在Silverlight中访问X509Store

Question

I'm currently developing a Silverlight app in order to access the X509Store to sign data with a private key embedded into a USB Security Token.

I started from a C# application that works this way :

public byte[] SignData(byte[] HashTosign, string Cert_To_Use_b64)
{
    byte[] Signature = null;

    X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
    store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
    X509Certificate2Collection collection = (X509Certificate2Collection)store.Certificates;
    store.Close();

    try {
        foreach (X509Certificate2 Certificate in collection) {

            if (ToBase64(Certificate.RawData) == Cert_To_Use_b64) {

                RSACryptoServiceProvider Rsa = new RSACryptoServiceProvider();
                Rsa = (RSACryptoServiceProvider)Certificate.PrivateKey;

                try {
                    RSACryptoServiceProvider aesRsa = new RSACryptoServiceProvider();
                    string strPk = Certificate.PrivateKey.ToXmlString(true);
                    aesRsa.FromXmlString(strPk);
                    Signature = aesRsa.SignHash(HashTosign, CryptoConfig.MapNameToOID("SHA256"));


                } catch (Exception ex) {
                    Throw new exception("FAILURE : " + ex.Message());
                }


                lgSignature = Signature.Length;
                return 0;
            }
        }
    } catch (CryptographicException ex) {
        Throw new exception("FAILURE : " + ex.Message());
    } catch (Exception ex) {
        Throw new exception("FAILURE : " + ex.Message());
    }
}

That method works great in a C# application. But when I try to adapt it to Silverlight, the X509Store doesn't seem to be implemented.

The name “X509Store” does not exist in the namespace System.Security.Cryptography. Are you missing an assembly reference?

I tried to apply a .NET Framework DLL but I got the following error :

It is not possible to add a reference to System.Security.dll because it was not created with the Silverlight runtime. Silverlight projects only work with Silverlight assemblies.

Can I recreate the System.Security.dll assembly to Silverlight ? Or is there a better means to do what I want to do ?

Thanks in advance.

Answer 1

There are two possible ways to do what you want:

---

CryptoAPI via P/Invoke

My fist guess was to use native Windows library crypt32.dll (commonly known as CryptoApi). After all System.Security.dll is just a managed wrapper around it (browsing decompiled source with tool like ILSpy will show you how MS is wrapping it). You can use it in Silverlight with P/Invoke when running in elevated trust (Properties -> Silverlight -> Require elevated trust) and with administrator rights (to be able to open certificate store). However there are couple of drawbacks:

• It is rather unfriendly (brings me back old good C/C++ days)
• You need to operate on low level system structures and operations (like pointers)
• You will need to use this style for both certificate retrieval and signature computing

Documentation reference:

• MSDN CryptoApi

This way I managed to acquire handle (IntPtr pointer) to certificate enrolled on my smart card:

using System;
using System.Runtime.InteropServices;

namespace SilverlightX509Store
{
    public static class CapiNative
    {
        public const string MY = "MY";
        public const uint PKCS_7_ASN_ENCODING = 0x00010000;
        public const uint X509_ASN_ENCODING = 0x00000001;
        public const uint CERT_FIND_SUBJECT_STR = 0x00080007;
        public const int ACCESS_DENIED = 5;

        [DllImport("crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        public static extern IntPtr CertOpenSystemStore(
            IntPtr hCryptProv,
            string storename);

        [DllImport("crypt32.dll", SetLastError = true)]
        public static extern IntPtr CertFindCertificateInStore(
            IntPtr hCertStore,
            uint dwCertEncodingType,
            uint dwFindFlags,
            uint dwFindType,
            [In, MarshalAs(UnmanagedType.LPWStr)]String pszFindString,
            IntPtr pPrevCertCntxt);
    }

    public class CapiWrapper
    {
        public IntPtr FindCert(string subject)
        {
            IntPtr storeHandle = CapiNative.CertOpenSystemStore(
                IntPtr.Zero, 
                CapiNative.MY);

            if (Marshal.GetLastWin32Error() == CapiNative.ACCESS_DENIED)
            {
                return IntPtr.Zero;
            }

            IntPtr certHandle = CapiNative.CertFindCertificateInStore(
                storeHandle,
                CapiNative.PKCS_7_ASN_ENCODING | CapiNative.X509_ASN_ENCODING,
                0,
                CapiNative.CERT_FIND_SUBJECT_STR,
                "subject to find",
                IntPtr.Zero);

            return certHandle;
        }
    }
}

---

Converting .NET dll to Silverlight compliant

There seems to be a way to convert .NET library into SL. See article Reusing .NET Assemblies in Silverlight . I haven't tested it yet. Potential issue might be that .NET security end encryption is built in deep into mscorlib and System.Security and it might not be so easy to convert those libraries (or even not possible at all).