1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
|
//
// X509AsymmetricSecurityKey.cs
//
// Author:
// Atsushi Enomoto <atsushi@ximian.com>
//
// Copyright (C) 2005 Novell, Inc. http://www.novell.com
//
// Permission is hereby granted, free of charge, to any person obtaining
// a copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, sublicense, and/or sell copies of the Software, and to
// permit persons to whom the Software is furnished to do so, subject to
// the following conditions:
//
// The above copyright notice and this permission notice shall be
// included in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
//
using System;
using System.Collections.Generic;
using System.Xml;
using System.IdentityModel.Policy;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography.Xml;
namespace System.IdentityModel.Tokens
{
public class X509AsymmetricSecurityKey : AsymmetricSecurityKey
{
public X509AsymmetricSecurityKey (X509Certificate2 certificate)
{
if (certificate == null)
throw new ArgumentNullException ("certificate");
cert = certificate;
}
X509Certificate2 cert;
// AsymmetricSecurityKey implementation
public override AsymmetricAlgorithm GetAsymmetricAlgorithm (
string algorithm, bool privateKey)
{
if (algorithm == null)
throw new ArgumentNullException ("algorithm");
if (privateKey && !cert.HasPrivateKey)
throw new NotSupportedException ("The certificate does not contain a private key.");
AsymmetricAlgorithm alg = privateKey ?
cert.PrivateKey : cert.PublicKey.Key;
switch (algorithm) {
// case SignedXml.XmlDsigDSAUrl:
// if (alg is DSA)
// return alg;
// throw new NotSupportedException (String.Format ("The certificate does not contain DSA private key while '{0}' requires it.", algorithm));
case EncryptedXml.XmlEncRSA15Url:
case EncryptedXml.XmlEncRSAOAEPUrl:
case SignedXml.XmlDsigRSASHA1Url:
case SecurityAlgorithms.RsaSha256Signature:
if (alg is RSA)
return alg;
throw new NotSupportedException (String.Format ("The certificate does not contain RSA private key while '{0}' requires it.", algorithm));
}
throw new NotSupportedException (String.Format ("The asymmetric algorithm '{0}' is not supported.", algorithm));
}
public override HashAlgorithm GetHashAlgorithmForSignature (
string algorithm)
{
if (algorithm == null)
throw new ArgumentNullException ("algorithm");
switch (algorithm) {
//case SignedXml.XmlDsigDSAUrl: // it is documented as supported, but it isn't in reality and it wouldn't be possible.
case SignedXml.XmlDsigRSASHA1Url:
return new HMACSHA1 ();
case SecurityAlgorithms.RsaSha256Signature:
return new HMACSHA256 ();
default:
throw new NotSupportedException (String.Format ("'{0}' Hash algorithm is not supported in this security key.", algorithm));
}
}
[MonoTODO]
public override AsymmetricSignatureDeformatter GetSignatureDeformatter (string algorithm)
{
throw new NotImplementedException ();
}
[MonoTODO]
public override AsymmetricSignatureFormatter GetSignatureFormatter (string algorithm)
{
throw new NotImplementedException ();
}
public override bool HasPrivateKey ()
{
return cert.HasPrivateKey;
}
// SecurityKey implementation
public override int KeySize {
get { return cert.PublicKey.Key.KeySize; }
}
public override byte [] DecryptKey (string algorithm, byte [] keyData)
{
if (algorithm == null)
throw new ArgumentNullException ("algorithm");
if (keyData == null)
throw new ArgumentNullException ("keyData");
if (!HasPrivateKey ())
throw new NotSupportedException ("This X509 certificate does not contain private key.");
if (cert.PrivateKey.KeyExchangeAlgorithm == null)
throw new NotSupportedException ("The exchange algorithm of the X509 certificate private key is null");
switch (algorithm) {
case EncryptedXml.XmlEncRSA15Url:
case EncryptedXml.XmlEncRSAOAEPUrl:
break;
default:
throw new NotSupportedException (String.Format ("This X509 security key does not support specified algorithm '{0}'", algorithm));
}
bool useOAEP =
algorithm == EncryptedXml.XmlEncRSAOAEPUrl;
return EncryptedXml.DecryptKey (keyData, cert.PrivateKey as RSA, useOAEP);
}
public override byte [] EncryptKey (string algorithm, byte [] keyData)
{
if (algorithm == null)
throw new ArgumentNullException ("algorithm");
if (keyData == null)
throw new ArgumentNullException ("keyData");
switch (algorithm) {
case EncryptedXml.XmlEncRSA15Url:
case EncryptedXml.XmlEncRSAOAEPUrl:
break;
default:
throw new NotSupportedException (String.Format ("This X509 security key does not support specified algorithm '{0}'", algorithm));
}
bool useOAEP =
algorithm == EncryptedXml.XmlEncRSAOAEPUrl;
return EncryptedXml.EncryptKey (keyData, cert.PublicKey.Key as RSA, useOAEP);
}
public override bool IsAsymmetricAlgorithm (string algorithm)
{
return GetAlgorithmSupportType (algorithm) == AlgorithmSupportType.Asymmetric;
}
public override bool IsSupportedAlgorithm (string algorithm)
{
switch (algorithm) {
case SecurityAlgorithms.RsaV15KeyWrap:
case SecurityAlgorithms.RsaOaepKeyWrap:
case SecurityAlgorithms.RsaSha1Signature:
case SecurityAlgorithms.RsaSha256Signature:
return true;
default:
return false;
}
}
public override bool IsSymmetricAlgorithm (string algorithm)
{
return GetAlgorithmSupportType (algorithm) == AlgorithmSupportType.Symmetric;
}
}
}
|
