如何使用.Net Core创建PKCS＃7分离签名？

Question

我想用.Net Core（2.0）创建PKCS＃7分离签名。

我在这里阅读了与我的问题或多或少相关的所有答案，并找到了this和this答案。所有其他人都无能为力。第一个例子正是我需要的，但它依赖于.NetFramework。 第二个使用Bouncy Castle库并做一些不同但相似的事情。我发现Portable.BouncyCastle项目在.Net Core上工作。据我所知，这是我唯一的选择。

这是第一个示例中的代码，并进行了一些修改：

    string s = "data string";
    byte[] data = Encoding.UTF8.GetBytes(s);        
    X509Certificate2 certificate = null;
    X509Store my = new X509Store(StoreName.My,StoreLocation.CurrentUser);
    my.Open(OpenFlags.ReadOnly);
    certificate = my.Certificates.Find(X509FindType.FindByThumbprint, "my thumbprint", false)[0];
    if (certificate == null) throw new Exception("No certificates found.");

    ContentInfo content = new ContentInfo(new Oid("1.2.840.113549.1.7.1"),data);
    SignedCms signedCms = new SignedCms(content, true);

    CmsSigner signer = new CmsSigner(certificate);
    signer.DigestAlgorithm = new Oid("SHA256"); 

    // create the signature
    signedCms.ComputeSignature(signer);
    return signedCms.Encode();

它在我的情况下工作正常。 signedCms.Encode（）返回1835个字节，该值通过验证。

但如果我使用BounceCastle，我会得到另一个结果。这是代码：

                X509Certificate2 certificate = null;
        X509Store my = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        my.Open(OpenFlags.ReadOnly);

        certificate = my.Certificates.Find(X509FindType.FindByThumbprint, "my thumbprint", false)[0];
        var privKey = DotNetUtilities.GetRsaKeyPair(certificate.GetRSAPrivateKey()).Private;
        var cert = DotNetUtilities.FromX509Certificate(certificate);

        var content = new CmsProcessableByteArray(data);

        var generator = new CmsSignedDataGenerator();

        generator.AddSigner(privKey, cert, CmsSignedGenerator.EncryptionRsa, CmsSignedGenerator.DigestSha256);

        var signedContent = generator.Generate(content, false);
        return signedContent.GetEncoded();

signedContent.GetEncoded（）返回502个字节，无法验证此结果。我明白我做错了什么，但我不知道是什么。

我应该如何使用Bouncy Castle修改样本，它会得到与上面代码相​​同的结果？

Answer 1

我发现另一个discussion给了我一个线索。有一个带有示例应用程序的GitHub repo的链接。我稍微修改了它，现在它按预期工作。这是代码：

            X509Certificate2 certificate = null;
        X509Store my = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        my.Open(OpenFlags.ReadOnly);

        certificate = my.Certificates.Find(X509FindType.FindByThumbprint, "thumbprint", false)[0];
        var privKey = DotNetUtilities.GetRsaKeyPair(certificate.GetRSAPrivateKey()).Private;
        var cert = DotNetUtilities.FromX509Certificate(certificate);

        var content = new CmsProcessableByteArray(data);

        var generator = new CmsSignedDataGenerator();

        generator.AddSigner(privKey, cert, CmsSignedGenerator.EncryptionRsa, CmsSignedGenerator.DigestSha256);

        var signedContent = generator.Generate(content, false);

        string hashOid = OID.SHA256;

        var si = signedContent.GetSignerInfos();
        var signer = si.GetSigners().Cast<SignerInformation>().First();

        SignerInfo signerInfo = signer.ToSignerInfo();

        Asn1EncodableVector digestAlgorithmsVector = new Asn1EncodableVector();
        digestAlgorithmsVector.Add(
            new AlgorithmIdentifier(
                algorithm: new DerObjectIdentifier(hashOid),
                parameters: DerNull.Instance));

        // Construct SignedData.encapContentInfo
        ContentInfo encapContentInfo = new ContentInfo(
            contentType: new DerObjectIdentifier(OID.PKCS7IdData),
            content: null);

        Asn1EncodableVector certificatesVector = new Asn1EncodableVector();
        certificatesVector.Add(X509CertificateStructure.GetInstance(Asn1Object.FromByteArray(cert.GetEncoded())));

        // Construct SignedData.signerInfos
        Asn1EncodableVector signerInfosVector = new Asn1EncodableVector();
        signerInfosVector.Add(signerInfo.ToAsn1Object());

        // Construct SignedData
        SignedData signedData = new SignedData(
            digestAlgorithms: new DerSet(digestAlgorithmsVector),
            contentInfo: encapContentInfo,
            certificates: new BerSet(certificatesVector),
            crls: null,
            signerInfos: new DerSet(signerInfosVector));

        ContentInfo contentInfo = new ContentInfo(
            contentType: new DerObjectIdentifier(OID.PKCS7IdSignedData),
            content: signedData);

        return contentInfo.GetDerEncoded();