使用 X509 密钥的文件加密

Question

I've reached the end of my rope with this issue. Background: Implementing the ability to encrypted all file via steams from a NetCore API

The implementation passes every test I can throw at it under both NetFULL and NetCore. I've thrown hundreds of different file types from plain text, Word, Excel, PDF and every file encrypts and decrypts. However when called from the API from an Angular front end is where the process breaks down.

Investigation has found that it's during encryption that the file ends up being corrupted as when I replace the "encrypted" file from upload with another file encrypted from unit tests, the decrypt and download work flawlessly.

I'm using bouncy castle to perform the real work. Here is the methods I'm using to encrypt and decrypt. Any guidance would be helpful.

        public virtual void EncryptFileStream(Stream stream, X509Certificate2 encryptingCertificate, Stream encryptedStream)
    {
        if (!encryptingCertificate.HasPrivateKey || encryptingCertificate.PrivateKey == null)
        {
            throw new ArgumentException(nameof(encryptingCertificate) + " Does not have a private key");
        }
        if (!IsFileEncrypted(stream))
        {
            var dataGenerator = new CmsEnvelopedDataStreamGenerator();
            dataGenerator.AddKeyTransRecipient(DotNetUtilities.FromX509Certificate(encryptingCertificate));
            var cryptoStream = dataGenerator.Open(encryptedStream, CmsEnvelopedGenerator.Aes128Cbc);
            using (var fs = new BinaryWriter(cryptoStream))
            {
                stream.CopyTo(fs.BaseStream);
            }
            cryptoStream.Close();
        }
    }


        public virtual void DecryptFileStream(Stream encryptedStream, X509Certificate2 encryptingCertificate, Stream decryptedStream)
    {
        if (!encryptingCertificate.HasPrivateKey || encryptingCertificate.PrivateKey == null)
        {
            throw new ArgumentException(nameof(encryptingCertificate) + " Does not have a private key");
        }

        if (IsFileEncrypted(encryptedStream))
        {
            CmsEnvelopedDataParser ep = new CmsEnvelopedDataParser(encryptedStream);
            RecipientInformationStore recipients = ep.GetRecipientInfos();

            var cert = DotNetUtilities.FromX509Certificate(encryptingCertificate);
            var keyPair = DotNetUtilities.GetKeyPair(encryptingCertificate.PrivateKey);
            RecipientID recSel = new RecipientID
            {
                Issuer = PrincipalUtilities.GetIssuerX509Principal(cert), SerialNumber = cert.SerialNumber
            };

            RecipientInformation recipient = recipients.GetFirstRecipient(recSel);
            CmsTypedStream recData = recipient.GetContentStream(keyPair.Private);
            recData.ContentStream.CopyTo(decryptedStream);
        }
    }

Answer 1

the issue was that void IsFileEncrypted() was setting the stream position back to 0 after checking, however the position of the uploaded file in a Content-Disposition is not at 0, hence malforming the target file. The fix was to fix track the starting position of the steam than resetting the stream back to it's original position.

        public virtual bool IsFileEncrypted(Stream stream)
        {
            var currentStreamPosition = stream.Position;
            try
            {
                CmsEnvelopedDataParser ep = new CmsEnvelopedDataParser(stream);
                RecipientInformationStore recipients = ep.GetRecipientInfos();
                return recipients != null;
            }
            catch
            {
                return false;
            }
            finally
            {
                stream.Position = currentStreamPosition;
            }
        }