Using RSACryptoServiceProvider for RSA-SHA256 signatures

re: Using RSACryptoServiceProvider for RSA-SHA256 signatures

Balazs — Fri, 01 May 2009 02:41:24 GMT

Could you tell me, why an actually existing private key wont't work with this method (on any current OS)

X509Store _windowsStore = new X509Store( StoreName.My , StoreLocation.CurrentUser );

_windowsStore.Open(OpenFlags.MaxAllowed); // for the sake of testing

X509Certificate2 _cachedCert = _windowsStore.Certificates[0];

RSACryptoServiceProvider _provider = null;

byte[] data = new byte[] { 0, 1, 2, 3, 4, 5 };

// CASE A, I'd like it to work

if (_cachedCert.HasPrivateKey)

{

_provider = (RSACryptoServiceProvider)_cachedCert.PrivateKey;

// This will throw {System.Security.Cryptography.CryptographicException}

// "Invalid algorithm specified.\r\n"

byte[] sigedBytes = _provider.SignData(data, "SHA256");

}

// CASE B, This works, this was your example

_provider = new RSACryptoServiceProvider();

byte[] sigedBytes2 = _provider.SignData(data, "SHA256");

re: Using RSACryptoServiceProvider for RSA-SHA256 signatures

Ronak jain — Tue, 19 May 2009 10:19:31 GMT

We can also print in a message box , why to use console ?

re: Using RSACryptoServiceProvider for RSA-SHA256 signatures

shawnfa — Fri, 22 May 2009 00:10:57 GMT

I tend to use the console in my sample code since it doesn't require any additional dependencies.

-Shawn

re: Using RSACryptoServiceProvider for RSA-SHA256 signatures

shawnfa — Fri, 22 May 2009 00:16:49 GMT

You need to make sure that the RSA key is stored in the PROV_RSA_AES crypto service provider. If your certificate is using PROV_RSA_FULL, then that CSP doesn't understand SHA-256, and the signature process won't work.

-Shawn

re: Using RSACryptoServiceProvider for RSA-SHA256 signatures

Pete R — Sun, 28 Jun 2009 21:43:40 GMT

Hi Shawn,

It seems this might still run afoul of this knowledgebase issue with regard to delays incurred while calling the SignData method: http://support.microsoft.com/kb/948080. I need to sign cookies for a very high-traffic website and such delays would be unacceptable. Is there a way to do RSA-SHA256 while still avoiding this issue? Thanks!