在 C# 中，使用 x.509 证书对 xml 进行签名并检查签名

In C#, sign an xml with a x.509 certificate and check the signature

提问by willvv

I'm trying to sign an XML file using a x.509 certificate, I can use the private key to sign the document and then use the CheckSignature method (it has an overload that receives a certificate as parameter) to verify the signature.

我正在尝试使用 x.509 证书对 XML 文件进行签名，我可以使用私钥对文档进行签名，然后使用 CheckSignature 方法（它具有接收证书作为参数的重载）来验证签名。

The problem is that the user who validates the signature must have the certificate, my concern is, if the user has the certificate then he has access to the private key, and as I understand, this is private and should be available only to the user who signs.

问题是验证签名的用户必须拥有证书，我担心的是，如果用户拥有证书，那么他就可以访问私钥，据我所知，这是私有的，应该只对用户可用谁签字。

What am I missing?

我错过了什么？

Thanks for your help.

谢谢你的帮助。

回答by chris166

Any certificate has a public and a private part. You only send around the public part. Just open any SSL enabled website in your browser, click on the padlock symbol and have a look at their certificate.

任何证书都有公共部分和私有部分。你只发送公共部分。只需在浏览器中打开任何启用 SSL 的网站，单击挂锁符号并查看其证书。

回答by Cheeso

In .NET, If you get your X509 cert from a .pfx file, like this:

在 .NET 中，如果您从 .pfx 文件获得 X509 证书，如下所示：

 X509Certificate2 certificate = new X509Certificate2(certFile, pfxPassword);
 RSACryptoServiceProvider rsaCsp = (RSACryptoServiceProvider) certificate.PrivateKey;   

Then you can export the public key portion like so:

然后你可以像这样导出公钥部分：

 rsaCsp.ToXmlString(false);

The "false" part says, only export the public piece, don't export the private piece. (doc for RSA.ToXmlString)

“假”部分说，只导出公共片，不导出私人片。（RSA.ToXmlString 的文档）

And then in the verifying application, use

然后在验证应用程序中，使用

 RSACryptoServiceProvider csp = new RSACryptoServiceProvider();
 csp.FromXmlString(PublicKeyXml);
 bool isValid = VerifyXml(xmlDoc, rsa2);

And the VerifyXml calls CheckSignature(). It looks something like this:

并且 VerifyXml 调用CheckSignature(). 它看起来像这样：

private Boolean VerifyXml(XmlDocument Doc, RSA Key)
{
    // Create a new SignedXml object and pass it
    // the XML document class.
    var signedXml = new System.Security.Cryptography.Xml.SignedXml(Doc);

    // Find the "Signature" node and create a new XmlNodeList object.
    XmlNodeList nodeList = Doc.GetElementsByTagName("Signature");

    // Throw an exception if no signature was found.
    if (nodeList.Count <= 0)
    {
        throw new CryptographicException("Verification failed: No Signature was found in the document.");
    }

    // Though it is possible to have multiple signatures on 
    // an XML document, this app only supports one signature for
    // the entire XML document.  Throw an exception 
    // if more than one signature was found.
    if (nodeList.Count >= 2)
    {
        throw new CryptographicException("Verification failed: More that one signature was found for the document.");
    }

    // Load the first <signature> node.  
    signedXml.LoadXml((XmlElement)nodeList[0]);

    // Check the signature and return the result.
    return signedXml.CheckSignature(Key);
}

回答by Raj kumar

First off all you need to be sure that the certificate .pfx or .cer that you are using is intended for signing purpose.

首先，您需要确保您使用的证书 .pfx 或 .cer 用于签名目的。

You can check same in General Tab of a certificate

*.Proves your identity to a remote computer
*.Protects e-mail messages
*.Allows data to be signed with the current time
*.Allows data on disk to be encrypted
*.2.16.356.100.2
**Document Signing**

A Complete console application to digitally sign/verify XmlDocument in C# is written here.

此处编写了一个完整的控制台应用程序，用于在 C# 中对 XmlDocument 进行数字签名/验证。