嘗試使用C＃中的Win32 API執行Diffie Hellman密鑰交換

Question

我正在嘗試構建一些代碼，這些代碼將在舊的CAPI或新的基於CNG的Diffie-Hellman算法之間切換。

（盡管有文檔記錄，但作為CNG的一部分的新的基於ECC的DH算法在Windows XP上不受支持）。

無論如何，我已經開始公開Win32 CAPI，如下所示：

public static class CAPI
{
    private static int ALG_CLASS_KEY_EXCHANGE = 5 << 13;
    private static int ALG_TYPE_DH = 5 << 9;
    private static int ALG_SID_DH_EPHEM = 2;

    public static int CALG_DH_EPHEM = (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_DH_EPHEM);
    public static uint CRYPT_VERIFYCONTEXT = 0xF0000000;
    public static uint CRYPT_SILENT = 0x00000040;
    public static uint PROV_DSS_DH = 13;
    public static uint CRYPT_EXPORTABLE = 0x00000001;
    public static uint CRYPT_PREGEN = 0x00000040;
    public static uint KEY_SIZE = 0x00000400;

    public static string MS_ENH_DSS_DH_PROV = "Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider";

    [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    public static extern bool CryptAcquireContext(ref IntPtr hProv, string pszContainer, string pszProvider, uint dwProvType, uint dwFlags);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool CryptReleaseContext(IntPtr hProv, uint dwFlags);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool CryptGenKey(IntPtr hProv, int Algid, uint dwFlags, ref IntPtr phKey);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool CryptDestroyKey(IntPtr key);
}

我已經開始構建一個.NET DH類了：

public sealed class CAPIDiffieHellman : IDisposable
{
    private IntPtr _publicKeyPointer = new IntPtr();
    private IntPtr _hProv = new IntPtr();
    private uint _contextFlags = CAPI.CRYPT_VERIFYCONTEXT | CAPI.CRYPT_SILENT;
    private uint _keyGenerationFlags = CAPI.CRYPT_EXPORTABLE | CAPI.CRYPT_PREGEN;

    public CAPIDiffieHellman()
    {
        if (!CAPI.CryptAcquireContext(
            ref this._hProv,
            null,
            CAPI.MS_ENH_DSS_DH_PROV,
            CAPI.PROV_DSS_DH,
            this._contextFlags))
        {
            throw new ApplicationException(string.Format("Unable to acquire cryptographic context. Error Code: {0}", Marshal.GetLastWin32Error()));
        }
    }

    public byte[] GeneratePublicKey()
    {
        if (!CAPI.CryptGenKey(this._hProv, CAPI.CALG_DH_EPHEM, this._keyGenerationFlags, ref this._publicKeyPointer))
        {
            throw new ApplicationException(string.Format("Unable to generate cryptographic key. Error Code: {0}", Marshal.GetLastWin32Error()));
        }

        var publicKey = new byte[128];
        Marshal.Copy(this._publicKeyPointer, publicKey, 0, publicKey.Length);

        return publicKey;
    }

    public byte[] DerivePrivateKey(byte[] publicKey)
    {
        return null;
    }

    public void Dispose()
    {
        CAPI.CryptReleaseContext(this._hProv, 0);
        CAPI.CryptDestroyKey(this._publicKeyPointer);
    }
}

我正在使用此文檔

但是，我意識到我不確定我需要遵循的流程是什么; 我所謂的“公鑰”可能不是！

因此， 非常感謝有關如何使用CAPI執行DH密鑰交換的分步指南！

謝謝。

Answer 1

使用此方法通過傳遞對應的isPublicKey值來獲取公鑰或私鑰：

public static bool ExportCryptKey(IntPtr cryptKey, out byte[] outData, ref uint outDataSize, bool isPublicKey)
        {
            uint keyType = isPublicKey ? 0x6u : 0x7u;
            outData = null;
            if (!CryptExportKey(cryptKey, IntPtr.Zero, keyType, 0, null, ref outDataSize))
            {
                var err = Marshal.GetLastWin32Error();
                Debug.Print(new Win32Exception(err).Message);
                return false;
            }

            outData = new byte[outDataSize];

            if (!CryptExportKey(cryptKey, IntPtr.Zero, keyType, 0, outData, ref outDataSize))
                return false;

            return true;
        }