其他人说“SHA-512 不是加密”，但忽略了说你可以，以及你如何能，实际上用它加密。如果您使用的是 RSACryptoServiceProvider 和非对称加密，则加密需要公钥（用于加密）和私钥（用于解密），如下所示。由于您可以创建基于 SHA512 的散列密钥，因此您可以对它们进行加密/解密。对于做盐，你可能会看http://www.obviex.com/samples/EncryptionWithSalt.aspx。这里我就不多说了。
对于那些可能在下面抱怨这个答案并说“使用 PBKDF2”的人：
- 我不知道这是什么。不要期望每个开发人员都知道，以及如何像您一样轻松地实现它。
- 在我的工作环境中，我们有一个未连接到 Internet 的单独开发人员网络，因此如果我的组织无法获得、更新、使用和获得批准，它会使 3rd 方库和 NuGet 包之类的东西变得很痛苦查看项目使用的源代码。
并不是每个环境都会有这些限制——但对于专家来说：不要假设你有一个万能的解决方案。数据库连接的服务帐户密码以加密形式存在于我们的 web.config 和 app.config 文件中——这是我回答这个问题的角度。它们不能是域帐户，这将允许您执行 Integrated Security=SSPI 或 webService.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials; 之类的操作。不要假设这些只会在数据库中 - 大多数数据库实际上都有自己的加密算法来处理。对于某些连接和环境，开发者社区 - 克服自己！实际上，您可能必须提供密码并将其存储在某个地方才能让您的应用程序运行！猜猜 NIST 没有禁止这样做，或者它没有您可以满足的加密标准（鼓励使用 SHA512）来接听这个电话。
因此，我将整理我所做的一些研究，以展示您可以使用的几条路线，以了解如何使用使用 SHA-512 哈希创建的密钥来实现这一点，然后您可以对其进行加密/解密。您可以通过创建证书或让 RSACryptoServiceContainer 为您提供一个来生成 SHA-512 密钥。
证书方法
在命令行中使用这些行创建您的证书：
makecert -r -pe -n "CN=MyCertificate" -a sha512 -b 09/01/2016 -sky exchange C:\Temp\MyCertificate.cer -sv C:\Temp\MyCertificate.pvk
pvk2pfx.exe -pvk C:\Temp\MyCertificate.pvk -pi "MyP@ssw0rd" -spc C:\Temp\MyCertificate.cer -pfx C:\Temp\MyCertificate.pfx -po "MyP@ssw0rd"
然后将证书导入本地根权限存储并使用此代码：
string input = "test";
string output = string.Empty;
X509Store store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);
X509Certificate2Collection collection = store.Certificates.Find(X509FindType.FindBySubjectName, "MyCertificate", false);
X509Certificate2 certificate = collection[0];
using (RSACryptoServiceProvider cps = (RSACryptoServiceProvider)certificate.PublicKey.Key)
{
byte[] bytesData = Encoding.UTF8.GetBytes(input);
byte[] bytesEncrypted = cps.Encrypt(bytesData, false);
output = Convert.ToBase64String(bytesEncrypted);
}
store.Close();
参考：https://social.msdn.microsoft.com/Forums/en-US/69e39ad0-13c2-4b5e-bb1b-972a614813fd/encrypt-with-certificate-sha512?forum=csharpgeneral
使用 RSACryptoServiceProvider 生成密钥
private static string privateKey = String.Empty;
private static void generateKeys()
{
int dwLen = 2048;
RSACryptoServiceProvider csp = new RSACryptoServiceProvider(dwLen);
privateKey = csp.ToXmlString(true).Replace("><",">\r\n");
}
public static string Encrypt(string data2Encrypt)
{
try
{
generateKeys();
RSAx rsax = new RSAx(privateKey, 2048);
rsax.RSAxHashAlgorithm = RSAxParameters.RSAxHashAlgorithm.SHA512;
byte[] CT = rsax.Encrypt(Encoding.UTF8.GetBytes(data2Encrypt), false, true); // first bool is for using private key (false forces to use public), 2nd is for using OAEP
return Convert.ToBase64String(CT);
}
catch (Exception ex)
{
// handle exception
MessageBox.Show("Error during encryption: " + ex.Message);
return String.Empty;
}
}
public static string Decrypt(string data2Decrypt)
{
try
{
RSAx rsax = new RSAx(privateKey, 2048);
rsax.RSAxHashAlgorithm = RSAxParameters.RSAxHashAlgorithm.SHA512;
byte[] PT = rsax.Decrypt(Convert.FromBase64String(data2Decrypt), true, true); // first bool is for using private key, 2nd is for using OAEP
return Encoding.UTF8.GetString(PT);
}
catch (Exception ex)
{
// handle exception
MessageBox.Show("Error during encryption: " + ex.Message);
return String.Empty;
}
}
这些方法使用一个名为 RSAx.DLL 的 DLL，该 DLL 是使用 https://www.codeproject.com/Articles/421656/RSA-Library-with-Private-Key-Encryption-in-Csharp 的源代码构建的，这不是我的（作者：Arpan Jati），但我已经使用它并且它是可通过CodeProject's Open Source License 向开发者社区提供。您也可以只从该项目中引入 3 个类，而不是：RSAx.cs、RSAxParameters.cs、RSAxUtils.cs
代码会使这篇文章超过 30000 个字符的限制，所以我只发布 RSAx 以便您了解发生了什么，但所有 3 个类都是必需的。您必须更改命名空间并引用 System.Numerics 程序集。
RSAx.cs
// @Date : 15th July 2012
// @Author : Arpan Jati (arpan4017@yahoo.com; arpan4017@gmail.com)
// @Library : ArpanTECH.RSAx
// @CodeProject: http://www.codeproject.com/Articles/421656/RSA-Library-with-Private-Key-Encryption-in-Csharp
using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Numerics;
using System.Linq;
using System.Text;
using System.IO;
namespace ArpanTECH
{
/// <summary>
/// The main RSAx Class
/// </summary>
public class RSAx : IDisposable
{
private RSAxParameters rsaParams;
private RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
/// <summary>
/// Initialize the RSA class.
/// </summary>
/// <param name="rsaParams">Preallocated RSAxParameters containing the required keys.</param>
public RSAx(RSAxParameters rsaParams)
{
this.rsaParams = rsaParams;
UseCRTForPublicDecryption = true;
}
/// <summary>
/// Initialize the RSA class from a XML KeyInfo string.
/// </summary>
/// <param name="keyInfo">XML Containing Key Information</param>
/// <param name="ModulusSize">Length of RSA Modulus in bits.</param>
public RSAx(String keyInfo, int ModulusSize)
{
this.rsaParams = RSAxUtils.GetRSAxParameters(keyInfo, ModulusSize);
UseCRTForPublicDecryption = true;
}
/// <summary>
/// Hash Algorithm to be used for OAEP encoding.
/// </summary>
public RSAxParameters.RSAxHashAlgorithm RSAxHashAlgorithm
{
set
{
rsaParams.HashAlgorithm = value;
}
}
/// <summary>
/// If True, and if the parameters are available, uses CRT for private key decryption. (Much Faster)
/// </summary>
public bool UseCRTForPublicDecryption
{
get; set;
}
/// <summary>
/// Releases all the resources.
/// </summary>
public void Dispose()
{
rsaParams.Dispose();
}
#region PRIVATE FUNCTIONS
/// <summary>
/// Low level RSA Process function for use with private key.
/// Should never be used; Because without padding RSA is vulnerable to attacks. Use with caution.
/// </summary>
/// <param name="PlainText">Data to encrypt. Length must be less than Modulus size in octets.</param>
/// <param name="usePrivate">True to use Private key, else Public.</param>
/// <returns>Encrypted Data</returns>
public byte[] RSAProcess(byte[] PlainText, bool usePrivate)
{
if (usePrivate && (!rsaParams.Has_PRIVATE_Info))
{
throw new CryptographicException("RSA Process: Incomplete Private Key Info");
}
if ((usePrivate == false) && (!rsaParams.Has_PUBLIC_Info))
{
throw new CryptographicException("RSA Process: Incomplete Public Key Info");
}
BigInteger _E;
if (usePrivate)
_E = rsaParams.D;
else
_E = rsaParams.E;
BigInteger PT = RSAxUtils.OS2IP(PlainText, false);
BigInteger M = BigInteger.ModPow(PT, _E, rsaParams.N);
if (M.Sign == -1)
return RSAxUtils.I2OSP(M + rsaParams.N, rsaParams.OctetsInModulus, false);
else
return RSAxUtils.I2OSP(M, rsaParams.OctetsInModulus, false);
}
/// <summary>
/// Low level RSA Decryption function for use with private key. Uses CRT and is Much faster.
/// Should never be used; Because without padding RSA is vulnerable to attacks. Use with caution.
/// </summary>
/// <param name="Data">Data to encrypt. Length must be less than Modulus size in octets.</param>
/// <returns>Encrypted Data</returns>
public byte[] RSADecryptPrivateCRT(byte[] Data)
{
if (rsaParams.Has_PRIVATE_Info && rsaParams.HasCRTInfo)
{
BigInteger C = RSAxUtils.OS2IP(Data, false);
BigInteger M1 = BigInteger.ModPow(C, rsaParams.DP, rsaParams.P);
BigInteger M2 = BigInteger.ModPow(C, rsaParams.DQ, rsaParams.Q);
BigInteger H = ((M1 - M2) * rsaParams.InverseQ) % rsaParams.P;
BigInteger M = (M2 + (rsaParams.Q * H));
if (M.Sign == -1)
return RSAxUtils.I2OSP(M + rsaParams.N, rsaParams.OctetsInModulus, false);
else
return RSAxUtils.I2OSP(M, rsaParams.OctetsInModulus, false);
}
else
{
throw new CryptographicException("RSA Decrypt CRT: Incomplete Key Info");
}
}
private byte[] RSAProcessEncodePKCS(byte[] Message, bool usePrivate)
{
if (Message.Length > rsaParams.OctetsInModulus - 11)
{
throw new ArgumentException("Message too long.");
}
else
{
// RFC3447 : Page 24. [RSAES-PKCS1-V1_5-ENCRYPT ((n, e), M)]
// EM = 0x00 || 0x02 || PS || 0x00 || Msg
List<byte> PCKSv15_Msg = new List<byte>();
PCKSv15_Msg.Add(0x00);
PCKSv15_Msg.Add(0x02);
int PaddingLength = rsaParams.OctetsInModulus - Message.Length - 3;
byte[] PS = new byte[PaddingLength];
rng.GetNonZeroBytes(PS);
PCKSv15_Msg.AddRange(PS);
PCKSv15_Msg.Add(0x00);
PCKSv15_Msg.AddRange(Message);
return RSAProcess(PCKSv15_Msg.ToArray() , usePrivate);
}
}
/// <summary>
/// Mask Generation Function
/// </summary>
/// <param name="Z">Initial pseudorandom Seed.</param>
/// <param name="l">Length of output required.</param>
/// <returns></returns>
private byte[] MGF(byte[] Z, int l)
{
if (l > (Math.Pow(2, 32)))
{
throw new ArgumentException("Mask too long.");
}
else
{
List<byte> result = new List<byte>();
for (int i = 0; i <= l / rsaParams.hLen; i++)
{
List<byte> data = new List<byte>();
data.AddRange(Z);
data.AddRange(RSAxUtils.I2OSP(i, 4, false));
result.AddRange(rsaParams.ComputeHash(data.ToArray()));
}
if (l <= result.Count)
{
return result.GetRange(0, l).ToArray();
}
else
{
throw new ArgumentException("Invalid Mask Length.");
}
}
}
private byte[] RSAProcessEncodeOAEP(byte[] M, byte[] P, bool usePrivate)
{
// +----------+---------+-------+
// DB = | lHash | PS | M |
// +----------+---------+-------+
// |
// +----------+ V
// | seed |--> MGF ---> XOR
// +----------+ |
// | |
// +--+ V |
// |00| XOR <----- MGF <-----|
// +--+ | |
// | | |
// V V V
// +--+----------+----------------------------+
// EM = |00|maskedSeed| maskedDB |
// +--+----------+----------------------------+
int mLen = M.Length;
if (mLen > rsaParams.OctetsInModulus - 2 * rsaParams.hLen - 2)
{
throw new ArgumentException("Message too long.");
}
else
{
byte[] PS = new byte[rsaParams.OctetsInModulus - mLen - 2 * rsaParams.hLen - 2];
//4. pHash = Hash(P),
byte[] pHash = rsaParams.ComputeHash(P);
//5. DB = pHash||PS||01||M.
List<byte> _DB = new List<byte>();
_DB.AddRange(pHash);
_DB.AddRange(PS);
_DB.Add(0x01);
_DB.AddRange(M);
byte[] DB = _DB.ToArray();
//6. Generate a random octet string seed of length hLen.
byte[] seed = new byte[rsaParams.hLen];
rng.GetBytes(seed);
//7. dbMask = MGF(seed, k - hLen -1).
byte[] dbMask = MGF(seed, rsaParams.OctetsInModulus - rsaParams.hLen - 1);
//8. maskedDB = DB XOR dbMask
byte[] maskedDB = RSAxUtils.XOR(DB, dbMask);
//9. seedMask = MGF(maskedDB, hLen)
byte[] seedMask = MGF(maskedDB, rsaParams.hLen);
//10. maskedSeed = seed XOR seedMask.
byte[] maskedSeed = RSAxUtils.XOR(seed, seedMask);
//11. EM = 0x00 || maskedSeed || maskedDB.
List<byte> result = new List<byte>();
result.Add(0x00);
result.AddRange(maskedSeed);
result.AddRange(maskedDB);
return RSAProcess(result.ToArray(), usePrivate);
}
}
private byte[] Decrypt(byte[] Message, byte [] Parameters, bool usePrivate, bool fOAEP)
{
byte[] EM = new byte[0];
try
{
if ((usePrivate == true) && (UseCRTForPublicDecryption) && (rsaParams.HasCRTInfo))
{
EM = RSADecryptPrivateCRT(Message);
}
else
{
EM = RSAProcess(Message, usePrivate);
}
}
catch (CryptographicException ex)
{
throw new CryptographicException("Exception while Decryption: " + ex.Message);
}
catch
{
throw new Exception("Exception while Decryption: ");
}
try
{
if (fOAEP) //DECODE OAEP
{
if ((EM.Length == rsaParams.OctetsInModulus) && (EM.Length > (2 * rsaParams.hLen + 1)))
{
byte[] maskedSeed;
byte[] maskedDB;
byte[] pHash = rsaParams.ComputeHash(Parameters);
if (EM[0] == 0) // RFC3447 Format : http://tools.ietf.org/html/rfc3447
{
maskedSeed = EM.ToList().GetRange(1, rsaParams.hLen).ToArray();
maskedDB = EM.ToList().GetRange(1 + rsaParams.hLen, EM.Length - rsaParams.hLen - 1).ToArray();
byte[] seedMask = MGF(maskedDB, rsaParams.hLen);
byte[] seed = RSAxUtils.XOR(maskedSeed, seedMask);
byte[] dbMask = MGF(seed, rsaParams.OctetsInModulus - rsaParams.hLen - 1);
byte[] DB = RSAxUtils.XOR(maskedDB, dbMask);
if (DB.Length >= (rsaParams.hLen + 1))
{
byte[] _pHash = DB.ToList().GetRange(0, rsaParams.hLen).ToArray();
List<byte> PS_M = DB.ToList().GetRange(rsaParams.hLen, DB.Length - rsaParams.hLen);
int pos = PS_M.IndexOf(0x01);
if (pos >= 0 && (pos < PS_M.Count))
{
List<byte> _01_M = PS_M.GetRange(pos, PS_M.Count - pos);
byte[] M;
if (_01_M.Count > 1)
{
M = _01_M.GetRange(1, _01_M.Count - 1).ToArray();
}
else
{
M = new byte[0];
}
bool success = true;
for (int i = 0; i < rsaParams.hLen; i++)
{
if (_pHash[i] != pHash[i])
{
success = false;
break;
}
}
if (success)
{
return M;
}
else
{
M = new byte[rsaParams.OctetsInModulus]; //Hash Match Failure.
throw new CryptographicException("OAEP Decode Error");
}
}
else
{// #3: Invalid Encoded Message Length.
throw new CryptographicException("OAEP Decode Error");
}
}
else
{// #2: Invalid Encoded Message Length.
throw new CryptographicException("OAEP Decode Error");
}
}
else // Standard : ftp://ftp.rsasecurity.com/pub/rsalabs/rsa_algorithm/rsa-oaep_spec.pdf
{//OAEP : THIS STADNARD IS NOT IMPLEMENTED
throw new CryptographicException("OAEP Decode Error");
}
}
else
{// #1: Invalid Encoded Message Length.
throw new CryptographicException("OAEP Decode Error");
}
}
else // DECODE PKCS v1.5
{
if (EM.Length >= 11)
{
if ((EM[0] == 0x00) && (EM[1] == 0x02))
{
int startIndex = 2;
List<byte> PS = new List<byte>();
for (int i = startIndex; i < EM.Length; i++)
{
if (EM[i] != 0)
{
PS.Add(EM[i]);
}
else
{
break;
}
}
if (PS.Count >= 8)
{
int DecodedDataIndex = startIndex + PS.Count + 1;
if (DecodedDataIndex < (EM.Length - 1))
{
List<byte> DATA = new List<byte>();
for (int i = DecodedDataIndex; i < EM.Length; i++)
{
DATA.Add(EM[i]);
}
return DATA.ToArray();
}
else
{
return new byte[0];
//throw new CryptographicException("PKCS v1.5 Decode Error #4: No Data");
}
}
else
{// #3: Invalid Key / Invalid Random Data Length
throw new CryptographicException("PKCS v1.5 Decode Error");
}
}
else
{// #2: Invalid Key / Invalid Identifiers
throw new CryptographicException("PKCS v1.5 Decode Error");
}
}
else
{// #1: Invalid Key / PKCS Encoding
throw new CryptographicException("PKCS v1.5 Decode Error");
}
}
}
catch (CryptographicException ex)
{
throw new CryptographicException("Exception while decoding: " + ex.Message);
}
catch
{
throw new CryptographicException("Exception while decoding");
}
}
#endregion
#region PUBLIC FUNCTIONS
/// <summary>
/// Encrypts the given message with RSA, performs OAEP Encoding.
/// </summary>
/// <param name="Message">Message to Encrypt. Maximum message length is (ModulusLengthInOctets - 2 * HashLengthInOctets - 2)</param>
/// <param name="OAEP_Params">Optional OAEP parameters. Normally Empty. But, must match the parameters while decryption.</param>
/// <param name="usePrivate">True to use Private key for encryption. False to use Public key.</param>
/// <returns>Encrypted message.</returns>
public byte[] Encrypt(byte[] Message, byte[] OAEP_Params, bool usePrivate)
{
return RSAProcessEncodeOAEP(Message, OAEP_Params, usePrivate);
}
/// <summary>
/// Encrypts the given message with RSA.
/// </summary>
/// <param name="Message">Message to Encrypt. Maximum message length is For OAEP [ModulusLengthInOctets - (2 * HashLengthInOctets) - 2] and for PKCS [ModulusLengthInOctets - 11]</param>
/// <param name="usePrivate">True to use Private key for encryption. False to use Public key.</param>
/// <param name="fOAEP">True to use OAEP encoding (Recommended), False to use PKCS v1.5 Padding.</param>
/// <returns>Encrypted message.</returns>
public byte[] Encrypt(byte[] Message, bool usePrivate, bool fOAEP)
{
if (fOAEP)
{
return RSAProcessEncodeOAEP(Message, new byte[0], usePrivate);
}
else
{
return RSAProcessEncodePKCS(Message, usePrivate);
}
}
/// <summary>
/// Encrypts the given message using RSA Public Key.
/// </summary>
/// <param name="Message">Message to Encrypt. Maximum message length is For OAEP [ModulusLengthInOctets - (2 * HashLengthInOctets) - 2] and for PKCS [ModulusLengthInOctets - 11]</param>
/// <param name="fOAEP">True to use OAEP encoding (Recommended), False to use PKCS v1.5 Padding.</param>
/// <returns>Encrypted message.</returns>
public byte[] Encrypt(byte[] Message, bool fOAEP)
{
if (fOAEP)
{
return RSAProcessEncodeOAEP(Message, new byte[0], false);
}
else
{
return RSAProcessEncodePKCS(Message, false);
}
}
/// <summary>
/// Decrypts the given RSA encrypted message.
/// </summary>
/// <param name="Message">The encrypted message.</param>
/// <param name="usePrivate">True to use Private key for decryption. False to use Public key.</param>
/// <param name="fOAEP">True to use OAEP.</param>
/// <returns>Encrypted byte array.</returns>
public byte[] Decrypt(byte[] Message, bool usePrivate, bool fOAEP)
{
return Decrypt(Message, new byte[0], usePrivate, fOAEP);
}
/// <summary>
/// Decrypts the given RSA encrypted message.
/// </summary>
/// <param name="Message">The encrypted message.</param>
/// <param name="OAEP_Params">Parameters to the OAEP algorithm (Must match the parameter while Encryption).</param>
/// <param name="usePrivate">True to use Private key for decryption. False to use Public key.</param>
/// <returns>Decrypted byte array.</returns>
public byte[] Decrypt(byte[] Message, byte[] OAEP_Params, bool usePrivate)
{
return Decrypt(Message, OAEP_Params, usePrivate, true);
}
/// <summary>
/// Decrypts the given RSA encrypted message using Private key.
/// </summary>
/// <param name="Message">The encrypted message.</param>
/// <param name="fOAEP">True to use OAEP.</param>
/// <returns>Decrypted byte array.</returns>
public byte[] Decrypt(byte[] Message, bool fOAEP)
{
return Decrypt(Message, new byte[0], true, fOAEP);
}
#endregion
}
}