Background

不对称算法有三个不同的目的(我知道)

1. Encryption

• RSA is the only "standard" algorithm that can do this directly.

2. Signature

• RSA
• DSA
• ECDSA
• ElGamal Signature

3. Key Agreement

• Diffie-Hellman (DH)
• ECDH
• ElGamal encryption (the asymmetric startup phase)
• MQV
• ECMQV

由于RSA加密空间有限,90年代的计算机很难使用,因此RSA加密的主要用途是“Key Transfer”,也就是说,“加密电”只是DES/3DES(AES尚未发明)的不对称加密钥匙——。

using (ECDsa ecdsa = cert.GetECDsaPublicKey())
{
    return ECDiffieHellman.Create(ecdsa.ExportParameters(false));
}

ECDiffieHellmanPublicKey recipientPublic = GetECDHFromCertificate(cert).PublicKey;
ECCurve curve = recipientPublic.ExportParameters().Curve;

因此,我们现在来看。 http://www.secg.org/sec1-v2.pdf。 第5.1节(Elliptic Curve 综合加密计划)

Setup

1. Choose ANSI-X9.63-KDF with SHA-2-256 as the hash function.
2. Choose HMAC–SHA-256–256.
3. Choose AES–256 in CBC mode.
4. Choose Elliptic Curve Diffie-Hellman Primitive.
5. You already chose secp256r1.
6. Hard-coded. Done.
7. Point compression s annoying, choose not to use it.
8. I m omitting SharedInfo. That probably makes me a bad person.
9. Not using XOR, N/A.

Encrypt

1. Make an ephemeral key on the right curve.

    ECDiffieHellman ephem = ECDiffieHellman.Create(curve);
   

2. 我们决定不这样做。

    ECParameters ephemPublicParams = ephem.ExportParameters(false);
    int pointLen = ephemPublicParams.Q.X.Length;
    byte[] rBar = new byte[pointLen * 2 + 1];
    rBar[0] = 0x04;
    Buffer.BlockCopy(ephemPublicParams.Q.X, 0, rBar, 1, pointLen);
    Buffer.BlockCopy(ephemPublicParams.Q.Y, 0, rBar, 1 + pointLen, pointLen);
   

3. 这样做是直接的。

4. 这样做是直接的。

5. 自从我们在此重新控制以来,我们仅举一 thing三、4、5和6。

6. KDF时间。

    // This is why we picked AES 256, HMAC-SHA-2-256(-256) and SHA-2-256,
    // the KDF is dead simple.
    byte[] ek = ephem.DeriveKeyFromHash(
        recipientPublic,
        HashAlgorithmName.SHA256,
        null,
        new byte[] { 0, 0, 0, 1 });
   
    byte[] mk = ephem.DeriveKeyFromHash(
        recipientPublic,
        HashAlgorithmName.SHA256,
        null,
        new byte[] { 0, 0, 0, 2 });
   

7. 加密。

    byte[] em;
   
    // ECIES uses AES with the all zero IV. Since the key is never reused,
    // there s not risk in that.
    using (Aes aes = Aes.Create())
    using (ICryptoTransform encryptor = aes.CreateEncryptor(ek, new byte[16]))
    {
        if (!encryptor.CanTransformMultipleBlocks)
        {
            throw new InvalidOperationException();
        }
   
        em = encryptor.TransformFinalBlock(message, 0, message.Length);
    }
   

8. MAC

    byte[] d;
   
    using (HMAC hmac = new HMACSHA256(mk))
    {
        d = hmac.ComputeHash(em);
    }
   

9. Finish

    // Either
    return Tuple.Create(rBar, em, d);
    // Or
    return rBar.Concat(em).Concat(d).ToArray();
   

Decrypt

Left as an exercise to the reader.

取得证书的私人钥匙使用以下方法:

• Install NuGet package Security.Cryptography (CLR Security). (The package is under MIT license.)
• Use the following extension method to get the CngKey instance: CngKey cngKey = certificate.GetCngPrivateKey(); (Note: The extension method certificate.GetECDsaPrivateKey(), natively supported in .NET, returns an ECDsaCng instance; there is no extension method to return ECDiffieHellmanCng.)
• The cngKey instance can be used to create either an ECDsaCng or an ECDiffieHellmanCng instance: var sa = new ECDsaCng(cngKey); var sa = new ECDiffieHellmanCng(cngKey);