在 C# 中通过 JS 解密 RSA 公钥加密数据时出现问题

Question

我在 C# 中解密 RSA 加密字符串时收到错误The data to be decrypted exceeds the maximum for this modulus of 256 bytes。

我要实现的目标：

1. 在 C# 中生成公钥/私钥对 (RSA(
2. 将私钥保存在会话/临时存储中，以便在解密期间使用
3. 将公钥发送/返回给客户端/JS以用于加密
4. 使用公钥加密JS中的字符串(最多20个字符(并发送到服务器
5. 使用步骤 2 中保存的私钥解密服务器中的加密字符串

什么有效：

1. 生成公钥/私钥对
2. 使用 jsencrypt 库在 JS 中进行加密

到目前为止编写的代码：

C#

///Source: https://stackoverflow.com/questions/17128038/c-sharp-rsa-encryption-decryption-with-transmission
public static void GenerateKeys()
{
//CSP with a new 2048 bit rsa key pair
var csp = new RSACryptoServiceProvider(2048);
//Private key
var privKey = csp.ExportParameters(true);
//Public key
var pubKey = csp.ExportParameters(false);
string privKeyString = string.Empty;
var sw = new System.IO.StringWriter();
var xs = new System.Xml.Serialization.XmlSerializer(typeof(RSAParameters));
xs.Serialize(sw, privKey);
privKeyString = sw.ToString();
//This will give public key in the following format which is required by the JS library
//-----BEGIN PUBLIC KEY-----
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//-----END PUBLIC KEY-----
string publicKeyBase64 = ConvertPublicKeyForJS(pubKey);
//Will be saved in sesssion for later use during decryption
string privateKeyBase64 = Convert.ToBase64String(System.Text.Encoding.ASCII.GetBytes(privKeyString));
//Save in session/temp location
//Return publicKeyBase64 to JS
}
/// <summary>
/// Source: https://stackoverflow.com/questions/28406888/c-sharp-rsa-public-key-output-not-correct/28407693#28407693
/// </summary>
/// <param name="publicKey"></param>
/// <returns></returns>
public static string ConvertPublicKeyForJS(RSAParameters publicKey)
{
string output = string.Empty;
using (var stream = new MemoryStream())
{
var writer = new BinaryWriter(stream);
writer.Write((byte)0x30); // SEQUENCE
using (var innerStream = new MemoryStream())
{
var innerWriter = new BinaryWriter(innerStream);
innerWriter.Write((byte)0x30); // SEQUENCE
EncodeLength(innerWriter, 13);
innerWriter.Write((byte)0x06); // OBJECT IDENTIFIER
var rsaEncryptionOid = new byte[] { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 };
EncodeLength(innerWriter, rsaEncryptionOid.Length);
innerWriter.Write(rsaEncryptionOid);
innerWriter.Write((byte)0x05); // NULL
EncodeLength(innerWriter, 0);
innerWriter.Write((byte)0x03); // BIT STRING
using (var bitStringStream = new MemoryStream())
{
var bitStringWriter = new BinaryWriter(bitStringStream);
bitStringWriter.Write((byte)0x00); // # of unused bits
bitStringWriter.Write((byte)0x30); // SEQUENCE
using (var paramsStream = new MemoryStream())
{
var paramsWriter = new BinaryWriter(paramsStream);
EncodeIntegerBigEndian(paramsWriter, publicKey.Modulus); // Modulus
EncodeIntegerBigEndian(paramsWriter, publicKey.Exponent); // Exponent
var paramsLength = (int)paramsStream.Length;
EncodeLength(bitStringWriter, paramsLength);
bitStringWriter.Write(paramsStream.GetBuffer(), 0, paramsLength);
}
var bitStringLength = (int)bitStringStream.Length;
EncodeLength(innerWriter, bitStringLength);
innerWriter.Write(bitStringStream.GetBuffer(), 0, bitStringLength);
}
var length = (int)innerStream.Length;
EncodeLength(writer, length);
writer.Write(innerStream.GetBuffer(), 0, length);
}
var base64 = Convert.ToBase64String(stream.GetBuffer(), 0, (int)stream.Length);
StringBuilder sb = new StringBuilder();
sb.AppendLine("-----BEGIN PUBLIC KEY-----");
sb.AppendLine(base64);
sb.AppendLine("-----END PUBLIC KEY-----");
output = sb.ToString();
}
return output;
}
private static void EncodeLength(BinaryWriter stream, int length)
{
if (length < 0) throw new ArgumentOutOfRangeException("length", "Length must be non-negative");
if (length < 0x80)
{
// Short form
stream.Write((byte)length);
}
else
{
// Long form
var temp = length;
var bytesRequired = 0;
while (temp > 0)
{
temp >>= 8;
bytesRequired++;
}
stream.Write((byte)(bytesRequired | 0x80));
for (var i = bytesRequired - 1; i >= 0; i--)
{
stream.Write((byte)(length >> (8 * i) & 0xff));
}
}
}
private static void EncodeIntegerBigEndian(BinaryWriter stream, byte[] value, bool forceUnsigned = true)
{
stream.Write((byte)0x02); // INTEGER
var prefixZeros = 0;
for (var i = 0; i < value.Length; i++)
{
if (value[i] != 0) break;
prefixZeros++;
}
if (value.Length - prefixZeros == 0)
{
EncodeLength(stream, 1);
stream.Write((byte)0);
}
else
{
if (forceUnsigned && value[prefixZeros] > 0x7f)
{
// Add a prefix zero to force unsigned if the MSB is 1
EncodeLength(stream, value.Length - prefixZeros + 1);
stream.Write((byte)0);
}
else
{
EncodeLength(stream, value.Length - prefixZeros);
}
for (var i = prefixZeros; i < value.Length; i++)
{
stream.Write(value[i]);
}
}
}
public static string DecryptValue(string cypherText)
{
string plainTextData = string.Empty;
string privKeyBase64 = ""; //get value from session/temp storage
string privKeyString = System.Text.Encoding.ASCII.GetString(Convert.FromBase64String(privKeyBase64));
var sr = new System.IO.StringReader(privKeyString);
var xs = new System.Xml.Serialization.XmlSerializer(typeof(RSAParameters));
var privKey = (RSAParameters)xs.Deserialize(sr);
var csp = new RSACryptoServiceProvider();
csp.ImportParameters(privKey);
var bytesCypherText = Convert.FromBase64String(cypherText);
//Problematic line
var bytesPlainTextData = csp.Decrypt(bytesCypherText, false);
plainTextData = System.Text.Encoding.Unicode.GetString(bytesPlainTextData);
return plainTextData;
}

.JS

function encrypt(msg, publicKey) {
var jsEncrypt = new JSEncrypt();
jsEncrypt.setPublicKey(publicKey);
var encrypted = jsEncrypt.encrypt(msg);
var base64result = btoa(encrypted);
return base64result;            
}

更新/变更：

如果我将密钥大小设为 1024 而不是 2048，则我得到的错误是The data to be decrypted exceeds the maximum for this modulus of 128 bytes..加密字符串的总字节数为 172，具体取决于我在调试器中看到的内容。

更新 |溶液：

1. 删除 JSvar base64result = btoa(encrypted);中的此行。只需直接返回加密值即可。
2. 在 C# 解密方法中，将此行var bytesPlainTextData = csp.Decrypt(bytesCypherText, false);更改为var bytesPlainTextData = csp.Decrypt(bytesCypherText, RSAEncryptionPadding.Pkcs1);。

笔记：

• 请忽略不正确的方法返回类型，这仍然是一个 POC，并且正在手动填充很多值。
• 我不是安全问题的专家，所以很多代码都是从不同的来源挑选的。

Answer 1

您正面临非对称加密的限制。对于大块数据，它非常慢，并且加密字符串大小受您使用的 RSA 密钥大小的限制。

RSA通常用于交换对称密钥和处理大部分数据。如果必须对大量数据使用非对称，则需要将有效负载分解为较小的有效负载并在另一侧重建。

RSA 只能将数据加密到密钥大小(2048 位 = 256 字节(减去填充/标头数据(PKCS#1 v1.5 填充为 11 字节(的最大数量。

如果如您所说，您只发送 20 个字符，那么确实使用断点检查您的解密函数是否确实获得了足够小的密码文本。如果没有，您需要回溯并检查您发送错误内容的位置。

也可能是 RSA 的标准在 JSEncrypt 和 RSA 在 C# 中并不相同，正如在此 SO 答案中所示