我应该使用MessageDigest来验证在C#中签名的数字签名吗？

huangapple
go评论113阅读模式
英文:

Should I use MessageDigest to verify a digital signature that signed in C#?

问题

以下是翻译好的内容：

C#：

  1. static string SignData(string message, RSAParameters privateKey)
  2. {
  3.     byte[] signedBytes;
  4.     using (var rsa = new RSACryptoServiceProvider())
  5.     {
  6.         var encoder = new UTF8Encoding();
  7.         byte[] originalData = encoder.GetBytes(message);
  8.         rsa.ImportParameters(privateKey);
  9.         signedBytes = rsa.SignData(originalData, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);
  10.         rsa.PersistKeyInCsp = false;
  11.     }
  12.     return Convert.ToBase64String(signedBytes);
  13. }

Java：

  1. static boolean verifySignature512(String message, String sign, PublicKey publicKey) throws Exception {
  2.     // MessageDigest digest = MessageDigest.getInstance("SHA-512");
  3.     // byte[] contentDigest = digest.digest(message.getBytes(Charset.forName("UTF-8")));
  5.     Signature signature = Signature.getInstance("SHA512withRSA");
  6.     signature.initVerify(publicKey);
  7.     signature.update(message.getBytes(Charset.forName("UTF-8")));
  8.     return signature.verify(Base64.getDecoder().decode(sign));
  9. }

请注意，上述内容中的代码片段已经根据你的要求进行了翻译。如果你有任何关于代码部分的问题或需要进一步的帮助，请随时提问。

英文:

I'm new in Java and want to sign some data in c# and verify in Java with RSA and SHA512.

C#:

  1. static string SignData(string message, RSAParameters privateKey)
  2.     {
  3.         byte[] signedBytes;
  4.         using (var rsa = new RSACryptoServiceProvider())
  5.         {
  6.             var encoder = new UTF8Encoding();
  7.             byte[] originalData = encoder.GetBytes(message);
  8.                 rsa.ImportParameters(privateKey);
  9.                
  10.                 signedBytes = rsa.SignData(originalData, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);
  12.                 rsa.PersistKeyInCsp = false;
  13.         }
  14.         return Convert.ToBase64String(signedBytes);
  15.     }

Java:

  1.  static boolean verifySignature512(String message, String sign, PublicKey publicKey) throws Exception {
  2.     MessageDigest digest = MessageDigest.getInstance("SHA-512");
  3.     byte[] contentDigest = digest.digest(message.getBytes(Charset.forName("UTF-8")));
  5.     Signature signature = Signature.getInstance("Sha512withRSA");
  6.     signature.initVerify(publicKey);
  7.     signature.update(contentDigest);
  8.     return signature.verify(Base64.getDecoder().decode(sign));
  9. }

I used RSA and public and private keys. Java function always return false with no error or exception.
If I remove MessageDigest like below it starts working, Is it ok and secure?

  1. static boolean verifySignature512(String message, String sign, PublicKey publicKey) throws Exception {
  2.    // MessageDigest digest = MessageDigest.getInstance("SHA-512");
  3.    // byte[] contentDigest = digest.digest(message.getBytes(Charset.forName("UTF-8")));
  5.     Signature signature = Signature.getInstance("Sha512withRSA");
  6.     signature.initVerify(publicKey);
  7.     signature.update(message.getBytes(Charset.forName("UTF-8")));
  8.     return signature.verify(Base64.getDecoder().decode(sign));
  9. }

答案1

得分: 1

以下是翻译好的内容：

C#-code:

  1. using System;
  2. using System.Security.Cryptography;
  3. using System.Text;
  5. class RSACSPSample {
  6.     static void Main() {
  8.         try {
  9.             Console.WriteLine("Should I use MessageDigest to verify a digital signature that signed in C#?");
  10.             // 创建UnicodeEncoder以在字节数组和字符串之间进行转换。
  11.             ASCIIEncoding ByteConverter = new ASCIIEncoding();
  13.             string message = "this is the important message to sign";
  15.             // 获取私钥和公钥 ### 示例和不安全的512位RSA密钥对
  16.             var privateKey = "<RSAKeyValue><Modulus>mfgthqgvK5P6kP00ojzA68+tGMwjEacduojFSukazKPXrZ8Q5XjzfqgJmDQ3wcWe3hWK92O3z/tmAuN47KA0ZQ==</Modulus><Exponent>AQAB</Exponent><P>8VCRao0hZmIv5gVGFLqOD/7n6TQKlekA96U1QVzimKM=</P><Q>o1bchWA5ddDd59FED37QcrakoTXNoxRspFtsLDKEp1c=</Q><DP>ugF0VUE7wYNlkFP4VPoHjuTZNbRbhHn5uOmrRxqlvyk=</DP><DQ>XoGggC9Hr8pUyo9DIPAP7X+Ny5TU0Vm87m/TK9Ni+2s=</DQ><InverseQ>YqOHEP8dgCvz5Q8nhpQgdrKfdlmjkNAFxKF7j3pm09I=</InverseQ><D>mCpGy/rxS08e5iXn26LRQvvm5UfyLKMNZWmAGk2QF8cRGFB7dds/SI9wGTC9xyOoF4N2kWzYdLx+dYbR9lqwbQ==</D></RSAKeyValue>";
  17.             var publicKey = "<RSAKeyValue><Modulus>mfgthqgvK5P6kP00ojzA68+tGMwjEacduojFSukazKPXrZ8Q5XjzfqgJmDQ3wcWe3hWK92O3z/tmAuN47KA0ZQ==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>";
  18.             
  19.             // 创建RSACryptoServiceProvider类的新实例
  20.             RSACryptoServiceProvider RSAalg = new RSACryptoServiceProvider(512);
  21.             RSAalg.PersistKeyInCsp = false;
  22.             RSAalg.FromXmlString(privateKey);
  23.             RSAParameters rsaParameters = RSAalg.ExportParameters(true);
  25.             String signedData = SignData(message, rsaParameters);
  26.             Console.WriteLine("signedData: " + signedData);
  28.             // 使用xml公钥进行验证
  29.             RSAalg.FromXmlString(publicKey);
  30.             rsaParameters = RSAalg.ExportParameters(false);
  31.             bool verifiedData = VerifyData(message, signedData, rsaParameters);
  32.             
  33.             // 验证数据并将结果显示在控制台上。
  34.             if (VerifyData(message, signedData, rsaParameters)) {
  35.                 Console.WriteLine("The data was verified.");
  36.             }
  37.             else {
  38.                 Console.WriteLine("The data does not match the signature.");
  39.             }
  40.         }
  41.         catch(ArgumentNullException) {
  42.             Console.WriteLine("The data was not signed or verified");
  43.         }
  44.     }
  45.     
  46.     static string SignData(string message, RSAParameters privateKey)
  47.     {
  48.         byte[] signedBytes;
  49.         using (var rsa = new RSACryptoServiceProvider())
  50.         {
  51.             var encoder = new UTF8Encoding();
  52.             byte[] originalData = encoder.GetBytes(message);
  53.             rsa.ImportParameters(privateKey);
  54.             signedBytes = rsa.SignData(originalData, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);
  55.             rsa.PersistKeyInCsp = false;
  56.         }
  57.         return Convert.ToBase64String(signedBytes);
  58.     }
  59.     
  60.     public static bool VerifyData(string message, string signedData, RSAParameters rsaParameters) 
  61.     {
  62.         byte[] messageBytes;
  63.         byte[] signedBytes;
  64.         using (var rsa = new RSACryptoServiceProvider())
  65.         try
  66.         {
  67.             var encoder = new UTF8Encoding();
  68.             messageBytes = encoder.GetBytes(message);
  69.             signedBytes = Convert.FromBase64String(signedData);
  70.             rsa.ImportParameters(rsaParameters);
  71.             return rsa.VerifyData(messageBytes, new SHA1CryptoServiceProvider(), signedBytes);
  72.         }
  73.         catch(CryptographicException e) {
  74.             Console.WriteLine(e.Message);
  76.             return false;
  77.         }
  78.     }
  79. }

Java-code:

  1. import java.nio.charset.StandardCharsets;
  2. import java.security.*;
  3. import java.security.spec.X509EncodedKeySpec;
  4. import java.util.Base64;
  6. public class MainSha1 {
  7.     public static void main(String[] args) throws GeneralSecurityException {
  8.         System.out.println("Should I use MessageDigest to verify a digital signature that signed in C#?");
  9.         String message = "this is the important message to sign";
  10.         // 这是一个示例和不安全的RSA 512位密钥
  11.         String publicKeyPem = "-----BEGIN PUBLIC KEY-----\n" +
  12.                 "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJn4LYaoLyuT+pD9NKI8wOvPrRjMIxGn\n" +
  13.                 "HbqIxUrpGsyj162fEOV4836oCZg0N8HFnt4Vivdjt8/7ZgLjeOygNGUCAwEAAQ==\n" +
  14.                 "-----END PUBLIC KEY-----";
  15.         String signedData = "HS4qvrXpqu97me7yDt9lWXp+QLjKMO8FY4kiUiGhMhi6KmXQXCtmcUWSbg0i+LXv7u5ueRiQNeBnu6UCbPhZLg==";
  16.         String rsaInstanceString = "SHA1withRSA";
  17.         System.out.println("RSA instance: " + rsaInstanceString);
  18.         PublicKey publicKey = getPublicKeyFromString(publicKeyPem);
  19.         boolean verifyData = verifyRsa(publicKey, rsaInstanceString, message.getBytes(StandardCharsets.UTF_8), Base64.getDecoder().decode(signedData));
  20.         if (verifyData == true) {
  21.             System.out.println("The data was verified.");
  22.         } else {
  23.             System.out.println("The data could NOT get verified.");
  24.         }
  26.     }
  28.     public static PublicKey getPublicKeyFromString(String key) throws GeneralSecurityException {
  29.         String publicKeyPEM = key;
  30.         publicKeyPEM = publicKeyPEM.replace("-----BEGIN PUBLIC KEY-----", "");
  31.         publicKeyPEM = publicKeyPEM.replace("-----END PUBLIC KEY-----", "");
  32.         publicKeyPEM = publicKeyPEM.replaceAll("[\\r\\n]+", "");
  33.         byte[] encoded = Base64.get
  35. <details>
  36. <summary>英文:</summary>
  38. The signature verification on Java-side has to fail as you are using different hashing algorithms on both sides.
  39. In C# you are using SHA1 (&#39;HashAlgorithmName.SHA1&#39;) and the Java-part is using SHA512 (&#39;Signature signature = Signature.getInstance(&quot;Sha512withRSA&quot;);&#39;).
  41. The following code is using SHA1 as hash algorithm but you can easily change this (on all codelines :-) to SHA256 or SHA512.
  42. The C#-code verifies the signature with the public key, the same public key (encoded as PEM) is used in the Java-code
  43. for verification only.
  45. **Security warning: My example codes are using UNSECURE 512-bit RSA-keys that should not used in production.
  46. There is not proper exception handling and you are using the padding &#39;RSASignaturePadding.Pkcs1&#39; which should
  47. NOT used anymore as well.**
  49. This is the output of my C#-code:
  51.     Should I use MessageDigest to verify a digital signature that signed in C#?
  52.     signedData: mU2bcCMEhG13xG9sKwhaA//dnw2+rbLkwz2737cNU5kb2EBenJIEJ+bA596XccCVKUKPanxMUFoVw2fl8HhCNw==
  53.     The data was verified.
  55. That&#39;s the Java-output:
  57.     RSA instance: SHA1withRSA
  58.     The data was verified.
  60. C#-code:
  62.     using System;
  63.     using System.Security.Cryptography;
  64.     using System.Text;
  65.     
  66.     class RSACSPSample {
  67.     	static void Main() {
  68.     
  69.     		try {
  70.     			Console.WriteLine(&quot;Should I use MessageDigest to verify a digital signature that signed in C#?&quot;);
  71.     			// Create a UnicodeEncoder to convert between byte array and string.
  72.     			ASCIIEncoding ByteConverter = new ASCIIEncoding();
  73.     
  74.     			string message = &quot;this is the important message to sign&quot;;
  75.     
  76.     			// get private and public key ### SAMPLE and UNSECURE 512 bit RSA keypair
  77.     			var privateKey = &quot;&lt;RSAKeyValue&gt;&lt;Modulus&gt;mfgthqgvK5P6kP00ojzA68+tGMwjEacduojFSukazKPXrZ8Q5XjzfqgJmDQ3wcWe3hWK92O3z/tmAuN47KA0ZQ==&lt;/Modulus&gt;&lt;Exponent&gt;AQAB&lt;/Exponent&gt;&lt;P&gt;8VCRao0hZmIv5gVGFLqOD/7n6TQKlekA96U1QVzimKM=&lt;/P&gt;&lt;Q&gt;o1bchWA5ddDd59FED37QcrakoTXNoxRspFtsLDKEp1c=&lt;/Q&gt;&lt;DP&gt;ugF0VUE7wYNlkFP4VPoHjuTZNbRbhHn5uOmrRxqlvyk=&lt;/DP&gt;&lt;DQ&gt;XoGggC9Hr8pUyo9DIPAP7X+Ny5TU0Vm87m/TK9Ni+2s=&lt;/DQ&gt;&lt;InverseQ&gt;YqOHEP8dgCvz5Q8nhpQgdrKfdlmjkNAFxKF7j3pm09I=&lt;/InverseQ&gt;&lt;D&gt;mCpGy/rxS08e5iXn26LRQvvm5UfyLKMNZWmAGk2QF8cRGFB7dds/SI9wGTC9xyOoF4N2kWzYdLx+dYbR9lqwbQ==&lt;/D&gt;&lt;/RSAKeyValue&gt;&quot;;
  78.     			var publicKey = &quot;&lt;RSAKeyValue&gt;&lt;Modulus&gt;mfgthqgvK5P6kP00ojzA68+tGMwjEacduojFSukazKPXrZ8Q5XjzfqgJmDQ3wcWe3hWK92O3z/tmAuN47KA0ZQ==&lt;/Modulus&gt;&lt;Exponent&gt;AQAB&lt;/Exponent&gt;&lt;/RSAKeyValue&gt;&quot;;
  79.     			
  80.     			// Create a new instance of the RSACryptoServiceProvider class
  81.     			RSACryptoServiceProvider RSAalg = new RSACryptoServiceProvider(512);
  82.     			RSAalg.PersistKeyInCsp = false;
  83.     			RSAalg.FromXmlString(privateKey);
  84.     			RSAParameters rsaParameters = RSAalg.ExportParameters(true);
  85.     
  86.     			String signedData = SignData(message, rsaParameters);
  87.     			Console.WriteLine(&quot;signedData: &quot; + signedData);
  88.     
  89.     			// verify with xml-public key
  90.     			RSAalg.FromXmlString(publicKey);
  91.     			rsaParameters = RSAalg.ExportParameters(false);
  92.     			bool verifiedData = VerifyData(message, signedData, rsaParameters);
  93.     			
  94.     			// Verify the data and display the result to the
  95.     			// console.
  96.     			if (VerifyData(message, signedData, rsaParameters)) {
  97.     				Console.WriteLine(&quot;The data was verified.&quot;);
  98.     			}
  99.     			else {
  100.     				Console.WriteLine(&quot;The data does not match the signature.&quot;);
  101.     			}
  102.     		}
  103.     		catch(ArgumentNullException) {
  104.     			Console.WriteLine(&quot;The data was not signed or verified&quot;);
  105.     		}
  106.     	}
  107.     	
  108.     	static string SignData(string message, RSAParameters privateKey)
  109.         {
  110.             byte[] signedBytes;
  111.             using (var rsa = new RSACryptoServiceProvider())
  112.             {
  113.                 var encoder = new UTF8Encoding();
  114.                 byte[] originalData = encoder.GetBytes(message);
  115.                     rsa.ImportParameters(privateKey);
  116.                     signedBytes = rsa.SignData(originalData, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);
  117.                     rsa.PersistKeyInCsp = false;
  118.             }
  119.             return Convert.ToBase64String(signedBytes);
  120.         }
  121.     	
  122.     	public static bool VerifyData(string message, string signedData, RSAParameters rsaParameters) 
  123.     	{
  124.     		byte[] messageBytes;
  125.     		byte[] signedBytes;
  126.             using (var rsa = new RSACryptoServiceProvider())
  127.     		try
  128.             {
  129.                 var encoder = new UTF8Encoding();
  130.                 messageBytes = encoder.GetBytes(message);
  131.     			signedBytes = Convert.FromBase64String(signedData);
  132.                 rsa.ImportParameters(rsaParameters);
  133.     			return rsa.VerifyData(messageBytes, new SHA1CryptoServiceProvider(), signedBytes);
  134.             }
  135.     		catch(CryptographicException e) {
  136.     			Console.WriteLine(e.Message);
  137.     
  138.     			return false;
  139.     		}
  140.     	}
  141.     }
  144. Java-code:
  146.     import java.nio.charset.StandardCharsets;
  147.     import java.security.*;
  148.     import java.security.spec.X509EncodedKeySpec;
  149.     import java.util.Base64;
  150.     
  151.     public class MainSha1 {
  152.         public static void main(String[] args) throws GeneralSecurityException {
  153.             System.out.println(&quot;Should I use MessageDigest to verify a digital signature that signed in C#?&quot;);
  154.             String message = &quot;this is the important message to sign&quot;;
  155.             // this is a SAMPLE and UNSECURE RSA 512 bit key
  156.             String publicKeyPem = &quot;-----BEGIN PUBLIC KEY-----\n&quot; +
  157.                     &quot;MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJn4LYaoLyuT+pD9NKI8wOvPrRjMIxGn\n&quot; +
  158.                     &quot;HbqIxUrpGsyj162fEOV4836oCZg0N8HFnt4Vivdjt8/7ZgLjeOygNGUCAwEAAQ==\n&quot; +
  159.                     &quot;-----END PUBLIC KEY-----&quot;;
  160.             String signedData = &quot;HS4qvrXpqu97me7yDt9lWXp+QLjKMO8FY4kiUiGhMhi6KmXQXCtmcUWSbg0i+LXv7u5ueRiQNeBnu6UCbPhZLg==&quot;;
  161.             String rsaInstanceString = &quot;SHA1withRSA&quot;;
  162.             System.out.println(&quot;RSA instance: &quot; + rsaInstanceString);
  163.             PublicKey publicKey = getPublicKeyFromString(publicKeyPem);
  164.             boolean verifyData = verifyRsa(publicKey, rsaInstanceString, message.getBytes(StandardCharsets.UTF_8), Base64.getDecoder().decode(signedData));
  165.             if (verifyData = true) {
  166.                 System.out.println(&quot;The data was verified.&quot;);
  167.             } else {
  168.                 System.out.println(&quot;The data could NOT get verified.&quot;);
  169.             }
  170.     
  171.         }
  172.     
  173.         public static PublicKey getPublicKeyFromString(String key) throws GeneralSecurityException {
  174.             String publicKeyPEM = key;
  175.             publicKeyPEM = publicKeyPEM.replace(&quot;-----BEGIN PUBLIC KEY-----&quot;, &quot;&quot;);
  176.             publicKeyPEM = publicKeyPEM.replace(&quot;-----END PUBLIC KEY-----&quot;, &quot;&quot;);
  177.             publicKeyPEM = publicKeyPEM.replaceAll(&quot;[\\r\\n]+&quot;, &quot;&quot;);
  178.             byte[] encoded = Base64.getDecoder().decode(publicKeyPEM);
  179.             KeyFactory kf = KeyFactory.getInstance(&quot;RSA&quot;);
  180.             PublicKey pubKey = (PublicKey) kf.generatePublic(new X509EncodedKeySpec(encoded));
  181.             return pubKey;
  182.         }
  183.     
  184.         public static Boolean verifyRsa(PublicKey publicKey, String rsaInstanceString, byte[] messageByte,
  185.                                         byte[] signatureByte) throws SignatureException, NoSuchAlgorithmException, InvalidKeyException {
  186.             Signature publicSignature = Signature.getInstance(rsaInstanceString);
  187.             publicSignature.initVerify(publicKey);
  188.             publicSignature.update(messageByte);
  189.             return publicSignature.verify(signatureByte);
  190.         }
  191.     }
  195. </details>

huangapple
  • 本文由 发表于 2020年8月27日 20:25:15
  • 转载请务必保留本文链接：https://go.coder-hub.com/63615966.html
  • c#
  • digital-signature
  • java
  • rsa
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定