Encrypting with Certificates

.NET provides us with several algorithm implementations to perform encryption and decryption. Next you can see an easy way to make use of a certificate to encrypt / decrypt using the RSACryptoServiceProvider

The first thing we need to do is to create a test certificate, this can be done by using the tool makecert. Just open the VS 2005 command prompt and type the next line:

makecert -n CN=Test -pe -ss My -sr LocalMachine

The command above will create a certificate called "Test" and will install it in the "My" location (displayed as "Personal") of the Local Computer, the -pe will mark the private key as exportable.

You can see the test certificate you have created following the next steps:

1. Run the Microsoft Management Console (MMC) snap-in utility by running the command mmc from a command prompt.
2. On the File menu, click Add/Remove Snap-in.
3. In the dialog box that displays, click Add.
4. Under Snap-in, double-click Certificates.
5. Click Computer account to access the LocalMachine store, and then click Next.
6. Click Finish.
7. Click the Certificates node, Personal, Certificates and et voila, your certificate is there.

Now let's see how we can make use of the certificate.

        1: public static X509Certificate2 LoadCertificate(StoreName storeName, 

       2:         StoreLocation storeLocation, string certificateName)

       3: {

       4:     X509Store store = new X509Store(storeName, storeLocation);

       5:  

       6:     try

       7:     {

       8:         store.Open(OpenFlags.ReadOnly);

       9:  

        X509Certificate2Collection certificateCollection =

            store.Certificates.Find(X509FindType.FindBySubjectName, 

                                    certificateName, false);

  

        if (certificateCollection.Count > 0)

        {

            //  We ignore if there is more than one matching cert, 

            //  we just return the first one.

            return certificateCollection[0];

        }

        else

        {

            throw new ArgumentException("Certificate not found");

        }

    }

    finally

    {

        store.Close();

    }

}

  

public static byte[] Encrypt(byte[] plainData, bool fOAEP, 

                             X509Certificate2 certificate)

{

    if (plainData == null)

    {

        throw new ArgumentNullException("plainData");

    }

    if (certificate == null)

    {

        throw new ArgumentNullException("certificate");

    }

  

    using (RSACryptoServiceProvider provider = new RSACryptoServiceProvider())

    {

        // Note that we use the public key to encrypt

        provider.FromXmlString(GetPublicKey(certificate));

  

        return provider.Encrypt(plainData, fOAEP);

    }

}

  

public static byte[] Decrypt(byte[] encryptedData, bool fOAEP, 

                             X509Certificate2 certificate)

{

    if (encryptedData == null)

    {

        throw new ArgumentNullException("encryptedData");

    }

    if (certificate == null)

    {

        throw new ArgumentNullException("certificate");

    }

  

    using (RSACryptoServiceProvider provider = new RSACryptoServiceProvider())

    {

        // Note that we use the private key to decrypt

        provider.FromXmlString(GetXmlKeyPair(certificate));

  

        return provider.Decrypt(encryptedData, fOAEP);

    }

}

  

public static string GetPublicKey(X509Certificate2 certificate)

{

    if (certificate == null)

    {

        throw new ArgumentNullException("certificate");

    }

  

    return certificate.PublicKey.Key.ToXmlString(false);

}

  

public static string GetXmlKeyPair(X509Certificate2 certificate)

{

    if (certificate == null)

    {

        throw new ArgumentNullException("certificate");

    }

  

    if (!certificate.HasPrivateKey)

    {

        throw new ArgumentException("certificate does not have a private key");

    }

    else

    {

        return certificate.PrivateKey.ToXmlString(true);

    }

}

The code to use the above methods is very simple:

       1: X509Certificate2 cert = LoadCertificate(

       2:      System.Security.Cryptography.X509Certificates.StoreName.My,

       3:      System.Security.Cryptography.X509Certificates.StoreLocation.LocalMachine, "Test");

       4:  

       5: byte[] encoded = System.Text.UTF8Encoding.UTF8.GetBytes("Encrypt me");

       6:  

       7: byte[] encrypted = Encrypt(encoded, true, cert);

       8: byte[] decrypted = Decrypt(encrypted, true, cert);

       9:  

      10: System.Console.Out.WriteLine(System.Text.UTF8Encoding.UTF8.GetString(decrypted));