CryptographicException"密钥无法在指定状态下使用." 在尝试导出X509私钥的RSAParameters时

Question

我盯着这看了很长一段时间,感谢MSDN文档我无法弄清楚到底发生了什么.基本上我正在将光盘中的PF​​X文件加载到a中,X509Certificate2并尝试使用公钥加密字符串并使用私钥解密.

为什么我感到困惑:加密/解密在我将引用传递给RSACryptoServiceProvider自身时起作用:

byte[] ed1 = EncryptRSA("foo1", x.PublicKey.Key as RSACryptoServiceProvider);
string foo1 = DecryptRSA(ed1, x.PrivateKey as RSACryptoServiceProvider);

但如果出口和传递RSAParameter:

byte[] ed = EncryptRSA("foo", (x.PublicKey.Key as RSACryptoServiceProvider).ExportParameters(false));
string foo = DecryptRSA(ed, (x.PrivateKey as RSACryptoServiceProvider).ExportParameters(true));

...它会抛出"密钥无法在指定状态下使用".尝试将私钥导出到的异常RSAParameter.请注意,生成PFX的证书标记为可导出(即我在创建证书时使用了pe标志).知道导致异常的是什么吗？

 static void Main(string[] args)
    {
        X509Certificate2 x = new X509Certificate2(@"C:\temp\certs\1\test.pfx", "test");
        x.FriendlyName = "My test Cert";

        X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
        store.Open(OpenFlags.ReadWrite);
        try
        {
            store.Add(x);
        }
        finally
        {
            store.Close();
        }

        byte[] ed1 = EncryptRSA("foo1", x.PublicKey.Key as RSACryptoServiceProvider);
        string foo1 = DecryptRSA(ed1, x.PrivateKey as RSACryptoServiceProvider);

        byte[] ed = EncryptRSA("foo", (x.PublicKey.Key as RSACryptoServiceProvider).ExportParameters(false));
        string foo = DecryptRSA(ed, (x.PrivateKey as RSACryptoServiceProvider).ExportParameters(true));
    }

private static byte[] EncryptRSA(string data, RSAParameters rsaParameters)
{
    UnicodeEncoding bytConvertor = new UnicodeEncoding();
    byte[] plainData = bytConvertor.GetBytes(data);

    RSACryptoServiceProvider publicKey = new RSACryptoServiceProvider();
    publicKey.ImportParameters(rsaParameters);
    return publicKey.Encrypt(plainData, true);
}

private static string DecryptRSA(byte[] data, RSAParameters rsaParameters)
{
    UnicodeEncoding bytConvertor = new UnicodeEncoding();

    RSACryptoServiceProvider privateKey = new RSACryptoServiceProvider();
    privateKey.ImportParameters(rsaParameters);

    byte[] deData = privateKey.Decrypt(data, true);
    return bytConvertor.GetString(deData);
}

private static byte[] EncryptRSA(string data, RSACryptoServiceProvider publicKey)
{
    UnicodeEncoding bytConvertor = new UnicodeEncoding();
    byte[] plainData = bytConvertor.GetBytes(data);

    return publicKey.Encrypt(plainData, true);
}

private static string DecryptRSA(byte[] data, RSACryptoServiceProvider privateKey)
{
    UnicodeEncoding bytConvertor = new UnicodeEncoding();

    byte[] deData = privateKey.Decrypt(data, true);
    return bytConvertor.GetString(deData);
}

只是为了澄清上面的代码,粗体部分抛出: string foo = DecryptRSA(ed, (x.PrivateKey as RSACryptoServiceProvider)**.ExportParameters(true)**);

Answer 1

我认为问题可能是密钥没有标记为可导出.还有另一个构造函数X509Certificate2需要一个X509KeyStorageFlags枚举.尝试更换该行:

X509Certificate2 x = new X509Certificate2(@"C:\temp\certs\1\test.pfx", "test");

有了这个:

X509Certificate2 x = new X509Certificate2(@"C:\temp\certs\1\test.pfx", "test", X509KeyStorageFlags.Exportable);

Answer 2

对于我遇到的问题,代码更改不是一个选项,因为安装了相同的库并在其他地方工作.

铱星的回答让我看起来让密钥可以导出,我可以将其作为MMC证书导入向导的一部分.

希望这有助于其他人.谢谢堆

Answer 3

我遇到了一些类似的问题,并X509KeyStorageFlags.Exportable解决了我的问题.

Answer 4

我不完全是这些事情的专家，但我快速谷歌了一下，发现了这个：

http://social.msdn.microsoft.com/Forums/en/clr/thread/4e3ada0a-bcaf-4c67-bdef-a6b15f5bfdce

“如果传递给 RSACryptoServiceProvider.Encrypt(byte[] rgb, bool fOAEP) 方法的字节数组中的字节数超过 245 个字节，那么它将引发异常。”