Using RSACryptoServiceProvider for RSA-SHA256 signatures
Earlier this month, we released .NET 3.5 SP 1. One of the new features available in this update is that RSACryptoServiceProvider has gained the ability to create and verify RSA-SHA256 signatures.
Since RSACryptoServiceProvider relies on the underlying CAPI APIs to do its work, this feature will only be enabled on versions of Windows which support SHA-256 algorithms in CAPI. At this point, that translates to Windows Server 2003 and higher.
The code to create and verify a signature is basically the same as it was for doing RSA-SHA1:
byte[] data = new byte[] { 0, 1, 2, 3, 4, 5 };
using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider())
{
byte[] signature = rsa.SignData(data, "SHA256");
if (rsa.VerifyData(data, "SHA256", signature))
{
Console.WriteLine("RSA-SHA256 signature verified");
}
else
{
Console.WriteLine("RSA-SHA256 signature failed to verify");
}
}
The second parameter should be either the string "SHA256", the type of the SHA256Managed object, or an instance of a SHA256Managed object.
Note that this means, somewhat counter-intuitively, that passing either the type of or an instance of the SHA256CryptoServiceProvider object will not work. If you do use the SHA256CryptoServiceProvider type, you'll end up with an error like this:
Unhandled Exception: System.ArgumentException: Value was invalid.
at System.Security.Cryptography.Utils.ObjToOidValue(Object hashAlg)
at System.Security.Cryptography.RSACryptoServiceProvider.SignData(Byte[] buffer, Object halg)
The reason for this is the same reason that CryptoConfig does not understand SHA256CryptoServiceProvider - it was added as part of the green bits in .NET 3.5, and due to layering restrictions the red bits (such as mscorlib.dll where RSACryptoServiceProvider lives) does not know about its existence.
Also note that this functionality was added only to the RSACryptoServiceProvider type, so upstack functionality such as XML digital signatures are not yet enabled for RSA-SHA256 digital signatures. However, this does provide the base building block for those upstack crypto technologies, so that they can begin adding support in the future.
