I'm making a Windows application, which you need to log into first.
The account details consist of username and password, and they need to be saved locally.
It's just a matter of security, so other people using the same computer can't see everyone's personal data.
What is the best/most secure way to save this data?
I don't want to use a database, so I tried some things with Resource files.
But since I'm kind of new with this, I'm not entirely sure of what I'm doing and where I should be looking for a solution.
If you are just going to verify/validate the entered user name and password, use the Rfc2898DerivedBytes class (also known as Password Based Key Derivation Function 2 or PBKDF2). This is more secure than using encryption like Triple DES or AES because there is no practical way to go from the result of RFC2898DerivedBytes back to the password. You can only go from a password to the result. See Is it ok to use SHA1 hash of password as a salt when deriving encryption key and IV from password string? for an example and discussion for .Net or String encrypt / decrypt with password c# Metro Style for WinRT/Metro.
If you are storing the password for reuse, such as supplying it to a third party, use the Windows Data Protection API (DPAPI). This uses operating system generated and protected keys and the Triple DES encryption algorithm to encrypt and decrypt information. This means your application does not have to worry about generating and protecting the encryption keys, a major concern when using cryptography.
In C#, use the System.Security.Cryptography.ProtectedData class. For example, to encrypt a piece of data, use ProtectedData.Protect():
// Data to protect. Convert a string to a byte[] using Encoding.UTF8.GetBytes().
byte[] plaintext;
// Generate additional entropy (will be used as the Initialization vector)
byte[] entropy = new byte[20];
using(RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider())
{
rng.GetBytes(entropy);
}
byte[] ciphertext = ProtectedData.Protect(plaintext, entropy,
DataProtectionScope.CurrentUser);
Store the entropy and ciphertext securely, such as in a file or registry key with permissions set so only the current user can read it. To get access to the original data, use ProtectedData.Unprotect():
byte[] plaintext= ProtectedData.Unprotect(ciphertext, entropy,
DataProtectionScope.CurrentUser);
Note that there are additional security considerations. For example, avoid storing secrets like passwords as a string. Strings are immutable, being they cannot be notified in memory so someone looking at the application's memory or a memory dump may see the password. Use SecureString or a byte[] instead and remember to dispose or zero them as soon as the password is no longer needed.
I have used this before and I think in order to make sure credential persist and in a best secure way is
you can write them to the app config file using the ConfigurationManager class
securing the password using the SecureString class
then encrypting it using tools in the Cryptography namespace.
This link will be of great help I hope : Click here
I wanted to encrypt and decrypt the string as a readable string.
Here is a very simple quick example in C# Visual Studio 2019 WinForms based on the answer from #Pradip.
Right click project > properties > settings > Create a username and password setting.
Now you can leverage those settings you just created. Here I save the username and password but only encrypt the password in it's respectable value field in the user.config file.
Example of the encrypted string in the user.config file.
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<userSettings>
<secure_password_store.Properties.Settings>
<setting name="username" serializeAs="String">
<value>admin</value>
</setting>
<setting name="password" serializeAs="String">
<value>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAQpgaPYIUq064U3o6xXkQOQAAAAACAAAAAAAQZgAAAAEAACAAAABlQQ8OcONYBr9qUhH7NeKF8bZB6uCJa5uKhk97NdH93AAAAAAOgAAAAAIAACAAAAC7yQicDYV5DiNp0fHXVEDZ7IhOXOrsRUbcY0ziYYTlKSAAAACVDQ+ICHWooDDaUywJeUOV9sRg5c8q6/vizdq8WtPVbkAAAADciZskoSw3g6N9EpX/8FOv+FeExZFxsm03i8vYdDHUVmJvX33K03rqiYF2qzpYCaldQnRxFH9wH2ZEHeSRPeiG</value>
</setting>
</secure_password_store.Properties.Settings>
</userSettings>
</configuration>
Full Code
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Security;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
namespace secure_password_store
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}
private void Exit_Click(object sender, EventArgs e)
{
Application.Exit();
}
private void Login_Click(object sender, EventArgs e)
{
if (checkBox1.Checked == true)
{
Properties.Settings.Default.username = textBox1.Text;
Properties.Settings.Default.password = EncryptString(ToSecureString(textBox2.Text));
Properties.Settings.Default.Save();
}
else if (checkBox1.Checked == false)
{
Properties.Settings.Default.username = "";
Properties.Settings.Default.password = "";
Properties.Settings.Default.Save();
}
MessageBox.Show("{\"data\": \"some data\"}","Login Message Alert",MessageBoxButtons.OK, MessageBoxIcon.Information);
}
private void DecryptString_Click(object sender, EventArgs e)
{
SecureString password = DecryptString(Properties.Settings.Default.password);
string readable = ToInsecureString(password);
textBox4.AppendText(readable + Environment.NewLine);
}
private void Form_Load(object sender, EventArgs e)
{
//textBox1.Text = "UserName";
//textBox2.Text = "Password";
if (Properties.Settings.Default.username != string.Empty)
{
textBox1.Text = Properties.Settings.Default.username;
checkBox1.Checked = true;
SecureString password = DecryptString(Properties.Settings.Default.password);
string readable = ToInsecureString(password);
textBox2.Text = readable;
}
groupBox1.Select();
}
static byte[] entropy = Encoding.Unicode.GetBytes("SaLtY bOy 6970 ePiC");
public static string EncryptString(SecureString input)
{
byte[] encryptedData = ProtectedData.Protect(Encoding.Unicode.GetBytes(ToInsecureString(input)),entropy,DataProtectionScope.CurrentUser);
return Convert.ToBase64String(encryptedData);
}
public static SecureString DecryptString(string encryptedData)
{
try
{
byte[] decryptedData = ProtectedData.Unprotect(Convert.FromBase64String(encryptedData),entropy,DataProtectionScope.CurrentUser);
return ToSecureString(Encoding.Unicode.GetString(decryptedData));
}
catch
{
return new SecureString();
}
}
public static SecureString ToSecureString(string input)
{
SecureString secure = new SecureString();
foreach (char c in input)
{
secure.AppendChar(c);
}
secure.MakeReadOnly();
return secure;
}
public static string ToInsecureString(SecureString input)
{
string returnValue = string.Empty;
IntPtr ptr = System.Runtime.InteropServices.Marshal.SecureStringToBSTR(input);
try
{
returnValue = System.Runtime.InteropServices.Marshal.PtrToStringBSTR(ptr);
}
finally
{
System.Runtime.InteropServices.Marshal.ZeroFreeBSTR(ptr);
}
return returnValue;
}
private void EncryptString_Click(object sender, EventArgs e)
{
Properties.Settings.Default.password = EncryptString(ToSecureString(textBox2.Text));
textBox3.AppendText(Properties.Settings.Default.password.ToString() + Environment.NewLine);
}
}
}
DPAPI is just for this purpose. Use DPAPI to encrypt the password the first time the user enters is, store it in a secure location (User's registry, User's application data directory, are some choices). Whenever the app is launched, check the location to see if your key exists, if it does use DPAPI to decrypt it and allow access, otherwise deny it.
This only works on Windows, so if you are planning to use dotnet core cross-platform, you'll have to look elsewhere. See https://github.com/dotnet/corefx/blob/master/Documentation/architecture/cross-platform-cryptography.md
For simple scenarios can also use Windows Credential Management API using C# wrapper CredentialManagement. It gives single place to store/retrieve passwords, easy to change.
https://stackoverflow.com/a/32550674/1129978
Related
Programmed in Visual Studio 2019 on Windows 10.
RFC 2898 encoding process from a .NET Framowork 4.7.2 project. to Xamarin.Form (.NET Standard 2.0) .
The original processing is as follows
var salt = "abcdefg";
var passWord = "password";
var iterations = 5;
var saltbyte = System.Text.Encoding.UTF8. GetBytes(salt);
var Rfc2898 = new System.Security.Cryptography. Rfc2898DeriveBytes(passWord, saltbyte, iterations, System.Security.Cryptography. HashAlgorithmName.SHA256);
Porting it will result in an error in Xamarin, because you can't specify a hash algorithm. You can't specify a hash algorithm.
var Rfc2898 = new System.Security.Cryptography. Rfc2898DeriveBytes(passWord, saltbyte, iterations);
How do I specify a hash algorithm in Xamarin?
Translated with www.DeepL.com/Translator (free version)
It seems like .NET Standard 2.0 doesn't provide the constructor with the HashAlgorithmName argument. It is however present in .NET Standard 2.1. You can easily change your library to use .NET Standard 2.1.
Otherwise, you will have to do that platform specifically instead. Xamarin.iOS and Xamarin.Android do have the constructor available.
So I would create a service to hash your passwords:
public interface IPasswordHasher
{
byte[] GetHashedPassword(string password, string salt, int keySize);
}
Then implement this on both Android and iOS and register it as a Xamarin.Forms DependencyService instance:
using System.Security.Cryptography;
using System.Text.Encoding;
using Xamarin.Forms;
[assembly: Dependency(typeof(MyAwesomeProject.iOS.Services.PasswordHasher))]
namespace MyAwesomeProject.iOS.Services
{
public class PasswordHasher : IPasswordHasher
{
public byte[] GetHashedPassword(string password, string salt, int keySize)
{
var saltbyte = UTF8.GetBytes(salt);
var rfc2898 = new Rfc2898DeriveBytes(password, saltbyte, 1000, HashAlgorithmName.SHA256);
return rfc2898.GetBytes(keySize);
}
}
}
Then when you need to use it as:
var bytes = DependencyService.Get<IDeviceOrientationService>().GetHashedPassword("password", "abcdefg", 20);
I highly recommend that you use more than 5 iterations for your PBKDF2 key derivation. The default is 1000, the higher the better. Of course on mobile, you may hit a performance limitation, but 5 is way too low.
I have been following the Oauth2 Service account documentation on Googles website. I have also been picking apart Googles .net client libray trying to get this to work.
I have reached the Computing the signature stage.
The privacy key from Google looks like this
-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDcmuyQC8rwWdPQ\nmIdksgzSJbVWTU5MeUxy+HAap3yut9wR/L6KGMJ4FBYcsPmXN5gQAhErybavGoZG\nfS1X1/PCpPVpTCA4749K8gbvuZg1JEIAqMtmHiBBrJj5l8eiekQc8pd7Pq35H4wi\nJYXAJGwggPcttkLBRi0xZzd+jdwL1st+7zRt8nMao/xFibInBBvKwb/gP4mJxlQg\nnRdGO6zgMk+PLTcA5C+gFyPA4SdkylrLib5CJO9123FgcfTJZJTukeHo1v0EfU+4\n3bK8HBZnOFa4DHH4mXhkhgYMjibv4Sr/WCEoomJJwNN04SbUEdyhgpM2rZ3cvx+4\nsmB0SQflAgMBAAECggEAXZ100+/dL7++zh9cHVQdcrRDzprBplw3H/bjg7wdgftN\n7Wgm5214YQKNG6HSWORjqC9oX/+agZYs8w69xjBDJg9ggU2nwuGOGky4utQ0jiCT\nzbnTjsMsBxKaXBiXxBBEhVBBDjDcHQLRMdBggNgz9lskCYb1rxT7qqJVf2PtxCuZ\nuxw3whLMRHXvKosER12sMQgGB/0+Nk86GWCqPigpfu7Ec92V0ffcSUaq3gjIUD54\n67TduTWaRDQNB+j2yQsWQZnqRv+TvIXOjinAI+pPbvCUovtiTSZAoz3EalsiXQ0l\nUqDVx26uzEJqhB2kzvAeApuW2Nd5EPxUnf48c4xh4QKBgQDw01mEChWyENV5CBKU\nMSfY0rpAPtq7ahHRR458ZKtITDBlqiZLMjydI65Rr1XxpQ3pJZALObMdUhbvCDfm\nu4BY/lCCt+hcdt9IICvVZsgXgvb6M+Fj2IbYZcAnOm4T1Z1D3I+pW5NdK2ALQRiK\nWsGINOqWCB9WRd7nhmb/XwWyjQKBgQDqgWht5laDuLMc4qpj9finY4qmk57eT3KG\npzbVlT3h7kv7j/j6e+6o9psrqdf1PXpu9XZi3bPtPbH1fX9x5pZgJQRMP4FGOURY\nQDkJfiOOSN/8Vl0senqkscT7DSbe2BqyqQlSlTB4BBF29p1wxb5Wz5HH2BvYE2zI\ni9B4WJcAuQKBgADnajCasRYoBgUcSKWRwaqIr/ZJxhxp+4Mjl59T6WiuEIhxKQ+j\nMqMMXT0lQVdU3UaAw5enMcrsYfWnvD37ejHbUoYLFq4yLAhjRobYieu8rByoUTJE\nv8zUJPKAv6UHaj20+D0UgOsanJOuPN9YE93lBPRnN2blgD6yPHS88JKJAoGABFyh\n16F4LH0L/9aLes6BcIOeeZi3VMU/iRelInXjL8eh7CzyYZ5agxQLMNW46ZvaIiQ4\nroAXL6t9GubZrwGt/F3T5aMswWShS87uAKoy+RuL5wKoOwKQM24HDvBgr7ZvULFq\nNfoGa8UPmhneNdHHx4+W05PGeM9rr5NCLmrfbCkCgYA0nMvEDIJvU3KA3S1cQ3fs\nVopRJwqRIFFL1cHTWaEyIsxEh6i/zAUc/habK82dN3/ZDn/XvWY14k7VZPsSdDC9\noVlQj2z8DVO2K99Oxyh0VlthtecW8exjzkIPJL4srOSl/dooQZS/7ZZyaRQU/BLI\nMdzKHlUKKXWcUU+Ko8W4+w\u003d\u003d\n-----END PRIVATE KEY-----\n
Clean up key
First I clean up the key a bit
private const string PrivateKeyPrefix = "-----BEGIN PRIVATE KEY-----";
private const string PrivateKeySuffix = "-----END PRIVATE KEY-----";
/// <summary>Converts the PKCS8 private key to RSA parameters. This method uses the Bouncy Castle library.</summary>
private static RSAParameters ConvertPKCS8ToRSAParameters(string pkcs8PrivateKey)
{
var base64PrivateKey = pkcs8PrivateKey.Replace(PrivateKeyPrefix, "").Replace("\r\n", "").Replace(PrivateKeySuffix, "");
var privateKeyBytes = Convert.FromBase64String(base64PrivateKey);
RsaPrivateCrtKeyParameters crtParameters = (RsaPrivateCrtKeyParameters)PrivateKeyFactory.CreateKey(privateKeyBytes);
return DotNetUtilities.ToRSAParameters(crtParameters);
}
Import Parameters
RSAParameters rsaParameters = ConvertPKCS8ToRSAParameters(results.private_key);
RSACryptoServiceProvider key = new RSACryptoServiceProvider();
key.ImportParameters(rsaParameters);
Error
'System.Security.Cryptography.CryptographicException' occurred in
mscorlib.dll
Additional information: Bad Data.
My ideas
the dp value seams to be off everything I have read says it should be 128 bytes not 127.
Note:
I am not using the p12. file I am using the Json service account file. Answers using the X509Certificate2 and the p12 key file will not help.
{
"private_key_id": "xxxxxx",
"private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDcmuyQC8rwWdPQ\nmIdksgzSJbVWTU5MeUxy+HAap3yut9wR/L6KGMJ4FBYcsPmXN5gQAhErybavGoZG\nfS1X1/PCpPVpTCA4749K8gbvuZg1JEIAqMtmHiBBrJj5l8eiekQc8pd7Pq35H4wi\nJYXAJGwggPcttkLBRi0xZzd+jdwL1st+7zRt8nMao/xFibInBBvKwb/gP4mJxlQg\nnRdGO6zgMk+PLTcA5C+gFyPA4SdkylrLib5CJO9123FgcfTJZJTukeHo1v0EfU+4\n3bK8HBZnOFa4DHH4mXhkhgYMjibv4Sr/WCEoomJJwNN04SbUEdyhgpM2rZ3cvx+4\nsmB0SQflAgMBAAECggEAXZ100+/dL7++zh9cHVQdcrRDzprBplw3H/bjg7wdgftN\n7Wgm5214YQKNG6HSWORjqC9oX/+agZYs8w69xjBDJg9ggU2nwuGOGky4utQ0jiCT\nzbnTjsMsBxKaXBiXxBBEhVBBDjDcHQLRMdBggNgz9lskCYb1rxT7qqJVf2PtxCuZ\nuxw3whLMRHXvKosER12sMQgGB/0+Nk86GWCqPigpfu7Ec92V0ffcSUaq3gjIUD54\n67TduTWaRDQNB+j2yQsWQZnqRv+TvIXOjinAI+pPbvCUovtiTSZAoz3EalsiXQ0l\nUqDVx26uzEJqhB2kzvAeApuW2Nd5EPxUnf48c4xh4QKBgQDw01mEChWyENV5CBKU\nMSfY0rpAPtq7ahHRR458ZKtITDBlqiZLMjydI65Rr1XxpQ3pJZALObMdUhbvCDfm\nu4BY/lCCt+hcdt9IICvVZsgXgvb6M+Fj2IbYZcAnOm4T1Z1D3I+pW5NdK2ALQRiK\nWsGINOqWCB9WRd7nhmb/XwWyjQKBgQDqgWht5laDuLMc4qpj9finY4qmk57eT3KG\npzbVlT3h7kv7j/j6e+6o9psrqdf1PXpu9XZi3bPtPbH1fX9x5pZgJQRMP4FGOURY\nQDkJfiOOSN/8Vl0senqkscT7DSbe2BqyqQlSlTB4BBF29p1wxb5Wz5HH2BvYE2zI\ni9B4WJcAuQKBgADnajCasRYoBgUcSKWRwaqIr/ZJxhxp+4Mjl59T6WiuEIhxKQ+j\nMqMMXT0lQVdU3UaAw5enMcrsYfWnvD37ejHbUoYLFq4yLAhjRobYieu8rByoUTJE\nv8zUJPKAv6UHaj20+D0UgOsanJOuPN9YE93lBPRnN2blgD6yPHS88JKJAoGABFyh\n16F4LH0L/9aLes6BcIOeeZi3VMU/iRelInXjL8eh7CzyYZ5agxQLMNW46ZvaIiQ4\nroAXL6t9GubZrwGt/F3T5aMswWShS87uAKoy+RuL5wKoOwKQM24HDvBgr7ZvULFq\nNfoGa8UPmhneNdHHx4+W05PGeM9rr5NCLmrfbCkCgYA0nMvEDIJvU3KA3S1cQ3fs\nVopRJwqRIFFL1cHTWaEyIsxEh6i/zAUc/habK82dN3/ZDn/XvWY14k7VZPsSdDC9\noVlQj2z8DVO2K99Oxyh0VlthtecW8exjzkIPJL4srOSl/dooQZS/7ZZyaRQU/BLI\nMdzKHlUKKXWcUU+Ko8W4+w\u003d\u003d\n-----END PRIVATE KEY-----\n",
"client_email": "dddddd-2a1f881e7rabfkt2eb1p84aisg30pedg#developer.gserviceaccount.com",
"client_id": "ddddd-2a1f881e7rabfkt2eb1p84aisg30pedg.apps.googleusercontent.com",
"type": "service_account"
}
Just realised how long ago this was reported. I presume you found an answer or gave up.
Your code now works - I tried this on BouncyCastle 1.8.1 and it works, it fails on 1.7.0.
Code used:
using System;
using System.Security.Cryptography;
using Newtonsoft.Json;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Security;
namespace ConsoleApp1
{
class Program
{
public static void Main()
{
var json = "{\"private_key_id\":\"xxxxxx\",\"private_key\":\"-----BEGIN PRIVATE KEY-----\\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDcmuyQC8rwWdPQ\\nmIdksgzSJbVWTU5MeUxy+HAap3yut9wR/L6KGMJ4FBYcsPmXN5gQAhErybavGoZG\\nfS1X1/PCpPVpTCA4749K8gbvuZg1JEIAqMtmHiBBrJj5l8eiekQc8pd7Pq35H4wi\\nJYXAJGwggPcttkLBRi0xZzd+jdwL1st+7zRt8nMao/xFibInBBvKwb/gP4mJxlQg\\nnRdGO6zgMk+PLTcA5C+gFyPA4SdkylrLib5CJO9123FgcfTJZJTukeHo1v0EfU+4\\n3bK8HBZnOFa4DHH4mXhkhgYMjibv4Sr/WCEoomJJwNN04SbUEdyhgpM2rZ3cvx+4\\nsmB0SQflAgMBAAECggEAXZ100+/dL7++zh9cHVQdcrRDzprBplw3H/bjg7wdgftN\\n7Wgm5214YQKNG6HSWORjqC9oX/+agZYs8w69xjBDJg9ggU2nwuGOGky4utQ0jiCT\\nzbnTjsMsBxKaXBiXxBBEhVBBDjDcHQLRMdBggNgz9lskCYb1rxT7qqJVf2PtxCuZ\\nuxw3whLMRHXvKosER12sMQgGB/0+Nk86GWCqPigpfu7Ec92V0ffcSUaq3gjIUD54\\n67TduTWaRDQNB+j2yQsWQZnqRv+TvIXOjinAI+pPbvCUovtiTSZAoz3EalsiXQ0l\\nUqDVx26uzEJqhB2kzvAeApuW2Nd5EPxUnf48c4xh4QKBgQDw01mEChWyENV5CBKU\\nMSfY0rpAPtq7ahHRR458ZKtITDBlqiZLMjydI65Rr1XxpQ3pJZALObMdUhbvCDfm\\nu4BY/lCCt+hcdt9IICvVZsgXgvb6M+Fj2IbYZcAnOm4T1Z1D3I+pW5NdK2ALQRiK\\nWsGINOqWCB9WRd7nhmb/XwWyjQKBgQDqgWht5laDuLMc4qpj9finY4qmk57eT3KG\\npzbVlT3h7kv7j/j6e+6o9psrqdf1PXpu9XZi3bPtPbH1fX9x5pZgJQRMP4FGOURY\\nQDkJfiOOSN/8Vl0senqkscT7DSbe2BqyqQlSlTB4BBF29p1wxb5Wz5HH2BvYE2zI\\ni9B4WJcAuQKBgADnajCasRYoBgUcSKWRwaqIr/ZJxhxp+4Mjl59T6WiuEIhxKQ+j\\nMqMMXT0lQVdU3UaAw5enMcrsYfWnvD37ejHbUoYLFq4yLAhjRobYieu8rByoUTJE\\nv8zUJPKAv6UHaj20+D0UgOsanJOuPN9YE93lBPRnN2blgD6yPHS88JKJAoGABFyh\\n16F4LH0L/9aLes6BcIOeeZi3VMU/iRelInXjL8eh7CzyYZ5agxQLMNW46ZvaIiQ4\\nroAXL6t9GubZrwGt/F3T5aMswWShS87uAKoy+RuL5wKoOwKQM24HDvBgr7ZvULFq\\nNfoGa8UPmhneNdHHx4+W05PGeM9rr5NCLmrfbCkCgYA0nMvEDIJvU3KA3S1cQ3fs\\nVopRJwqRIFFL1cHTWaEyIsxEh6i/zAUc/habK82dN3/ZDn/XvWY14k7VZPsSdDC9\\noVlQj2z8DVO2K99Oxyh0VlthtecW8exjzkIPJL4srOSl/dooQZS/7ZZyaRQU/BLI\\nMdzKHlUKKXWcUU+Ko8W4+w==\\n-----END PRIVATE KEY-----\\n\",\"client_email\":\"dddddd-2a1f881e7rabfkt2eb1p84aisg30pedg#developer.gserviceaccount.com\",\"client_id\":\"ddddd-2a1f881e7rabfkt2eb1p84aisg30pedg.apps.googleusercontent.com\",\"type\":\"service_account\"}";
dynamic jsonObject = JsonConvert.DeserializeObject(json);
var rsaParams = ConvertPKCS8ToRSAParameters((string)jsonObject.private_key);
RSACryptoServiceProvider key = new RSACryptoServiceProvider();
key.ImportParameters(rsaParams);
Console.WriteLine($"Key size: {key.KeySize}, DP: {rsaParams.DP.Length}");
Console.ReadLine();
}
private const string PrivateKeyPrefix = "-----BEGIN PRIVATE KEY-----";
private const string PrivateKeySuffix = "-----END PRIVATE KEY-----";
/// <summary>Converts the PKCS8 private key to RSA parameters. This method uses the Bouncy Castle library.</summary>
private static RSAParameters ConvertPKCS8ToRSAParameters(string pkcs8PrivateKey)
{
var base64PrivateKey = pkcs8PrivateKey.Replace(PrivateKeyPrefix, "").Replace("\r\n", "").Replace(PrivateKeySuffix, "");
var privateKeyBytes = Convert.FromBase64String(base64PrivateKey);
RsaPrivateCrtKeyParameters crtParameters = (RsaPrivateCrtKeyParameters)PrivateKeyFactory.CreateKey(privateKeyBytes);
return DotNetUtilities.ToRSAParameters(crtParameters);
}
}
}
I've made this .net project that uses both json and p12 files to authenticate a service account with or without user impersonation.
GoogleApiServiceFactory
I am working on a file locker/unlocker application using C# on VS2010.
what i want is to lock a file with a password using my application and then unlock it any time.
In fact, I used the following code to lock the file, but the file is being locked only while the application is still running; when I close the application, the file is unlocked.
using System;
using System.Collections.Generic;
using System.Text;
using System.IO;
using System.Configuration;
using System.Windows.Forms;
namespace LockFile
{
public enum LockStatus
{
Unlocked,
Locked
}
public class LockFilePresenter
{
private ILockFileView view;
private string file2Lock = string.Empty;
private FileStream fileLockStream = null;
public LockFilePresenter(ILockFileView view)
{
this.view = view;
}
internal void LockFile()
{
if (string.IsNullOrEmpty(file2Lock) || !File.Exists(file2Lock))
{
view.ShowMessage("Please select a path to lock.");
return;
}
if (fileLockStream != null)
{
view.ShowMessage("The path is already locked.");
return;
}
try
{
fileLockStream = File.Open(file2Lock, FileMode.Open);
fileLockStream.Lock(0, fileLockStream.Length);
view.SetStatus(LockStatus.Locked);
}
catch (Exception ex)
{
fileLockStream = null;
view.SetStatus(LockStatus.Unlocked);
view.ShowMessage(string.Format("An error occurred locking the path.\r\n\r\n{0}", ex.Message));
}
}
internal void UnlockFile()
{
if (fileLockStream == null)
{
view.ShowMessage("No path is currently locked.");
return;
}
try
{
using (fileLockStream)
fileLockStream.Unlock(0, fileLockStream.Length);
}
catch (Exception ex)
{
view.ShowMessage(string.Format("An error occurred unlocking the path.\r\n\r\n{0}", ex.Message));
}
finally
{
fileLockStream = null;
}
view.SetStatus(LockStatus.Unlocked);
}
internal void SetFile(string path)
{
if (ValidateFile(path))
{
if (fileLockStream != null)
UnlockFile();
view.SetStatus(LockStatus.Unlocked);
file2Lock = path;
view.SetFile(path);
}
}
internal bool ValidateFile(string path)
{
bool exists = File.Exists(path);
if (!exists)
view.ShowMessage("File does not exist.");
return exists;
}
}
}
and
using System;
using System.Collections.Generic;
using System.Text;
namespace LockFile
{
public interface ILockFileView
{
void ShowMessage(string p);
void SetStatus(LockStatus lockStatus);
void SetFile(string path);
}
}
As I said previously, the application works fine during the running time, but when I close it, the locked file will be unlocked.
If anybody has any idea about how to do it, I would be grateful.
A Lock on a FileStream just means that your process has exclusive access to the file while it's active; it has nothing to do with password protecting a file.
It sounds like what you want is to encrypt a file with a password. The file class provides Encrypt/Decrypt based on the current user, or, if you want it based on your own custom password there's a sample of using some of the classes in the System.Security.Cryptography namespace to encrypt a file with a password here (instead of hard coding you would take it as input presumably) http://www.codeproject.com/Articles/26085/File-Encryption-and-Decryption-in-C
Keep in mind, doing security right is hard.
You're using the FileStream.Lock() method to lock a specific file so that only the process running the FileStream can use it.
http://msdn.microsoft.com/en-us/library/system.io.filestream.lock.aspx
This is a mechanism designed to prevent other processes writing to a file that you are reading/writing to, and you can see this method in use with applications like Microsoft Excel.
When you close your application, the process is no longer running, and the lock on the file is disengaged.
If your goal is to prevent other applications from reading the file, you have some limited options:
Encrypt the file. This will mean that an application cannot read usable information from the file without the decryption key, but there is the potential for an application to open and change the encrypted file.
Save the file to a read-only media like a CD/DVD, or to removable storage that you then unplug and carry with you.
If you want to prevent other applications from modifying the file, you might look at the ReadOnly flags that Windows offers: http://msdn.microsoft.com/en-us/library/system.io.fileinfo.isreadonly.aspx
Note that these will still be insecure, as readonly flags can be ignored.
Something you need to think about is your reasoning for why you want to be restricting access to a file - that will help determine the best strategy for restricting access.
If all you need to do is make sure nothing else can read or modify the file while you've got your application locking it, the below should do the job.
If you need anything more, look into proper file encryption techniques.
Note that if you close the application the lock will no longer be in effect.
System.IO.FileStream fileStream;
private void LockFile(string FilePath)
{
fileStream = System.IO.File.Open(FilePath, System.IO.FileMode.Open, System.IO.FileAccess.ReadWrite, System.IO.FileShare.None);
//using System.IO.FileShare.None in the above line should be sufficient, but just to go the extra mile...
fileStream.Lock(0, fileStream.Length);
}
private void UnlockFile()
{
if (fileStream != null)
{
try { fileStream.Unlock(0, fileStream.Length); }
finally { fileStream.Dispose(); }
}
}
We're trying to generate an X509 certificate (including the private key) programmatically using C# and the BouncyCastle library. We've tried using some of the code from this sample by Felix Kollmann but the private key part of the certificate returns null. Code and unit test are as below:
using System;
using System.Collections;
using Org.BouncyCastle.Asn1;
using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Generators;
using Org.BouncyCastle.Crypto.Prng;
using Org.BouncyCastle.Math;
using Org.BouncyCastle.Security;
using Org.BouncyCastle.X509;
namespace MyApp
{
public class CertificateGenerator
{
/// <summary>
///
/// </summary>
/// <remarks>Based on <see cref="http://www.fkollmann.de/v2/post/Creating-certificates-using-BouncyCastle.aspx"/></remarks>
/// <param name="subjectName"></param>
/// <returns></returns>
public static byte[] GenerateCertificate(string subjectName)
{
var kpgen = new RsaKeyPairGenerator();
kpgen.Init(new KeyGenerationParameters(new SecureRandom(new CryptoApiRandomGenerator()), 1024));
var kp = kpgen.GenerateKeyPair();
var gen = new X509V3CertificateGenerator();
var certName = new X509Name("CN=" + subjectName);
var serialNo = BigInteger.ProbablePrime(120, new Random());
gen.SetSerialNumber(serialNo);
gen.SetSubjectDN(certName);
gen.SetIssuerDN(certName);
gen.SetNotAfter(DateTime.Now.AddYears(100));
gen.SetNotBefore(DateTime.Now.Subtract(new TimeSpan(7, 0, 0, 0)));
gen.SetSignatureAlgorithm("MD5WithRSA");
gen.SetPublicKey(kp.Public);
gen.AddExtension(
X509Extensions.AuthorityKeyIdentifier.Id,
false,
new AuthorityKeyIdentifier(
SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(kp.Public),
new GeneralNames(new GeneralName(certName)),
serialNo));
gen.AddExtension(
X509Extensions.ExtendedKeyUsage.Id,
false,
new ExtendedKeyUsage(new ArrayList() { new DerObjectIdentifier("1.3.6.1.5.5.7.3.1") }));
var newCert = gen.Generate(kp.Private);
return DotNetUtilities.ToX509Certificate(newCert).Export(System.Security.Cryptography.X509Certificates.X509ContentType.Pkcs12, "password");
}
}
}
Unit test:
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using Microsoft.VisualStudio.TestTools.UnitTesting;
namespace MyApp
{
[TestClass]
public class CertificateGeneratorTests
{
[TestMethod]
public void GenerateCertificate_Test_ValidCertificate()
{
// Arrange
string subjectName = "test";
// Act
byte[] actual = CertificateGenerator.GenerateCertificate(subjectName);
// Assert
var cert = new X509Certificate2(actual, "password");
Assert.AreEqual("CN=" + subjectName, cert.Subject);
Assert.IsInstanceOfType(cert.PrivateKey, typeof(RSACryptoServiceProvider));
}
}
}
Just to clarify, an X.509 certificate does not contain the private key. The word certificate is sometimes misused to represent the combination of the certificate and the private key, but they are two distinct entities. The whole point of using certificates is to send them more or less openly, without sending the private key, which must be kept secret. An X509Certificate2 object may have a private key associated with it (via its PrivateKey property), but that's only a convenience as part of the design of this class.
In your first BouncyCastle code example, newCert is really just the certificate and DotNetUtilities.ToX509Certificate(newCert) is built from the certificate only.
Considering that the PKCS#12 format requires the presence of a private key, I'm quite surprised that the following part even works (considering you're calling it on a certificate which can't possibly know the private key):
.Export(System.Security.Cryptography.X509Certificates.X509ContentType.Pkcs12,
"password");
(gen.Generate(kp.Private) signs the certificate using the private key, but doesn't put the private key in the certificate, which wouldn't make sense.)
If you want your method to return both the certificate and the private key you could either:
Return an X509Certificate2 object in which you've initialized the PrivateKey property
Build a PKCS#12 store and returns its byte[] content (as if it was a file). Step 3 in the link you've sent (mirror) explains how to build a PKCS#12 store.
Returning the byte[] (DER) structure for the X.509 certificate itself will not contain the private key.
If your main concern (according to your test case) is to check that the certificate was built from an RSA key-pair, you can check the type of its public key instead.
I realise this is an old post but I found these excellent articles which go through the process:
Using Bouncy Castle from .NET
I would like to embed some C# .Net code that does some simple Encryption/Decryption functions into a web page. This will be an internal web page so users will be implicitly trusted. Is there any way to do this? I will need to hit user's Windows-MY key store (via CAPI) to pull out the keys for decryption and hit an LDAP server to grab public keys for encryption.
You can use Silverlight.
Note, however, that you can do encryption in Javascript as well:
Javascript AES encryption
http://www.ohdave.com/rsa/
Define what you mean by "into a web page"? Web pages are run by browsers, which usually only know Javascript (and Java).
You could do it as a Silverlight application.
Silverlight or maybe a c# to JavaScript compiler, like Script#.
Consider writing a new ASP.NET application where your encryption/decryption logic lies within the application. Perhaps create a new webforms application with a page dedicated to fielding those requests.
Consider writing that encryption logic in a separate .NET assembly, and then reference that assembly from your ASP.NET application.
It's not clear whether you wanted this as a service, or whether users would be expecting to enter text in a textbox, and having it perform the encryption as they visit.
I ended up faking a COM object using C# then using JavaScript to call that COM object and was able to interact with the CAPI through the browser that way.
JavaScript:
<html>
<head>
<script language="javascript">
var keystore = new ActiveXObject("RBCrypto.KeyStore");
function getCertList()
{
try {
keystore.openKeyStore("MY", true, false);
var size = keystore.getStoreSize();
var list = document.getElementById('list');
list.size = size;
for(var i = 0; i < size; i++)
{
var fname = keystore.getFriendlyName(i, true);
var opt = new Option(fname, fname);
list.options.add(opt);
}
}
catch(err)
{
alert(err.description);
}
}
</script>
</head>
<body onload="getCertList()">
<center>
<h2>KeyStore Test</h2>
<hr />
<br />
<select id="list"></select>
</center>
</body>
</html>
C#:
using System;
using System.Runtime.InteropServices;
using System.Security;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
namespace RBCrypto
{
public interface AXInterface
{
void openKeyStore(string storeName, bool currentUser, bool readOnly);
int getStoreSize();
string getFriendlyName(int index, bool subjectNameIfEmpty);
}
[ClassInterface(ClassInterfaceType.AutoDual)]
public class KeyStore :AXInterface
{
public void openKeyStore(string storeName, bool currentUser, bool readOnly)
{
if (keystoreInitialized)
throw new Exception("Key Store must be closed before re-initialization");
try
{
if (currentUser) //user wants to open store used by the current user
certificateStore = new X509Store(storeName, StoreLocation.CurrentUser);
else //user wants to open store used by local machine
certificateStore = new X509Store(storeName, StoreLocation.LocalMachine);
if (readOnly)
certificateStore.Open(OpenFlags.ReadOnly);
else
certificateStore.Open(OpenFlags.ReadWrite);
allCertificates = certificateStore.Certificates;
if (allCertificates == null)
{
certificateStore.Close();
throw new NullReferenceException("Certificates could not be gathered");
}
keystoreInitialized = true;
}
catch (ArgumentException ae)
{
throw ae;
}
catch (SecurityException se)
{
throw se;
}
catch (CryptographicException ce)
{
throw ce;
}
catch (NullReferenceException ne)
{
throw ne;
}
}
....
}
}
C# AssemblyInfo:
// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(true)]
In order for this to work the user has to isntall your .dll on their machine (Make sure you specify to register your .dll as vsdraCOM in your installer) and they have to add your site to their trusted sites.
You could use AJAX and call the encryption function you've used over the network.