我想将 RSA 1024 私有-公共交换密钥对从 Machine-1 导出到 Machine-2。我在 XP 中使用 cryptoAPI。
在 Machine-1 中，我生成了密钥对。我封装了一个会话密钥，它实际上加密了一些真实数据。密钥容器名称是“PAIR1”。
在 Machine-2 中，我想用私钥（我在 Machine-1 中生成）解开会话密钥。为此，我想将密钥对从 Machine-1 导出到 Machine-2。
我知道导出持久密钥存在安全缺陷。
我尝试过什么？
我从 Machine_1 将密钥对导出为 PKCS#12 -pfx 文件。当我将其导入 Machine-2 时，密钥容器名称已从“PAIR1”更改为空。我的应用程序需要相同的容器名称才能在交换密钥对中选择正确的私钥。是否可以更改密钥容器名称？
这行得通吗？
用 Machine-2 的公钥包装交换密钥对并将其导入到 Machine-2。在这种情况下，您认为密钥容器名称将保持不变还是会发生变化？我觉得这可能是正确的做法。
编辑：
我问这个查询的原因是因为我用交换密钥对（公钥）包装了会话密钥，并将包装的密钥与加密的数据一起放入服务器的介质中。
该介质将绕过不同的客户端并返回到服务器。此时，我将使用解开的会话密钥解密我的数据。这个解包需要交换私钥。
我这样做是为了演示目的，我不能指望我们的营销人员执行密钥交换等。我们想向客户展示安全方面的内容，并减少与我们的营销人员设置的麻烦。
最后，我导出了密钥对，并在我想要的任何地方导入了相同的密钥对，尽管 Ramsus 方法是正确的方法。
I want to export a RSA 1024 private-public exchange key pair from Machine-1 to Machine-2. I am using cryptoAPI in XP.
In Machine-1, I generated the key pair. I wrapped a session key which actually encrypts some real data. The key container name is "PAIR1".
In Machine-2, I wanted to unwrap the session key with the private key(which I generated in Machine-1). For this purpose, I wanted to export the key pair from Machine-1 to Machine-2.
I am aware of security flaws of exporting the persistent keys.
What I have tried?
I exported the keypair as a PKCS#12 -pfx file from Machine_1. When i imported it to Machine-2, the key container name has changed from "PAIR1" to nothing. My application requires the same container name to pick the right private key in the exchange key pair. Is it possible to change the key container name?
Will this work?
Wrap the exchange key pair with Machine-2's public key and import it to Machine-2. In this case, do think, the key container name will remain the same or will it change? I feel that this might be the right approach.
Edited:
The reason I asked this query is because I wrapped a session key with an exchange key pair (public key) and put the wrapped key along with the encrypted data in a medium at the server.
This medium will go-around different clients and will come back to the server. At this point, I will be decrypting my data with the unwrapped session key. This unwrapping needs the exchange private key.
I am doing this for a demo purpose and I cannot expect our marketing guys to perform key exchange etc. We wanted to show the client the security aspects and reduce the hassle of setting up things with our marketing guys.
Finally I exported the key pair and imported the same where ever I wanted though Ramsus approach is the right way of doing it.
发布评论
评论（1）
执行此操作的正确方法是在 machine-2 上生成密钥对，仅导出公钥，将其传输到 machine-1 并使用它来包装会话密钥。
如何导出和导入 PKCS#12 文件？ Windows 通常会将密钥容器名称作为专有扩展添加到 PKCS#12 文件内，因此它应该与密钥对的其余部分一起传输。
The right way to do this, is to generate the keypair on machine-2, export the public key only, transport this to machine-1 and use it to wrap the session key.
How did you export and import the PKCS#12-file? Windows will usually add the key container name as a proprietary extension inside the PKCS#12-file, so it should have been transported together with the rest of the key pair.