SignedXml与Azure密钥库SignData

Question

我知道如何使用SignedXml (https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.xml.signedxml?view=dotnet-plat-ext-6.0)对XML文档签名。

我知道如何使用Azure KeyVault API对数据进行签名，以便私钥保持安全(https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.keys.cryptography.cryptographyclient.signdata?view=azure-dotnet)。

现在，我想将两者结合起来，使用SignedXml (或创建相同的结果)，在不提取私钥的情况下使用金库中的密钥。

如下所示，试图设置这两个值似乎是不正确的。

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
        <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
        <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
        <Reference URI="">
            <Transforms>
                <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
            <DigestValue>...</DigestValue>
        </Reference>
    </SignedInfo>
    <SignatureValue>...</SignatureValue>
</Signature>

var digestValue = new SHA256Managed().ComputeHash(Encoding.UTF8.GetBytes(xmlDoc.OuterXml));
var signatureValue = new CryptographyClient().SignData(SignatureAlgorithm.RS256, digestValue);

Answer 1

您需要实现从System.Security.Cryptography.RSA类继承的自定义类，在其实现中使用KeyVault API，然后使用自定义类的实例作为SigningKey。

您可以自己实现它，也可以使用RSAKeyVaultProvider库。

Answer 2

SignedXml signedXml = new SignedXml(tokenDoc);
var reference = new Reference("");
reference.AddTransform(new XmlDsigEnvelopedSignatureTransform());
signedXml.AddReference(reference);
signedXml.SigningKey = new KeyVaultRsa();
signedXml.ComputeSignature();
var xmlDigitalSignature = signedXml.GetXml();

internal class KeyVaultRsa : RSA
{
    public override RSAParameters ExportParameters(bool includePrivateParameters)
    {
        throw new NotImplementedException();
    }

    public override void ImportParameters(RSAParameters parameters)
    {
        throw new NotImplementedException();
    }

    public override byte[] SignHash(byte[] hash, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding)
    {
        var keyId = new Uri("https://xxx.vault.azure.net/keys/xxx");
        var rsaCryptoClient = new Azure.Security.KeyVault.Keys.Cryptography.CryptographyClient(keyId, new Azure.Identity.DefaultAzureCredential());
        var result = rsaCryptoClient.Sign(Azure.Security.KeyVault.Keys.Cryptography.SignatureAlgorithm.RS256, hash);

        return result.Signature;
    }
}