Sign string with private key X509 certificate

Question

I have an X509 certificate in current user storage (Windows 10). What is the simplest approach to verifying a signature in JavaScript which was generated by RSACryptoServiceProvider in C# / .NET? I already have the C# method:

public static string GetSign(string data, AsymmetricAlgorithm privateKey)
 {
            var rsa = (RSACryptoServiceProvider)privateKey;            
            TextWriter textWriter = new StringWriter();
            CertifycateKeyHelper.ExportPrivateKey(rsa, textWriter);
            RSACryptoServiceProvider rsaClear = new RSACryptoServiceProvider();
            rsaClear.ImportParameters(rsa.ExportParameters(true));
            var signature = rsaClear.SignData(Encoding.UTF8.GetBytes(data), 
               new SHA256CryptoServiceProvider());
            return BytesToHex(signature);
 }

Also, how can I go the other direction, generate an RSA SHA256 signature javascript and verify it in C# with an instance of RSACryptoServiceProvider ?

Answer 1

First of all, you need a library to parse an X.509 certificate. Then you need a way to validate and verify the certificate or to trust it explicitly (certificate pinning). If you cannot trust the certificate and the public key within it then verifying the signature is moot; it won't enable you to trust the data signed with it.

Parsing, validating and verifying an X.509 certificate is not an easy task, which means that you cannot do without a library. If you can pin the certificate then you can get away with just retrieving the public key from it. You could also extract the public key using different means and pin (ie store) the public key itself.

After you've trusted the certificate you can extract the public key from it and perform the signature verification. Note that the M$ documentation sucks and doesn't specify the signature generation algorithm. It uses PKCS#1 v1.5 padding.

---

For signature generation, you need to transfer the private key in a secure fashion, parse the private key and then perform the signature generation.

---

StackOverflow is not here to do the work for you so I just provided the steps you need to follow.