C# 如何使用C从安全令牌获取信息#
我需要使我的应用程序的用户能够使用他们的个人USB安全令牌签署他们的批准 我已经成功地签署了数据,但我还无法获得谁的代币用于签署数据的信息 以下是我目前掌握的代码:C# 如何使用C从安全令牌获取信息#,c#,sign,pki,C#,Sign,Pki,我需要使我的应用程序的用户能够使用他们的个人USB安全令牌签署他们的批准 我已经成功地签署了数据,但我还无法获得谁的代币用于签署数据的信息 以下是我目前掌握的代码: CspParameters csp = new CspParameters(1, "SafeNet RSA CSP"); csp.Flags = CspProviderFlags.UseDefaultKeyContainer; RSACryptoServiceProvider rsa =
CspParameters csp = new CspParameters(1, "SafeNet RSA CSP");
csp.Flags = CspProviderFlags.UseDefaultKeyContainer;
RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(csp);
// Create some data to sign.
byte[] data = new byte[] { 0, 1, 2, 3, 4, 5, 6, 7 };
Console.WriteLine("Data : " + BitConverter.ToString(data));
// Sign the data using the Smart Card CryptoGraphic Provider.
byte[] sig = rsa.SignData(data, "SHA1");
Console.WriteLine("Signature : " + BitConverter.ToString(sig));
令牌的信息中有一个名为“令牌名称”的字段。如何访问该字段以验证已使用哪个令牌签署批准
其他信息和更新:
- “令牌名称”始终与所有者的名称(拥有usb的用户)匹配 代币)
- 这似乎是不可能做到的,也许有一个web服务或 我需要打电话直接获取信息 来自认证机构
//Prompt the user with the list of certificates on the local store.
//The user have to select the certificate he wants to use for signing.
//Note: All certificates form the USB device are automatically copied to the local store as soon the device is plugged in.
X509Store store = new X509Store(StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly);
X509CertificateCollection certificates = X509Certificate2UI.SelectFromCollection(store.Certificates,
"Certificados conocidos",
"Por favor seleccione el certificado con el cual desea firmar",
X509SelectionFlag.SingleSelection
);
store.Close();
X509Certificate2 certificate = null;
if (certificates.Count != 0)
{
//The selected certificate
certificate = (X509Certificate2)certificates[0];
}
else
{
//The user didn't select a certificate
return "El usuario canceló la selección de un certificado";
}
//Check certificate's atributes to identify the type of certificate (censored)
if (certificate.Issuer != "CN=............................., OU=................., O=..., C=US")
{
//The selected certificate is not of the needed type
return "El certificado seleccionado no corresponde a un token ...";
}
//Check if the certificate is issued to the current user
if (!certificate.Subject.ToUpper().Contains(("E=" + pUserADLogin + "@censoreddomain.com").ToUpper()))
{
return "El certificado seleccionado no corresponde al usuario actual";
}
//Check if the token is currently plugged in
XmlDocument xmlDoc = new XmlDocument();
XmlElement element = xmlDoc.CreateElement("Content", SignedXml.XmlDsigNamespaceUrl.ToString());
element.InnerText = "comodin";
xmlDoc.AppendChild(element);
SignedXml signedXml = new SignedXml();
try
{
signedXml.SigningKey = certificate.PrivateKey;
}
catch
{
//USB Token is not plugged in
return "El token no se encuentra conectado al equipo";
}
DataObject dataObject = new DataObject();
dataObject.Data = xmlDoc.ChildNodes;
dataObject.Id = "CONTENT";
signedXml.AddObject(dataObject);
Reference reference = new Reference();
reference.Uri = "#CONTENT";
signedXml.AddReference(reference);
//Attempt to sign the data. The user will be prompted to enter his PIN
try
{
signedXml.ComputeSignature();
}
catch
{
//User didn't enter the correct PIN
return "Hubo un error confirmando la identidad del usuario";
}
//The user has signed with the correct token
return String.Format("El usuario {0} ha firmado exitosamente usando el token con serial {1}", pUserADLogin, certificate.SerialNumber);
资料来源:
(法语)
(英文)这可能是security.stachexchange.com的一个更大的问题?看起来您需要提取证书指纹,然后与所有可用证书指纹的数据库进行比较。可能是@oleksii之类的东西我没有模数数据库。我需要得到“令牌名”,并将其与当前的广告用户名进行比较。谢谢你的评论。我不太确定什么是令牌,它是私有RSA证书吗?我认为您根本无法在证书中嵌入此类信息。你需要一个你可以信任的第三方,即你的数据库,第三方要么承认这个指纹是鲍勃的私人证书,要么拒绝它。如果你将用户名嵌入到私有证书中,那么任何人都可以创建一个新的私有证书并声称自己是Bob。你怎么能相信呢?令牌名称是硬件独有的还是标准的一部分?很可能它的存储方式无法通过标准库获取。有另一种获取令牌名称的方法。您必须使用PKCS#11或CryptoAPI接口来检测插入了哪个tokane。这与基于证书使用者名称确定令牌名称的方法不同。