Decrypt my World

Cryptography, Security, Debugging and more!

RSACryptoServiceProvider fails when used with ASP.NET

RSACryptoServiceProvider fails when used with ASP.NET

  • Comments 15

Hi, welcome back,

I will talk today about a very common issue we face when we try to use .NET's RSACryptoServiceProvider class in ASP.NET.

When we try to create a new RSACryptoServiceProvider object in this scenario, we may get the following exception:

"System.Security.Cryptography.CryptographicException: The system cannot find the file specified".

 

By using my CryptoAPI Tracer script we can take a look to the CryptoAPI calls that .NET is making behind the scenes. Thanks to this script we will be able to see the exact API that is failing and the exact error (which most of the time .NET masks).

In our case, the API that fails is CryptAcquireContext, and it fails with error #2 (ERROR_FILE_NOT_FOUND). According to CryptAcquireContext documentation, this error means the following:
"
The profile of the user is not loaded and cannot be found. This happens when the application impersonates a user, for example, the IUSR_ComputerName account.
"

By default, ASP.NET won't load the user profile. Take a look to the parameters of the problematic CryptAcquireContext call as being shown in the log file that my script generated. If this API is not being called with CRYPT_MACHINE_KEYSET (to use the machine profile) or CRYPT_VERIFYCONTEXT (to use temporary key stores), it will try to access the key stores in the user profile, and it will fail because its not loaded.

Which options do we have here then?

1) If we need each user running your ASP.NET app to use their own key stores, we will have to load their user profile. We can do it with LoadUserProfile API. The only problem is that the privileges needed to execute this API are quite powerful for a standard user.

2) If we still need the user profile and don't want to give users enough privileges to run LoadUserProfile, there is a trick we can use: Service Control Manager (SCM) will automatically load the profile of the user that a Windows service uses to run. So we may create a dummy Windows service which runs with our user's credentials. This service won't need to do anything special, just stay alive. SCM will load the user profile for us and ASP.NET will be able to use it automatically once it gets loaded.

3) We may also use machine key stores instead of user's. We just have to pass CRYPT_MACHINE_KEYSET flag to CryptAcquireContext. In order to do that in .NET, we may use a code like this: 

CspParameters RSAParams = new CspParameters();
RSAParams.Flags = CspProviderFlags.UseMachineKeyStore;
RSACryptoServiceProvider sp = new RSACryptoServiceProvider(1024, RSAParams);

Note. When we use machine key stores, any user in that machine may have access to those keys.

 

I hope this helps.

Cheers,

 

Alex (Alejandro Campos Magencio)

  • Hello Alex,

    I found your Blog by Nacho's one, I didn't notice you were writing here. Reading briefly some of your entries, you seem to be surrounded by the power of WinDBG, which everything must be said, is insane. :-P

    I wish you all the best, take care,

    Marcos, your mentee

  • Thank u very much for ur studying on this problem, I found there a are really too many developers encounter this kind of troubles, but u provide the solution, Thank u!

    And I choose the 3rd way to solve this problem, coz the code is already there ^_^, but when I upload my code to the virtual host, there's still a problem called "Access is denied!"

    Hope u can provide more! Thank u in advanced! ^_^

    Access is denied.

    Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

    Exception Details: System.Security.Cryptography.CryptographicException: Access is denied.

    Source Error:

    Line 14: RSAParams.Flags = CspProviderFlags.UseMachineKeyStore;

    Line 15: RSACryptoServiceProvider rsaCryptoServiceProvider = new RSACryptoServiceProvider(dwKeySize, RSAParams);

    Line 16: rsaCryptoServiceProvider.FromXmlString(xmlString);

    Line 17: int base64BlockSize = ((dwKeySize / 8) % 3 != 0) ? (((dwKeySize / 8) / 3) * 4) + 4 : ((dwKeySize / 8) / 3) * 4;

    Line 18: int iterations = inputString.Length / base64BlockSize;

    And sorry for bother u...-_-b

  • Hi KAI,

    You just gave me an idea for a new post which may help you troubleshoot this issue:

    Key Containers: Basics

    http://blogs.msdn.com/alejacma/archive/2007/12/13/key-containers-basics.aspx

    Process Monitor may help you find out why you are getting Access Denied.

    I hope this helps.

    Alex

  • hi Alex

    I was going mad.. before seeing your blog. I am new to this crypt32 and RSA related things.Your blog is giving me some hope, Can you please give your tips to resolve my following issue.

    The basic functionality of my app is read RAW certificate data from a certificate file and use it

    to verify a SAML response.

    I am using the exact code given in the microsoft article (sub topic: Verify a SignedXml object by using a certificate) http://support.microsoft.com/kb/320602.

    But,the Crypt32.CryptAcquireContext method is returning false value, and the subsequent crypt32 methods

    Crypt32.CryptImportPublicKeyInfo, Crypt32.CryptExportKey. are also failing.

    The confusing thing for me is, The same code is working fine, if i change the identity of Application Domain

    to any of the predefined services(Network service,Local service, Local system). It is not working if the identity is set us

    IWAM_machine account.

    If i try the same code in a windows XP environment with IIS 5.1, The code is working fine only in (IIS Low(IISProcess)

    it is failing in Medium and High. I couldn't understand this mystery :(

    I can't use the Predefined services as identity because if i change it, some other functionalites in my application are crashing, because those are configured to use IWAM_machine.

    Can you give some tips to execute the above code under the IWAM_machine account.

    Any clues Alex..

  • Alex,

    Thanks for the script.  I have the error message, but still do not know what to do with it - "Indicates the specified environment variable name was not found in the specified environment block".  I have a custom identity for the IIS process and hacve granted it access to everything I can think of,but still get this error.  How can I know which environment variable it is looking for?  

    Thanks for any help,

    David

  • I also came across this problem. Option 3 helps me out.

    Thank you. I will follow yours for a couple of time.

  • Option 3 is in the money for me.  Cured the problem straight away.  Thanks very much.

  • Alex,

    Thank you very much for your explanation, diagnosis and possibles workarounds. As one said before me... "I was going mad" with this issue. Solution number 3 was the perfect for me; I tried and it worked fine!

    Thanks again!

    Marc

  • Alex,

    Thank you for the useful post.  Could you elaborate on the statement "Note. When we use machine key stores, any user in that machine may have access to those keys." ?  

    Darrell

  • Darrell, what I mean by that is that if users have NTFS permissions on the folder where keys are stored, they may be able to access them. By default only admins should be able to access those keys. More details here:

    Key Containers: Basics

    blogs.msdn.com/.../key-containers-basics.aspx

  • I'm having this problem one of two machines in a small web farm. One runs perfectly, the other

    throws the crypto exception. Our code base has not changed in years.

    We did move the two machines about the time this problem appeared. I also don't know the update history of the machines. We've rebuilt the bad machine but the exception keeps appearing. I think it's a config or environmental issue.

    I can reproduce the issue on my DEV machine by deleting the user profile for the App Pool under which the web site is running. If I recreate the profile on my DEV machine, it corrects the problem.

    We've confirmed the correct profile for the App Pool exists and that the web site is running under the correct App Pool. We've also looked for any differences between the two machines with no luck. Both machines are manually setup.

    This is in a test environment. Our production environment is the same, and it's running fine

    Any thoughts on where to look?

  • Hi epaetz41,

    I would get Process Monitor logs (technet.microsoft.com/.../bb896645.aspx) to see which file we cannot access. That may give us some ideas...

  • Hello Everyone,

    I am glad that i found the one alternative for this issue

    System.Security.Cryptography.CryptographicException: The system cannot find the file specified".

    while importing the pfx file,

    I solved this by temperorily saving the pfx file in project folder and then using it after this issue get solved it works now. Hope this will help someone.

  • Thank you very much ! I have sloved my problem by your method.

  • Option 2 worked for me thanks for your help.........

    Thanks

    Rizwan

Page 1 of 1 (15 items)
Leave a Comment
  • Please add 7 and 3 and type the answer here:
  • Post
Translate This Page