public static void VerifyIsX509(string oidValue, bool expectedValue)
{
var certBag = new Pkcs12CertBag(new Oid(oidValue), s_derNull);
if (expectedValue)
{
Assert.True(certBag.IsX509Certificate, "certBag.IsX509Certificate");
Assert.ThrowsAny <CryptographicException>(() => certBag.GetCertificate());
}
else
{
Assert.False(certBag.IsX509Certificate, "certBag.IsX509Certificate");
Assert.Throws <InvalidOperationException>(() => certBag.GetCertificate());
}
}
public static void DataNotValidatedInCtor()
{
using (X509Certificate2 cert = Certificates.RSAKeyTransferCapi1.GetCertificate())
{
var certBag = new Pkcs12CertBag(s_x509TypeOid, cert.RawData);
Assert.True(certBag.IsX509Certificate, "certBag.IsX509Certificate");
Assert.ThrowsAny <CryptographicException>(() => certBag.GetCertificate());
}
}
public static void CertificateReadsSuccessfully()
{
using (X509Certificate2 cert = Certificates.RSAKeyTransferCapi1.GetCertificate())
{
Pkcs12SafeContents contents = new Pkcs12SafeContents();
Pkcs12CertBag certBag = contents.AddCertificate(cert);
using (X509Certificate2 extracted = certBag.GetCertificate())
{
Assert.True(extracted.RawData.AsSpan().SequenceEqual(cert.RawData));
}
}
}
public static void ReadIndefiniteEncodingNoMac(int trailingByteCount)
{
ReadOnlyMemory <byte> source = PadContents(Pkcs12Documents.IndefiniteEncodingNoMac, trailingByteCount);
Pkcs12Info info = Pkcs12Info.Decode(
source,
out int bytesRead,
skipCopy: true);
Assert.Equal(Pkcs12Documents.IndefiniteEncodingNoMac.Length, bytesRead);
Assert.Equal(Pkcs12IntegrityMode.None, info.IntegrityMode);
ReadOnlyCollection <Pkcs12SafeContents> safes = info.AuthenticatedSafe;
Assert.Equal(2, safes.Count);
Pkcs12SafeContents firstSafe = safes[0];
Pkcs12SafeContents secondSafe = safes[1];
Assert.Equal(Pkcs12ConfidentialityMode.None, firstSafe.ConfidentialityMode);
Assert.Equal(Pkcs12ConfidentialityMode.None, secondSafe.ConfidentialityMode);
Assert.True(firstSafe.IsReadOnly, "firstSafe.IsReadOnly");
Assert.True(secondSafe.IsReadOnly, "secondSafe.IsReadOnly");
Pkcs12SafeBag[] firstContents = firstSafe.GetBags().ToArray();
Pkcs12SafeBag[] secondContents = secondSafe.GetBags().ToArray();
Assert.Equal(1, firstContents.Length);
Assert.Equal(1, secondContents.Length);
Pkcs12KeyBag keyBag = Assert.IsType <Pkcs12KeyBag>(firstContents[0]);
Pkcs12CertBag certBag = Assert.IsType <Pkcs12CertBag>(secondContents[0]);
CryptographicAttributeObjectCollection keyBagAttrs = keyBag.Attributes;
CryptographicAttributeObjectCollection certBagAttrs = certBag.Attributes;
Assert.Equal(2, keyBagAttrs.Count);
Assert.Equal(2, certBagAttrs.Count);
Assert.Equal(Oids.FriendlyName, keyBagAttrs[0].Oid.Value);
Assert.Equal(1, keyBagAttrs[0].Values.Count);
Assert.Equal(Oids.LocalKeyId, keyBagAttrs[1].Oid.Value);
Assert.Equal(1, keyBagAttrs[1].Values.Count);
Pkcs9AttributeObject keyFriendlyName =
Assert.IsAssignableFrom <Pkcs9AttributeObject>(keyBagAttrs[0].Values[0]);
Pkcs9LocalKeyId keyKeyId = Assert.IsType <Pkcs9LocalKeyId>(keyBagAttrs[1].Values[0]);
Assert.Equal(Oids.FriendlyName, certBagAttrs[0].Oid.Value);
Assert.Equal(1, certBagAttrs[0].Values.Count);
Assert.Equal(Oids.LocalKeyId, certBagAttrs[1].Oid.Value);
Assert.Equal(1, certBagAttrs[1].Values.Count);
Pkcs9AttributeObject certFriendlyName =
Assert.IsAssignableFrom <Pkcs9AttributeObject>(certBagAttrs[0].Values[0]);
Pkcs9LocalKeyId certKeyId = Assert.IsType <Pkcs9LocalKeyId>(certBagAttrs[1].Values[0]);
// This PFX gave a friendlyName value of "cert" to both the key and the cert.
Assert.Equal("1E080063006500720074", keyFriendlyName.RawData.ByteArrayToHex());
Assert.Equal(keyFriendlyName.RawData, certFriendlyName.RawData);
// The private key (KeyBag) and the public key (CertBag) are matched from their keyId value.
Assert.Equal("0414EDF3D122CF623CF0CFC9CD226261E8415A83E630", keyKeyId.RawData.ByteArrayToHex());
Assert.Equal("EDF3D122CF623CF0CFC9CD226261E8415A83E630", keyKeyId.KeyId.ByteArrayToHex());
Assert.Equal(keyKeyId.RawData, certKeyId.RawData);
using (X509Certificate2 cert = certBag.GetCertificate())
using (RSA privateKey = RSA.Create())
using (RSA publicKey = cert.GetRSAPublicKey())
{
privateKey.ImportPkcs8PrivateKey(keyBag.Pkcs8PrivateKey.Span, out _);
Assert.Equal(
publicKey.ExportSubjectPublicKeyInfo().ByteArrayToHex(),
privateKey.ExportSubjectPublicKeyInfo().ByteArrayToHex());
}
}
public static void Test1()
{
var loader = (CertLoaderFromRawData)Certificates.RSAKeyTransferCapi1;
ReadOnlyMemory <byte> pfxData = loader.PfxData;
Pkcs12Info info = Pkcs12Info.Decode(pfxData, out int bytesConsumed);
Assert.Equal(pfxData.Length, bytesConsumed);
Assert.Equal(Pkcs12IntegrityMode.Password, info.IntegrityMode);
CheckMac(info, loader.Password);
ReadOnlyCollection <Pkcs12SafeContents> authSafe = info.AuthenticatedSafe;
Assert.Same(authSafe, info.AuthenticatedSafe);
Assert.Equal(2, authSafe.Count);
Assert.Equal(Pkcs12ConfidentialityMode.None, authSafe[0].ConfidentialityMode);
Assert.Equal(Pkcs12ConfidentialityMode.None, authSafe[1].ConfidentialityMode);
List <Pkcs12SafeBag> safe0Bags = new List <Pkcs12SafeBag>(authSafe[0].GetBags());
Assert.Equal(1, safe0Bags.Count);
Pkcs12ShroudedKeyBag shroudedKeyBag = Assert.IsType <Pkcs12ShroudedKeyBag>(safe0Bags[0]);
CryptographicAttributeObjectCollection keyBagAttrs = shroudedKeyBag.Attributes;
Assert.Same(keyBagAttrs, shroudedKeyBag.Attributes);
Assert.Equal(2, keyBagAttrs.Count);
Assert.Equal(Oids.LocalKeyId, keyBagAttrs[0].Oid.Value);
Assert.Equal(1, keyBagAttrs[0].Values.Count);
Pkcs9LocalKeyId keyKeyId = Assert.IsType <Pkcs9LocalKeyId>(keyBagAttrs[0].Values[0]);
Assert.Equal("1.3.6.1.4.1.311.17.1", keyBagAttrs[1].Oid.Value);
Assert.Equal(1, keyBagAttrs[1].Values.Count);
Pkcs9AttributeObject cspNameAttr = Assert.IsType <Pkcs9AttributeObject>(keyBagAttrs[1].Values[0]);
byte[] cspNameBytes = Encoding.BigEndianUnicode.GetBytes("Microsoft Strong Cryptographic Provider");
Assert.Equal(
$"1E{cspNameBytes.Length:X2}{cspNameBytes.ByteArrayToHex()}",
cspNameAttr.RawData.ByteArrayToHex());
List <Pkcs12SafeBag> safe1Bags = new List <Pkcs12SafeBag>(authSafe[1].GetBags());
Assert.Equal(1, safe0Bags.Count);
Assert.IsType <Pkcs12CertBag>(safe1Bags[0]);
Pkcs12CertBag certBag = (Pkcs12CertBag)safe1Bags[0];
Assert.True(certBag.IsX509Certificate, "certBag.IsX509Certificate");
Assert.InRange(certBag.EncodedCertificate.Length, loader.CerData.Length + 2, int.MaxValue);
CryptographicAttributeObjectCollection certBagAttrs = certBag.Attributes;
Assert.Same(certBagAttrs, certBag.Attributes);
Assert.Equal(1, certBagAttrs.Count);
Assert.Equal(Oids.LocalKeyId, certBagAttrs[0].Oid.Value);
Assert.Equal(1, certBagAttrs[0].Values.Count);
Pkcs9LocalKeyId certKeyId = Assert.IsType <Pkcs9LocalKeyId>(certBagAttrs[0].Values[0]);
Assert.Equal(keyKeyId.KeyId.ByteArrayToHex(), certKeyId.KeyId.ByteArrayToHex());
byte[] data = { 9, 8, 7, 6, 5, 4, 3, 2, 1 };
byte[] encrypted;
using (X509Certificate2 fromLoader = loader.GetCertificate())
using (X509Certificate2 fromBag = certBag.GetCertificate())
using (RSA loaderPub = fromLoader.GetRSAPublicKey())
{
Assert.Equal(fromLoader.RawData, fromBag.RawData);
encrypted = loaderPub.Encrypt(data, RSAEncryptionPadding.OaepSHA1);
}
int bytesRead;
using (RSA rsa = RSA.Create())
{
rsa.ImportEncryptedPkcs8PrivateKey(
loader.Password,
shroudedKeyBag.EncryptedPkcs8PrivateKey.Span,
out bytesRead);
byte[] dec = rsa.Decrypt(encrypted, RSAEncryptionPadding.OaepSHA1);
Assert.Equal(data, dec);
}
Assert.Equal(shroudedKeyBag.EncryptedPkcs8PrivateKey.Length, bytesRead);
}
public static void ReadWithEncryptedContents()
{
var loader = (CertLoaderFromRawData)Certificates.RSAKeyTransfer_ExplicitSki;
ReadOnlyMemory <byte> pfxData = loader.PfxData;
Pkcs12Info info = Pkcs12Info.Decode(pfxData, out int bytesConsumed);
Assert.Equal(pfxData.Length, bytesConsumed);
Assert.Equal(Pkcs12IntegrityMode.Password, info.IntegrityMode);
CheckMac(info, loader.Password);
ReadOnlyCollection <Pkcs12SafeContents> authSafe = info.AuthenticatedSafe;
Assert.Same(authSafe, info.AuthenticatedSafe);
Assert.Equal(2, authSafe.Count);
Assert.Equal(Pkcs12ConfidentialityMode.Password, authSafe[0].ConfidentialityMode);
Assert.Equal(Pkcs12ConfidentialityMode.None, authSafe[1].ConfidentialityMode);
Assert.ThrowsAny <CryptographicException>(
() => authSafe[0].Decrypt(loader.Password.AsSpan().Slice(1)));
Assert.Equal(Pkcs12ConfidentialityMode.Password, authSafe[0].ConfidentialityMode);
authSafe[0].Decrypt(loader.Password);
Assert.Equal(Pkcs12ConfidentialityMode.None, authSafe[0].ConfidentialityMode);
List <Pkcs12SafeBag> safe0Bags = new List <Pkcs12SafeBag>(authSafe[0].GetBags());
Assert.Equal(1, safe0Bags.Count);
Pkcs12CertBag certBag = Assert.IsType <Pkcs12CertBag>(safe0Bags[0]);
Assert.True(certBag.IsX509Certificate, "certBag.IsX509Certificate");
Assert.InRange(certBag.EncodedCertificate.Length, loader.CerData.Length + 2, int.MaxValue);
List <Pkcs12SafeBag> safe1Bags = new List <Pkcs12SafeBag>(authSafe[1].GetBags());
Assert.Equal(1, safe0Bags.Count);
Pkcs12ShroudedKeyBag shroudedKeyBag = Assert.IsType <Pkcs12ShroudedKeyBag>(safe1Bags[0]);
byte[] data = { 9, 8, 7, 6, 5, 4, 3, 2, 1 };
byte[] encrypted;
using (X509Certificate2 fromLoader = loader.GetCertificate())
using (X509Certificate2 fromBag = certBag.GetCertificate())
using (RSA loaderPub = fromLoader.GetRSAPublicKey())
{
Assert.Equal(fromLoader.RawData, fromBag.RawData);
encrypted = loaderPub.Encrypt(data, RSAEncryptionPadding.OaepSHA1);
}
int bytesRead;
using (RSA rsa = RSA.Create())
{
rsa.ImportEncryptedPkcs8PrivateKey(
loader.Password,
shroudedKeyBag.EncryptedPkcs8PrivateKey.Span,
out bytesRead);
byte[] dec = rsa.Decrypt(encrypted, RSAEncryptionPadding.OaepSHA1);
Assert.Equal(data, dec);
}
Assert.Equal(shroudedKeyBag.EncryptedPkcs8PrivateKey.Length, bytesRead);
}
