Develop Reference

how to use p7b and p12 certificates

Hello my goal is it to encrypt the password of a zipfile. As for now I only had to generate a SHA Hash which will be my password and used the RSA-Cryptoprovider with me private key to encrypt the password.
Now I need to use .p7b and .p12 certificates to do this task.
But I dont understand what do I need those files for after some research I figured out that .p12 will be probably the file that I use to encrypt my password but what do I need .p7b for?
That is what I did so far with it, it seems to work because I can read the string but still what do I need my .p7b file for?
var password = #"test";
var p12FilePath = #"key\Test.p12";
var text = #"myFutureZipPassword";
X509Certificate2 cert = new X509Certificate2(p12FilePath, password, X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.Exportable);
byte[] certData = cert.Export(X509ContentType.Pfx, password);
RSACryptoServiceProvider rsaKey = (RSACryptoServiceProvider)cert.PrivateKey;
SHA1Managed sha1 = new SHA1Managed();
UnicodeEncoding encoding = new UnicodeEncoding();
byte[] data = encoding.GetBytes(text);
byte[] hash = sha1.ComputeHash(data);
var sign = rsaKey.SignHash(hash, CryptoConfig.MapNameToOID("SHA1"));
var str = System.Text.Encoding.Default.GetString(sign);

Neither p12 - the extension for PKCS#12 key/certificate stores - nor .p7b - the extension for PKCS#7 binary Cryptographic Message Syntax - is a certificate.
PKCS#12 can be used to store multiple private key / certificate chains (required to sign or decrypt) or just trusted certificates (used to verify or encrypt). Other information can be stored as well, but for your assignment you should just use it as key / certificate store.
The PKCS#7 standard specifies the Cryptographic Message Syntax or CMS. It specifies a container format which can be used to specify signed or enveloped (read: encrypted) messages / files. Whereas RSA by itself can encrypt small files, PKCS#7 allows you to use a well specified form of hybrid encryption.
The container format indicates and may contain the certificates used to perform the encryption so you can choose which key to use. It also specifies the algorithms used to perform the encryption. To use it you need a higher level API than RSACryptoServiceProvider; it is provided in the PKCS namespace within the .NET framework (start with EnvelopedCms). PKCS stands for Public Key Cryptography Standards, which were first created by RSA Labs and then copied and continued in RFC's.
The structure of PKCS#12 and PKCS#7 have been defined in a language that defines data structures called ASN.1. The structures are then encoded using a binary encoding format called BER / DER. However, to make sure that the messages are correctly transmitted over a text based interface, the PKCS#7 file is often ASCII armored using PEM text encoding, which is just basically a few header / footer lines with base 64 encoded binary in between. The b is there in the filename to show that the PEM encoding should not be performed.
Note that sometimes the PKCS#7 / CMS is also used to simply store certificates, which could be used for encryption as you only need the public key for that. However, it is much nicer to use PKCS#12 for that.

How to convert ObjectHandle from Pkcs11Interop to X509 Certificate or Pem format?

How to convert Public key from Pkcs11Interop to X509 certificate or pem format

If you want to extract RSA public key value then you need to read CKA_PUBLIC_EXPONENT and CKA_MODULUS attributes.

Get private key file with sha256 in C #

Currently I perform this operation through openssl, and I have had no problem with the generated file
openssl dgst -sha256 -sign privateKey.key -out file.txt.signature file.txt
Now, we want to automate the generation of the file using C #, but I have not been able to get the same result.
public class Program
{
static void Main(string[] args)
{
Console.WriteLine(CreateToken("key...", "text"));
Console.ReadLine();
}
public static string CreateToken(string key, string message)
{
System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
byte[] keyByte = encoding.GetBytes(key);
HMACSHA256 hmacsha256 = new HMACSHA256(keyByte);
byte[] messageBytes = encoding.GetBytes(message);
byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);
return System.Text.Encoding.UTF8.GetString(hashmessage);
}
}
I'm new to working with this, what would be the right way?
Am I not retrieving the information properly ?, Should I get the content directly from the file?
Thank you very much.

Signature generation is not the same thing as HMAC message authentication and it uses a different key. As HMAC can use a key of any size, it will probably take the private key, but that's not how it is supposed to work. RSA is an asymmetric algorithm that uses private and public keys, MAC uses symmetric, secret keys. The dgst -sign instead uses RSA PKCS#1 v1.5 padding to sign the file.
From the OpenSSL Wiki on dgst:
When signing a file, dgst will automatically determine the algorithm (RSA, ECC, etc) to use for signing based on the private key's ASN.1 info. When verifying signatures, it only handles the RSA, DSA, or ECDSA signature itself, not the related data to identify the signer and algorithm used in formats such as x.509, CMS, and S/MIME.
HMAC is not the same thing as SHA-256 either. RSA signature generation uses a hash, not a HMAC. You should use the SHA256 class to create a hash. HMAC is a message authentication code build using the SHA-256 hash. However, the SHA class is not needed as signature generation usually includes the hash generation (you sign a message, not a hash value).
So to create a signature, take a look at the RSAPKCS1SignatureFormatter class, it includes an example at the bottom. Try again using this example.
Make sure your message only contains ASCII (both in the text file as in your string) or your result may fail as well.

How can I import private key and use it to sign document in C#?

I've generate a self-signed certificates(X509 certificate) and want to use the private key to sign some document to make digital signature and I'm doing it in C#.
How can I import .pvk file? Do I need to import from key store?
And can I use this code to sign and create a digital signature?
RSACryptoServiceProvider RSA = new RSACryptoServiceProvider();
RSAPKCS1SignatureFormatter RSAFormatter = new RSAPKCS1SignatureFormatter(RSA);
RSAFormatter.SetHashAlgorithm("SHA1");
RSAFormatter.SetKey(cert.PrivateKey);
byte[] SignedHash = RSAFormatter.CreateSignature(data);

Try tho Initialize your RSA like this:
RSACryptoServiceProvider RSA = (RSACryptoServiceProvider)cert.PrivateKey;
To generate a signature I use rsa.SignData(data, "sha1");

First of all you need to determine, in what format the signature should be made. If you deal with certificates, most likely you will create PKCS#7 or CMS signature. There's a class in .NET for CMS signatures.
The next steps depend on whether you need certificate-based PKCS#7 signature or RSA (PKCS#1) signature.
Side note - putting several questions into one makes it hard to answer properly. Also most of your questions have lots of answers if you do the search.

How to read a private key from pvk file in C#?

I have to read a private key, and this key is on pvk format. I use X509Certificate2 class, but i this class i have only public key access.
How can I get a private key from pvk file?

Luiz, you need to combine the CER and PVK into a single PFX file, then import the file as a cert so that when you load the X509Cert the PrivateKey will be there. See Decrypt with PrivateKey X.509 Certificate.

http://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.x509certificate2.privatekey.aspx
How about this ?
Have in mind:
Currently this property supports only
RSA or DSA keys, so it returns either
an RSACryptoServiceProvider or a
DSACryptoServiceProvider object. If no
private key is associated with the
certificate, a null reference (Nothing
in Visual Basic) is returned

You can use this command to combine them.
pvk2pfx -spc CA.cer -pvk CA.pvk -pfx CA.pfx
Decrypt with PrivateKey X.509 Certificate