如何在SignedData.Sign中复制CAPICOM SignedData.Sign()方法

Question

我需要为使用VB6/CAPICOM组件的现有经典Asp网站编写一个测试工具。目的是重新创建SignedData.Sign()的结果，以便我可以将其发布到经典Asp网站，在那里它将使用CAPICOM解码有效载荷。

VB6 CAPICOM供参考

Function SignContent(ByVal strXmlToSign As String) As String
    Dim strSignedString As String
    Dim objSign As SignedData ‘ From CAPICOM library
    Set objSign = New SignedData
    objSign.Content = strXmlToSign
    strSignedString = objSign.Sign
    Set objSign = Nothing
    SignContent = strSignedString
End Function

我一直在使用CAPICOM文档这里作为指南

C#等效

public string Sign(string dataToSign)
{    
    ContentInfo contentInfo = new ContentInfo(Encoding.UTF8.GetBytes(dataToSign));

    // Create a new, nondetached SignedCms message.
    SignedCms signedCms = new SignedCms(contentInfo);

    // get cert from store by Serial Number
    X509Certificate2 cert = GetCertificateBy("my-cert-serial-number");
    CmsSigner signer = new CmsSigner(cert);

    // Sign the message.
    signedCms.ComputeSignature(signer);

    // Encode the message.
    var encoded = signedCms.Encode();

    // mimic default EncodingType; CAPICOM_ENCODE_BASE64 Data is saved as a base64 - encoded string.
    return Convert.ToBase64String(encoded);
}

到目前为止，C#生成的签名还不能被CAPICOM组件解码。

Answer 1

在做了大量的检测工作之后，我成功地向端点发送了一条消息，可以对CAPICOM组件进行解码。工作解决办法如下：

public string Sign(string dataToSign)
{
    // Default to SHA1; required if targeting .Net Framework 4.7.1 or above
    AppContext.SetSwitch("Switch.System.Security.Cryptography.Pkcs.UseInsecureHashAlgorithms", true);

    // The dataToSign byte array holds the data to be signed.
    ContentInfo contentInfo = new ContentInfo(Encoding.Unicode.GetBytes(dataToSign));

    // Create a new, nondetached SignedCms message.
    SignedCms signedCms = new SignedCms(contentInfo, false);

    X509Certificate2 cert = GetCertificate();

    CmsSigner signer = new CmsSigner(cert);

    // Sign the message.
    signedCms.ComputeSignature(signer);

    // Encode the message.
    var encoded = signedCms.Encode();

    // mimic default EncodingType; CAPICOM_ENCODE_BASE64 Data is saved as a base64 - encoded string.
    return Convert.ToBase64String(encoded, Base64FormattingOptions.InsertLineBreaks);
}

变动摘要：

AppContext.SetSwitch("Switch.System.Security.Cryptography.Pkcs.UseInsecureHashAlgorithms", true);

如果.NET框架4.7.1+是目标(我的应用程序以.NET 4.7.1为目标)，默认情况下，这些操作将启用SHA256。这种更改是必要的，因为SHA1不再被认为是安全的。来源

ContentInfo contentInfo = new ContentInfo(Encoding.Unicode.GetBytes(dataToSign));

从编码UTF8改为Unicode。

return Convert.ToBase64String(encoded, Base64FormattingOptions.InsertLineBreaks);

使用换行选项匹配Capicom输出。