How to RSA Encrypt XmlFile in one program and decrypt in another?

Question

I have a requirement to encrypt/decrypt a whole XML file. I am using RSA like in this MSDN post but the issue is that I have to encrypt in one program, an Windows Form program and decrypt in a Windows Service. How will the Windows Service know the RSA key I generated in order to decrypt?

The encrypt/decrypt code is:

 public class EncryptDecrpt
    {
        public static void Encrypt(XmlDocument doc, string ElementToEncrypt, string EncryptionElementID, RSA Alg,
            string KeyName)
        {
            try
            {
                //Check the arguments
                if (doc == null)
                    throw new ArgumentNullException("doc");
                if (ElementToEncrypt == null)
                    throw new ArgumentNullException("ElementToEncrypt");
                if (EncryptionElementID == null)
                    throw new ArgumentNullException("EncryptionElementID");
                if (Alg == null)
                    throw new ArgumentNullException("Alg");
                if (KeyName == null)
                    throw new ArgumentNullException("KeyName");


                // Find the specified element in the XmlDocument object
                // and create a new XmlElement object
                XmlElement elementToEncrypt = doc.GetElementsByTagName(ElementToEncrypt)[0] as XmlElement;
                if (elementToEncrypt == null)
                    throw new XmlException("The specified element was not found");

                RijndaelManaged sessionKey = null;

                // Create a 256 bit Rijandel key
                sessionKey = new RijndaelManaged();
                sessionKey.KeySize = 256;

                EncryptedXml eXml = new EncryptedXml();

                byte[] encryptedElement = eXml.EncryptData(elementToEncrypt, sessionKey, false);

                // Construct an EncryptedData object and populate
                // it with the desired encryption information

                EncryptedData edElement = new EncryptedData();
                edElement.Type = EncryptedXml.XmlEncElementUrl;
                edElement.Id = EncryptionElementID;

                edElement.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES256Url);
                // Encrypt the session key and add it to an EncryptedKey element
                EncryptedKey ek = new EncryptedKey();

                byte[] encryptedKey = EncryptedXml.EncryptKey(sessionKey.Key, Alg, false);

                ek.CipherData = new CipherData(encryptedKey);

                ek.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncRSA15Url);

                DataReference dRef = new DataReference();

                // Specify the EncryptedData URI
                dRef.Uri = "#" + EncryptionElementID;

                ek.AddReference(dRef);

                edElement.KeyInfo.AddClause(new KeyInfoEncryptedKey(ek));

                KeyInfoName kin = new KeyInfoName();

                kin.Value = KeyName;

                ek.KeyInfo.AddClause(kin);

                edElement.CipherData.CipherValue = encryptedElement;

                // Replace the element from the original XmlDocument
                // object with the EncrytedData element
                EncryptedXml.ReplaceElement(elementToEncrypt, edElement, false);
            }
            catch (Exception e)
            {
                // rethrow the exception
                throw e;
            }

        }

        public static void Decrypt(XmlDocument Doc, RSA Alg, string KeyName)
        {
            // Check the arguments.   
            if (Doc == null)
                throw new ArgumentNullException("Doc");
            if (Alg == null)
                throw new ArgumentNullException("Alg");
            if (KeyName == null)
                throw new ArgumentNullException("KeyName");

            // Create a new EncryptedXml object.
            EncryptedXml exml = new EncryptedXml(Doc);

            // Add a key-name mapping. 
            // This method can only decrypt documents 
            // that present the specified key name.
            exml.AddKeyNameMapping(KeyName, Alg);

            // Decrypt the element.
            exml.DecryptDocument();

        }

    }

The code in the Windows Form program is:

 private void SaveForm()
        {
            try
            {
                string fileName = System.IO.Path.Combine(Application.StartupPath, "alphaService.xml");
                XDocument doc = new XDocument();
                XElement xml = new XElement("Info",
                    new XElement("DatabaseServerName", txtServerName.Text),
                    new XElement("DatabaseUserName", txtDatabaseUserName.Text),
                    new XElement("DatabasePassword", txtDatabasePassword.Text),
                    new XElement("ServiceAccount", txtAccount.Text),
                    new XElement("ServicePassword", txtServicePassword.Text),
                    new XElement("RegistrationCode", txtRegistrationCode.Text));

                doc.Add(xml);
                doc.Save(fileName);

                // Encrypt
                XmlDocument xmlDoc = new XmlDocument();
                xmlDoc.Load(fileName);
                // Create a new CspParameters object to specify
                // a key container
                CspParameters cspParams = new CspParameters();
                cspParams.KeyContainerName = "XML_ENC_RSA_KEY";

                RSACryptoServiceProvider rsaKey = new RSACryptoServiceProvider(cspParams);

                EncryptDecrpt.Encrypt(xmlDoc, "info", "EncryptedElement1", rsaKey, "rsaKey");

                xmlDoc.Save(fileName);

                MessageBox.Show(xmlDoc.OuterXml);

                EncryptDecrpt.Decrypt(xmlDoc, rsaKey, "rsaKey");

How will the Windows Service know the RSA key or how can I do this?

Answer 1

You need to share your public key between both of your applications. Just doing new RSACryptoServiceProvider() every time will generate new keys. I shared my keys in the project's app.config:

<applicationSettings>
    <YpurApp.Properties.Settings>
        <setting name="PublicKeyXml" serializeAs="String">
            <value>&lt;RSAKeyValue&gt;&lt;Modulus&gt;YOURMODULUS&lt;/Modulus&gt;&lt;Exponent&gt;YOUREXP&lt;/Exponent&gt;&lt;/RSAKeyValue&gt;</value>
        </setting>

The XML actually looks like this, once read in by the program:

<RSAKeyValue><Modulus>YOURMODULUS</Modulus><Exponent>YOUREXP</Exponent></RSAKeyValue>

Then you can use code like this to encrypt in the public application:

    private static byte[] Encrypt(byte[] bytes)
    {
        using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider())
        {
            rsa.FromXmlString(Properties.Settings.Default.PublicKeyXml);
            return rsa.Encrypt(bytes, true);
        }
    }

The private application should also have the matching PrivateKey, either hard coded or in the app.config. You would not want to share the private key with anything "public" that could use it to break your encryption. Data is decrypted using the private key like this:

    private static byte[] Decrypt(byte[] bytes)
    {
        using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider())
        {
            rsa.FromXmlString(Properties.Settings.Default.PrivateKeyXml);
            return rsa.Decrypt(bytes, true);
        }
    }

To generate the keys, do this:

        CspParameters cspParams = new CspParameters();
        cspParams.KeyContainerName = "XML_ENC_RSA_KEY";
        RSACryptoServiceProvider rsaKey = new RSACryptoServiceProvider(cspParams);
        string keyXML = rsaKey.ToXmlString(true);

This will contain the public and private keys. The public key is the <RSAKeyValue><Modulus></Modulus><Exponent></Exponent> part. The private key is the whole thing, including the <P></P><Q></Q><DP></DP><DQ></DQ><InverseQ></InverseQ><D></D>. Copy/Paste that string into your app.config, and split it into two options, PublicKey and PrivateKey as noted above. DO NOT INCLUDE THE PRIVATE KEY in the encrypting application's app.config.

Answer 2

PKI and key management are books in themselves. But it comes down to this: you create a key pair on the server that performs the decryption. Decryption requires the private key and you don't want to move the private key (except for backup purposes). You should do this only once in, say, 5 years.

Then you distribute the public key securily to the clients. You may do this by incorporating the key in your code - as long as you can trust the public key. The public key is then used to perform the encryption. Again, the distribution is normally performed once for each key pair.