在 c# 中将签名算法从 sha1 转换为 sha256答案

【问题标题】：convert signature algorithm from sha1 to sha256 in c#在 c# 中将签名算法从 sha1 转换为 sha256
【发布时间】：2020-08-18 07:03:11
【问题描述】：

我有一个网络服务客户端应用程序。我的网络服务提供商通知我将签名方法从 sha1 更改为 sha256，它位于请求标头部分。目前我有一个 CustomSendFilter 类，并使用以下功能保护传出消息。如何转换为 sha 256？我搜索了但还没有找到明确的解决方案。

public override void SecureMessage(SoapEnvelope envelope, Security security)
        {
            X509SecurityToken signatureToken;

            signatureToken = new X509SecurityToken(CertificateManager.ClientCertificate);           
          
            security.Tokens.Add(signatureToken);
            
            MessageSignature sig = new MessageSignature(signatureToken);

            security.Elements.Add(sig);
            security.Timestamp.TtlInSeconds = 60;

            Logging.AddToLog(envelope.Envelope.InnerText);
        }

【问题讨论】：

标签： c# .net soap webservice-client

【解决方案1】：

您可以通过MessageSignature.SignedInfo.SignatureMethod设置要使用的签名算法。

不幸的是，在撰写本文时，.NET Framework 可能没有对http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 的内置支持，但可以使用以下代码来解决这个问题（致谢https://gist.github.com/sneal/f35de432115b840c4c1f）：

/// <summary>
/// SignatureDescription impl for http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
/// </summary>
public class RSAPKCS1SHA256SignatureDescription : SignatureDescription
{
    /// <summary>
    /// Registers the http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 algorithm
    /// with the .NET CrytoConfig registry. This needs to be called once per
    /// appdomain before attempting to validate SHA256 signatures.
    /// </summary>
    public static void Register()
    {
        CryptoConfig.AddAlgorithm(
            typeof(RSAPKCS1SHA256SignatureDescription),
            "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
    }

    /// <summary>
    /// .NET calls this parameterless ctor
    /// </summary>
    public RSAPKCS1SHA256SignatureDescription()
    {
        KeyAlgorithm = "System.Security.Cryptography.RSACryptoServiceProvider";
        DigestAlgorithm = "System.Security.Cryptography.SHA256Managed";
        FormatterAlgorithm = "System.Security.Cryptography.RSAPKCS1SignatureFormatter";
        DeformatterAlgorithm = "System.Security.Cryptography.RSAPKCS1SignatureDeformatter";
    }

    public override AsymmetricSignatureDeformatter CreateDeformatter(AsymmetricAlgorithm key)
    {
        var asymmetricSignatureDeformatter =
            (AsymmetricSignatureDeformatter)CryptoConfig.CreateFromName(DeformatterAlgorithm);
        asymmetricSignatureDeformatter.SetKey(key);
        asymmetricSignatureDeformatter.SetHashAlgorithm("SHA256");
        return asymmetricSignatureDeformatter;
    }

    public override AsymmetricSignatureFormatter CreateFormatter(AsymmetricAlgorithm key)
    {
        var asymmetricSignatureFormatter =
            (AsymmetricSignatureFormatter)CryptoConfig.CreateFromName(FormatterAlgorithm);
        asymmetricSignatureFormatter.SetKey(key);
        asymmetricSignatureFormatter.SetHashAlgorithm("SHA256");
        return asymmetricSignatureFormatter;
    }
}

【讨论】：

【解决方案2】：

感谢您的回答。我有一个用于保护请求的 CustomSendFilter 类，如下所示。我应该在哪里注册算法？我在调用 webservice 函数之前和下面的 SecureMessage 函数中注册了，但没有工作。

公共类 CustomSendFilter : SendSecurityFilter { 私有字符串服务描述；

    public CustomSendFilter(SecurityPolicyAssertion parentAssertion , string serviceDescription)
        : base(parentAssertion.ServiceActor, true)
    {
        this.serviceDescription = serviceDescription;
    }

    public override SoapFilterResult ProcessMessage(SoapEnvelope envelope)
    {
        SoapFilterResult result = base.ProcessMessage(envelope);

        Logging.SaveSoapEnvelope(envelope, SoapMessageDirection.Out , serviceDescription);

        return result;
    }

    public override void SecureMessage(SoapEnvelope envelope, Security security)
    {
        X509SecurityToken signatureToken;


            signatureToken = new X509SecurityToken(CertificateManager.ClientCertificate);
        RSAPKCS1SHA256SignatureDescription.Register();
        security.Tokens.Add(signatureToken);
        
        MessageSignature sig = new MessageSignature(signatureToken);

        security.Elements.Add(sig);
        security.Timestamp.TtlInSeconds = 60;

        Logging.AddToLog(envelope.Envelope.InnerText);
    }

}

【讨论】：