C# 加密 XML 文件

C# Encrypt an XML File

提问by abmv

I need two methods one to encrypt and one to decrypt an xml file with a key= "hello world",the key hello world should be used to encrypt and decrypt the xml file.These methods should work on all machines!!! Any encryption methods will do. XML File contents below:

我需要两种方法，一种是加密，另一种是用 key="hello world" 解密 xml 文件，密钥 hello world 应该用于加密和解密 xml 文件。这些方法应该适用于所有机器！！！任何加密方法都可以。XML 文件内容如下：

<root>
    <lic>
        <number>19834209</number>
        <expiry>02/02/2002</expiry>
    </lic>
</root>

Can some give me a sample?The issue is the msdn sample encyptions make a xml file encypted but when I decrypt on another machine it doesn't work.For example

有人可以给我一个样本吗？问题是 msdn 样本加密使 xml 文件加密，但是当我在另一台机器上解密时它不起作用。例如

I tried this sample: How to: Encrypt XML Elements with Asymmetric Keys, but here there is some kinda session and on another machine it says bad data phewf!

我尝试了这个示例： 如何：使用非对称密钥加密 XML 元素，但这里有一些会话，在另一台机器上它说坏数据 phewf！

采纳答案by Kobi

If you want the same key for encrypting and decrypting you should use a symmetric method (that's the definition, really). Here's the closest one to your sample (same source). http://msdn.microsoft.com/en-us/library/sb7w85t6.aspx

如果您想要加密和解密相同的密钥，您应该使用对称方法（这就是定义，真的）。这是与您的样本最接近的一个（相同来源）。 http://msdn.microsoft.com/en-us/library/sb7w85t6.aspx

The posted sample isn't working because they aren't using the same keys. Not only on different machines: running the program on the same machine twice should not work either (didn't work for me), because they use different random keys every time.
try adding this code after creating your key:

发布的示例不起作用，因为它们没有使用相同的键。不仅在不同的机器上：在同一台机器上运行程序两次也不应该起作用（对我不起作用），因为它们每次都使用不同的随机密钥。
创建密钥后尝试添加此代码：

key = new RijndaelManaged();

string password = "Password1234"; //password here
byte[] saltBytes = Encoding.UTF8.GetBytes("Salt"); // salt here (another string)
var p = new Rfc2898DeriveBytes(password, saltBytes); //TODO: think about number of iterations (third parameter)
// sizes are devided by 8 because [ 1 byte = 8 bits ]
key.IV = p.GetBytes(key.BlockSize / 8);
key.Key = p.GetBytes(key.KeySize / 8);

Now the program is using the same key and initial vector, and Encrypt and Decrypt should work on all machines.
Also, consider renaming keyto algorithm, otherwise this is very misleading. I'd say it's a bad, not-working-well example from MSDN.

现在程序使用相同的密钥和初始向量，加密和解密应该适用于所有机器。
另外，请考虑重命名key为algorithm，否则这是非常具有误导性的。我会说这是来自 MSDN 的一个糟糕的、不工作的例子。

_{NOTE: PasswordDeriveBytes.GetBytes()has been deprecated because of serious (security) issues within the PasswordDeriveBytesclass. The code above has been rewritten to use the safer Rfc2898DeriveBytesclass instead (PBKDF2 instead of PBKDF1). Code generated with the above using PasswordDeriveBytesmay be compromised.}

_{注意：PasswordDeriveBytes.GetBytes()由于类中的严重（安全）问题已被弃用PasswordDeriveBytes。上面的代码已被重写为使用更安全的Rfc2898DeriveBytes类（PBKDF2 而不是 PBKDF1）。使用上述方法生成的代码PasswordDeriveBytes可能会受到损害。}

See also: Recommended # of iterations when using PKBDF2-SHA256?

另请参阅：使用 PKBDF2-SHA256 时推荐的迭代次数？

回答by sisve

Would be cooler if you used a private key to sign the <lic> element and added the result to the file (in a <hash> element perhaps). This would make it possibly for everyone to read the xml file in case your support needs to know the license number, or the date of expiry, but they can not change any values without the private key.

如果您使用私钥对 <lic> 元素进行签名并将结果添加到文件中（可能在 <hash> 元素中）会更酷。这将使每个人都可以阅读 xml 文件，以防您的支持人员需要知道许可证编号或到期日期，但他们无法在没有私钥的情况下更改任何值。

The public key needed to verify the signature would be common knowledge.

验证签名所需的公钥是常识。

Clarification
Signing your code will only protect it against changes, it will not keep any information in it hidden. Your original question mentions encryption, but I am not sure that it is a requirement to hide the data, or just protect it from modification.

说明
签署您的代码只会保护它免受更改，它不会隐藏其中的任何信息。您最初的问题提到了加密，但我不确定是否需要隐藏数据，或者只是保护数据不被修改。

Example code: (Never publish PrivateKey.key. ServerMethods are only needed when signing the xml file, ClientMethods are only needed when verifying the xml file.)

示例代码：（永远不要发布PrivateKey.key。ServerMethods只在xml文件签名时需要，ClientMethods只在xml文件校验时需要。）

using System;
using System.Diagnostics;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Xml;

public static class Program {
    public static void Main() {
        if (!File.Exists("PublicKey.key")) {
            // Assume first run, generate keys and sign document.
            ServerMethods.GenerateKeyPair();

            var input = new XmlDocument();
            input.Load("input.xml");
            Debug.Assert(input.DocumentElement != null);

            var licNode = input.DocumentElement["lic"];
            Debug.Assert(licNode != null);

            var licNodeXml = licNode.OuterXml;
            var signedNode = input.CreateElement("signature");
            signedNode.InnerText = ServerMethods.CalculateSignature(licNodeXml);
            input.DocumentElement.AppendChild(signedNode);

            input.Save("output.xml");
        }

        if (ClientMethods.IsValidLicense("output.xml")) {
            Console.WriteLine("VALID");
        } else {
            Console.WriteLine("INVALID");
        }
    }

    public static class ServerMethods {
        public static void GenerateKeyPair() {
            var rsa = SharedInformation.CryptoProvider;

            using (var keyWriter = File.CreateText("PublicKey.key"))
                keyWriter.Write(rsa.ToXmlString(false));

            using (var keyWriter = File.CreateText("PrivateKey.key"))
                keyWriter.Write(rsa.ToXmlString(true));
        }

        public static string CalculateSignature(string data) {
            var rsa = SharedInformation.CryptoProvider;
            rsa.FromXmlString(File.ReadAllText("PrivateKey.key"));

            var dataBytes = Encoding.UTF8.GetBytes(data);
            var signatureBytes = rsa.SignData(dataBytes, SharedInformation.HashAlgorithm);
            return Convert.ToBase64String(signatureBytes);
        }
    }

    public static class ClientMethods {
        public static bool IsValid(string data, string signature) {
            var rsa = SharedInformation.CryptoProvider;
            rsa.FromXmlString(File.ReadAllText("PublicKey.key"));

            var dataBytes = Encoding.UTF8.GetBytes(data);
            var signatureBytes = Convert.FromBase64String(signature);
            return rsa.VerifyData(dataBytes, SharedInformation.HashAlgorithm, signatureBytes);
        }

        public static bool IsValidLicense(string filename) {
            var doc = new XmlDocument();
            doc.Load(filename);

            var licNode = doc.SelectSingleNode("/root/lic") as XmlElement;
            var signatureNode = doc.SelectSingleNode("/root/signature") as XmlElement;
            if (licNode == null || signatureNode == null) return false;

            return IsValid(licNode.OuterXml, signatureNode.InnerText);
        }
    }

    public static class SharedInformation {
        public static int KeySize {
            get { return 1024; }
        }

        public static string HashAlgorithm {
            get { return "SHA512"; }
        }

        public static RSACryptoServiceProvider CryptoProvider {
            get { return new RSACryptoServiceProvider(KeySize, new CspParameters()); }
        }
    }
}

回答by Vilx-

First of all, if you want to use the same key for encrypting and decrypting, you should look at symmetric cryptography. Asymmetric cryptography is when the keys for encrypting and decrypting are different. Just so that you know - RSA is asymmetric, TripleDES and Rijndael are symmetric. There are others too, but .NET does not have default implementations for them.

首先，如果你想使用相同的密钥进行加密和解密，你应该看看对称密码学。非对称加密是指加密和解密的密钥不同。只是为了让您知道 - RSA 是非对称的，TripleDES 和 Rijndael 是对称的。还有其他的，但 .NET 没有它们的默认实现。

I'd advise studying the System.Security.Cryptography namespace. And learning a bit about all that stuff. It has all you need to encrypt and decrypt files, as well as generate a password. In particular, you might be interested in these classes:

我建议学习System.Security.Cryptography namespace. 并了解所有这些东西。它拥有加密和解密文件以及生成密码所需的一切。特别是，您可能对这些类感兴趣：

• CryptoStream
• PasswordDeriveBytes
• RijndaelManaged

• CryptoStream
• PasswordDeriveBytes
• RijndaelManaged

There are also examples for usage in MSDN for each of them. You can use these classes to encrypt any file, not just XML. If however you want to encrypt just a select few elements, you can take a look at System.Security.Cryptography.Xmlnamespace. I see you've already found one article about it. Keep following the links on that page and you will learn more about those classes.

在 MSDN 中也有使用示例。您可以使用这些类来加密任何文件，而不仅仅是 XML。但是，如果您只想加密选定的几个元素，则可以查看System.Security.Cryptography.Xml命名空间。我看到你已经找到了一篇关于它的文章。继续点击该页面上的链接，您将了解有关这些课程的更多信息。

回答by Eros

this is how you digitally sign and verify XML documents Sign XML Documents

这就是您对 XML 文档进行数字签名和验证的方式Sign XML Documents