 


     // Valid For 
     certificateGenerator.SetNotBefore(_notBefore ?? DateTime.UtcNow.Date.AddDays(-1)); 
     certificateGenerator.SetNotAfter(_notAfter ?? DateTime.UtcNow.Date.AddYears(3)); 


     //Key Usage(s) don't set for CA cert, just the SSL cert. 
     if (_subjectName != "CN=Bla Certificate Authority") 
     { 
      certificateGenerator.AddExtension(X509Extensions.KeyUsage, true, new KeyUsage(KeyUsage.DigitalSignature | KeyUsage.KeyEncipherment)); 
      var usages = new[] { KeyPurposeID.IdKPServerAuth, KeyPurposeID.IdKPClientAuth}; 
      certificateGenerator.AddExtension(X509Extensions.ExtendedKeyUsage.Id, false, new ExtendedKeyUsage(usages)); 
     } 


     // Subject Public Key 
     var keyGenerationParameters = new KeyGenerationParameters(random, _keyStrength); 
     var keyPairGenerator = new RsaKeyPairGenerator(); 
     keyPairGenerator.Init(keyGenerationParameters); 

     var subjectKeyPair = keyPairGenerator.GenerateKeyPair(); 
     var issuerKeyPair = _issuerPrivateKey == null 
      ? subjectKeyPair 
      : DotNetUtilities.GetKeyPair(_issuerPrivateKey); 

     certificateGenerator.SetPublicKey(subjectKeyPair.Public); 

     //Add the subject key identifier for the SSL Certficate 
     if (_subjectName != "CN=Bla Certificate Authority") 
     { 
      certificateGenerator.AddExtension(X509Extensions.SubjectKeyIdentifier, false, new SubjectKeyIdentifierStructure(subjectKeyPair.Public)); 
     } 

     // selfsign certificate 
     var certificate = certificateGenerator.Generate(issuerKeyPair.Private, random); 

     // merge into X509Certificate2 
     return new X509Certificate2(certificate.GetEncoded()) 
     { 
      PrivateKey = ConvertToRsaPrivateKey(subjectKeyPair) 
     }; 
    } 

    private static AsymmetricAlgorithm ConvertToRsaPrivateKey(AsymmetricCipherKeyPair keyPair) 
    { 
     var keyInfo = PrivateKeyInfoFactory.CreatePrivateKeyInfo(keyPair.Private); 
     var seq = (Asn1Sequence)Asn1Object.FromByteArray(keyInfo.PrivateKey.GetDerEncoded()); 
     if (seq.Count != 9) 
      throw new PemException("malformed sequence in RSA private key"); 

     var rsa = new RsaPrivateKeyStructure(seq); 
     var rsaparams = new RsaPrivateCrtKeyParameters(rsa.Modulus, rsa.PublicExponent, rsa.PrivateExponent, rsa.Prime1, rsa.Prime2, rsa.Exponent1, rsa.Exponent2, rsa.Coefficient); 

     return DotNetUtilities.ToRSA(rsaparams); 



    } 
} 

}

をキースペックをデジタル署名に変更する方法について説明します。私はそれが秘密鍵の側で起こるはずであることを認識していますが、バーンシーキャスルコードを特にC＃の例で使用する場合、そこには例がありません。

私はネイティブのC＃コードでcspparamsのようなrsaparamsを使用することができますが、私はそれで何も見つけることができません。

ご協力いただければ幸いです。

Answer 1

私はあなたがKeyUsage.keyEncipherment

Answer 2

、私はデスクトップの開発にあったことが判明し、このkeyspecは、しかし0に設定されたを使用したいと思いますKeyUsage定数クラスに

をチェック私は2012年のサーバー上で私のツールを実行し、keyspecは1に設定されました。私はすべて設定されています。

Answer 3

public static AsymmetricAlgorithm ToDotNetKey(RsaPrivateCrtKeyParameters privateKey) 
    { 
     var cspParams = new CspParameters 
     { 
      ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider", 
      ProviderType = 24, 
      KeyContainerName = KEY_CONTAINER_NAME, 
      KeyNumber = (int)KeyNumber.Signature, 
      Flags = CspProviderFlags.UseMachineKeyStore 
     }; 

     RSACryptoServiceProvider rsaProvider = new RSACryptoServiceProvider(cspParams); 

     RSAParameters parameters = new RSAParameters 
     { 
      Modulus = privateKey.Modulus.ToByteArrayUnsigned(), 
      P = privateKey.P.ToByteArrayUnsigned(), 
      Q = privateKey.Q.ToByteArrayUnsigned(), 
      DP = privateKey.DP.ToByteArrayUnsigned(), 
      DQ = privateKey.DQ.ToByteArrayUnsigned(), 
      InverseQ = privateKey.QInv.ToByteArrayUnsigned(), 
      D = privateKey.Exponent.ToByteArrayUnsigned(), 
      Exponent = privateKey.PublicExponent.ToByteArrayUnsigned() 
     }; 

     rsaProvider.ImportParameters(parameters); 

     return rsaProvider; 
    } 

ここで別の回答を追加するには、このスニペットを使用してkeyspec = 2 AT_SIGNATUREを強制することができました。しかし、現在、署名の問題が発生しています。潜在的にそれらを正しい方向に導くために他の人のためにそこに投げ捨てたかっただけです。