使用 RSA 公钥解密数据
首先，这不是拼写错误，我想使用公钥解密。这样做的目的是挑战第三方以确保他们确实拥有与公钥相对应的私钥。基本上，我会发送一些随机数据，他们会用私钥对其进行加密，我会使用公钥对其进行解密，并将解密的值与我发送的随机数据进行比较。我相信这是公钥加密中一个非常标准的过程，但由于某种原因，使用公钥解密似乎是禁忌。
我只是在 .NET 2.0 中使用RSACryptoServiceProvider。但是，当我调用 Decrypt 时，它会抛出 CryptographicException 并显示消息 Bad Key。密钥还不错（我可以毫无问题地加密），但它似乎不允许我仅使用公钥进行解密。什么给？这一定是可以做到的。
First off, that is not a typo, I want to decrypt using a public key. The purpose for doing this is to challenge a third party to ensure they do, in fact, have the private key that corresponds to the public key. Basically, I would send some random data, they would encrypt it with their private key, I would decrypt it using the public key and compare the decrypted value to the random data that I sent. I believe this is a pretty standard procedure in public key crypto but for some reason decrypting with a public key seems to be taboo.
I am simply using the RSACryptoServiceProvider in .NET 2.0. However, when I call Decrypt it throws a CryptographicException with message Bad Key. The key is not bad (I can Encrypt with no problem), but it appears as though it will not let me decrypt with just the public key. What gives? This must be possible to do.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为公认的条款是签字。他们使用私钥签名，而您使用公钥验证。我承认我不太了解低级数学，但我的理解是签名实际上只是用私钥加密。
使用RSACryptoServiceProvider 的签名和验证方法系列。事实上，SignHash 实际上是说“用私钥对其进行加密”。
I think the recognized term is signing. They sign with the private key, and you verify with the public key. I admit I don't understand the low-level math as well as I should, but my understanding is signing is really just encrypting with the private key.
Use
RSACryptoServiceProvider's sign and verify family of methods. In fact,SignHashactually says, "encrypting it with the private key."这些 .Net 类应该是加密 API 的包装器。
加密 API 中有两种类型的密钥。 加密 API 是 PKCS#11 的包装器。当您使用 Microsoft 加密服务提供商生成密钥对时，您将获得 AT_EXCHANGE 和 AT_SIGNATURE 密钥。每个密钥都是根据 PKCS#11 标准中定义的一些属性生成的..
AT_EXCHANGE 密钥属性：
包装/解开 = true
签名/验证 = true
加密/解密 = false
AT_SIGNATURE 密钥属性：
包装/解开 = false
签名/验证 = true
加密/decrypt = false
所以基本上，当您交换数据时，您实际上是在执行包装/解包功能。 Microsoft 将其称为 AT_EXCHANGE。这主要用于交换秘密/对称密钥，而不用于交换大量数据。
因此，您需要返回并找出您选择哪个密钥来签署/包装您的数据。
These .Net classes should be a wrapper of the crypto API.
There are two types of keys in crypto API. Crypto API is a wrapper around PKCS#11. When you generate a key pair using Microsoft cryptographic service provider, you get AT_EXCHANGE AND AT_SIGNATURE keys. Every key is generated based on some attributes defined in PKCS#11 standard..
AT_EXCHANGE keys Attributes:
wrap/unwrap = true
sign/verify = true
encrypt/decrypt = false
AT_SIGNATURE keys Attributes:
wrap/unwrap = false
sign/verify = true
encrypt/decrypt = false
So basically, when you are exchaning data, you are essentially performing a wrapping/unwrapping function. This is what Microsoft calls it as AT_EXCHANGE. This is primarily used to exchange secrete/symmetric keys and not used to echange huge amounts of data.
So you need to go back and find out which key you chose to EITHER sign / wrap your dat.
根据 Raj 的说法，您获得的钥匙可能没有标记为可交换。
询问提供公钥的一方如何生成它。如果使用 makecert.exe，则需要指定“-sky Exchange”。如果没有这个，您只能使用密钥进行签名和身份验证，而不能使用加密/解密，这是您在此处实现的用例。
Per Raj, the key you've been provided with probably isn't marked for exchange.
Ask the party who provided the public key how they generated it. If using makecert.exe, they'll need to specify "-sky Exchange". Without this, you can only use the key for signing and authentication, not encryption/decryption which is the use case you're implementing here.