RSA signing with Python verifying with C#

Question

I'm trying to sign message with RSA in Python and then verifying data in C#, but getting fail still after hours of testing/fighting.

Python code for signing:

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import serialization

message = b"Test string"

with open("id_rsa", "rb") as key_file:

    private_key = serialization.load_pem_private_key(
        key_file.read(),
        password=None,
    )

    signature = private_key.sign(
        message,
        padding.PKCS1v15(),
        hashes.SHA256()
    )

    signaturefile = open('signed.dat', 'wb')
    signaturefile.write(signature)
    signaturefile.close()
    
datafile = open('message.dat', 'wb')
datafile.write(message)
datafile.close()

And C# code for verifying:

private void button_Click(object sender, EventArgs e)
{
    byte[] data = File.ReadAllBytes("message.dat");
    byte[] signature = File.ReadAllBytes("signed.dat");

    try
    {
        using (var reader = File.OpenText("id_rsa.pub"))
        {
            var pem = new PemReader(reader);
            var o = (RsaKeyParameters)pem.ReadObject();
            using (var rsa = new RSACryptoServiceProvider())
            {
                var parameters = new RSAParameters();
                parameters.Modulus = o.Modulus.ToByteArray();
                parameters.Exponent = o.Exponent.ToByteArray();
                rsa.ImportParameters(parameters);

                bool ok = rsa.VerifyData(data, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

                if (ok) Console.WriteLine("Verified");
            }
        }
    }
    catch (CryptographicException exc)
    {
        Console.WriteLine(exc.Message);
    }
}

I'm getting always fail from rsa.VerifyData. Could someone point me what is the problem?

Same files can be verified well in Python.

Answer 1

RSAParameters#Modulus and RSAParameters#Exponent expect modulus and exponent unsigned , so Org.BouncyCastle.Math.BigInteger#ToByteArrayUnsigned() must be used instead of Org.BouncyCastle.Math.BigInteger#ToByteArray() . With this change, verification is successful.

Also, the big endian byte order is required, but this applies to both methods.

Note that System.Numerics.BigInteger#ToByteArray() returns the data signed with little endian order.

---

Your current approach uses BC for key import and built-in .NET methods for verification. Alternatively, BC classes can also be used for verification, making for a slightly more efficient implementation overall.

using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Security;
...
ISigner signer = SignerUtilities.GetSigner("SHA256withRSA");
signer.Init(false, o);
signer.BlockUpdate(data, 0, data.Length);
bool verified = signer.VerifySignature(signature);