“向后” C# 中的公钥/私钥加密，我该如何处理？
我希望我的客户端应用程序能够解密服务器端生成的一些数据，但无法加密数据以便可以再次解密。
所以服务端可以加密和解密，客户端只能解密。
RSA 显然不能用于此目的，因为拥有私钥（用于解密）意味着您还必须拥有公钥。
我需要能够确保从服务器接收的数据确实来自服务器并且不是由第三方生成的。向客户端应用程序提供公钥意味着您无法执行此操作。
任何有关解决此问题的最佳方法的建议都将受到欢迎。
I want my client side application to be able to decrypt some data generated server side, but not be able to encrypt data such that it can decrypt it again.
So the server can encrypt and decrypt, client can only decrypt.
RSA can't be used for this obviously, as having the private key (to decrypt) means you have to also have the public key.
I need to be able to ensure that the data I'm receiving from the server really did come from the server and wasn't generated by a third party. Giving the client application the public key would mean you couldn't do this.
Any advise on the best way to approach this would be most welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
简单：您使用私钥加密，然后任何人都可以使用公钥解密。这是证书签名的基础。
通常，您只会加密哈希值，而不是整个数据块，因为这样速度更快。
RSAPKCS1SignatureFormatter构造函数CreateSignature方法Simple: You encrypt with the private key, then anyone can decrypt with the public key. This is the basis of certificate signing.
Normally you would encrypt only a hash, and not the entire data block, since this is faster.
RSAPKCS1SignatureFormatterconstructorCreateSignaturemethod创建两个 RSA 密钥对 - 一个 (A) 用于加密（并将私钥放入客户端应用程序），另一个 (B) 用于签名（私钥保存在服务器上）。现在，当您将数据发送到客户端时，使用密钥对 A 中的公钥对其进行加密，并使用密钥对 B 中的私钥对其进行签名。签名是通过对数据的哈希值计算加密签名来完成的（以使处理更容易，并且提高其速度）。由于非对称加密的速度非常低，通常不会对数据本身进行签名。
此过程是标准的，并且受所有 RSA 实现的支持（如果至少值一分钱的话）。如果您计划使用 X.509 证书，那么 PKCS#7（后来演变为 CMS 和 CAdES）标准是您的朋友。如果您使用普通的 RSA 密钥，那么您将需要发明自己的格式（但这并不是一个大麻烦）。
不过，需要考虑一件事：您将私钥传递给应用程序，这意味着用户也可以使用它，并且这样可能会泄漏数据。你考虑过这个副作用吗？
Create two RSA keypairs - one (A) for encryption (and put the private key to the client-side application) and another (B) for signing (private key is kept on the server). Now when you send the data to the client, encrypt it using the public key from keypair A and sign it using the private key from keypair B. Signing is done by calculating a cryptographic signature over the hash of the data (to make processing easier and increase it's speed). Signing is normally not done over the data itself due to very low speed of asymmetric cryptography.
This procedure is standard and is supported by all RSA implementations (if the are worth at least a penny). If you plan to use X.509 certificates, then PKCS#7 (later evolved to CMS and to CAdES) standard is your friend. If you go with plain RSA keys, then you will need to invent your own format (but that's not a big hassle).
There's one thing to consider though: you are passing the private key to the application, which means that it becomes available to the user as well and leakage of data is possible that way. Did you consider this side effect?