Solved

How to validate digital signature using .NET 2.0

Posted on 2008-06-12
3
8,364 Views
Last Modified: 2013-12-17
I'm creating web application using .NET Framework 2.0. One of the requirements is that the data entered by user should be signed using certificate issued by CA, before is submitted for further processing. Certificate is chosen by the user from Certificate Store. For that purpose I use JavaScript and CAPICOM to sign the data. Everything is OK on that part. Data is signed and submitted to the server. On the server side I need to first validate the user certificate and then validate signature.
1. Using X509Chain I'm unable to validate certificate. ChainStatus return following statuses
PartialChain: A certificate chain could not be built to a trusted root authority.
RevocationStatusUnknown: The revocation function was unable to check revocation for the certificate.
OfflineRevocation: The revocation function was unable to check revocation because the revocation server was offline.
2. How to validate digiatal signature using System.Security.Cryptography classes. I tried using RSACryptoServiceProvider. Code sample is bellow.

Does enyone know where is my error, and what am I doing wrong?
Can someone give me URLs with this topic?


1)
X509Certificate2 aCertificate = new X509Certificate2(UnicodeEncoding.Unicode.GetBytes(Signature)); 
X509Chain chain = new X509Chain();
chain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain;
chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
chain.ChainPolicy.UrlRetrievalTimeout = new TimeSpan(0, 1, 0);
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
bool chainIsValid = chain.Build(aCertificate);
 
2)
byte[] data = Encoding.Unicode.GetBytes(Data); //original data
SHA1 sha = new SHA1CryptoServiceProvider();
byte[] hash = sha.ComputeHash(data);
RSACryptoServiceProvider RSAP = (RSACryptoServiceProvider)aCert.PublicKey.Key; 
//aCert is X509Certificate2 from code above
RSAPKCS1SignatureDeformatter RSADeformatter = new RSAPKCS1SignatureDeformatter(RSAP);
RSADeformatter.SetHashAlgorithm("SHA1");
if (RSADeformatter.VerifySignature(hash, sig))
{
    return true;
}
else
{
    return false;
}

Open in new window

0
Comment
Question by:re-aktiv
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 8

Accepted Solution

by:
the_crazed earned 500 total points
ID: 21874036
I know its a bit lame, but we use CAPICOM through interop.
we coudn't get the RSAPKCS1SignatureDeformatter to verify our capicom sigs either, its too hard to guess what CAPICOM does under the hood.
here is our verification code:
using CAPICOM;
 
'..........
 
		public static bool VerifyTheSignedString(string strSignedData, string strRawData, out SignedDataClass objSignedData, bool blnDetatchedSignature, out string strErrorReason)
		{
			bool blnRet = true;
			strErrorReason = "";
 
 
			objSignedData = new SignedDataClass();
			try
			{
				if (blnDetatchedSignature) objSignedData.Content = strRawData;
				objSignedData.Verify(strSignedData, blnDetatchedSignature,CAPICOM_SIGNED_DATA_VERIFY_FLAG.CAPICOM_VERIFY_SIGNATURE_AND_CERTIFICATE);
 
			}
			catch(Exception e)
			{
				blnRet = false;
				strErrorReason = e.Message;
 
			}
                            return blnRet;
}

Open in new window

0

Featured Post

Is Your DevOps Pipeline Leaking?

Is your CI/CD pipeline a hodge-podge of randomly connected tools? You’ve likely got a tool to fix one problem & then a different tool to fix another, resulting in a cluster of tools with overlapping functionality. Learn how to optimize your pipeline with Gartner's recommendations

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Developer tools in browsers have been around for a while, yet they are still heavily underused by developers. Developers still fix html or CSS then refresh page to see effect, or they put alert or debugger in JavaScript and then try again and again …
It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
Learn how to set-up custom confirmation messages to users who complete your Wufoo form. Include inputs from fields in your form, webpage redirects, and more with Wufoo’s confirmation options.
Learn how to set-up PayPal payment integration in your Wufoo form. Allow your users to remit payment through PayPal upon completion of your online form. This is helpful for collecting membership payments, customer payments, donations, and more.

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question