用非对称密钥加密 XML 元素

项目
05/09/2023

可以使用 System.Security.Cryptography.Xml 命名空间中的类加密 XML 文档内的元素。 XML 加密是交换或存储加密的 XML 数据的一种标准方式，使用后就无需担心数据被轻易读取。有关 XML 加密标准的详细信息，请参阅万维网联合会 (W3C) 对于 XML 加密的规范，该规范位于 https://www.w3.org/TR/xmldsig-core/。

可以使用 XML 加密将任何 XML 元素或文档替换为包含加密 XML 数据的 <EncryptedData> 元素。 <EncryptedData> 元素也可包含一些子元素来收入关于加密期间使用的密钥和进程的信息。 XML 加密允许文档包含多个加密元素，并允许对一个元素进行多次加密。此过程中的代码示例演示了如何创建 <EncryptedData> 元素和几个其他子元素，以便以后在解密过程中使用。

此示例使用两个密钥对 XML 元素进行加密。它生成 RSA 公钥/私钥对，并将密钥对保存到安全的密钥容器中。然后，此示例使用高级加密标准 (AES) 算法创建单独的会话密钥。使用 AES 会话密钥对 XML 文档进行加密，再使用 RSA 公钥对 AES 会话密钥进行加密。最后，将加密的 AES 会话密钥和加密的 XML 数据保存到新的 <EncryptedData> 元素内的 XML 文档中。

若要解密 XML 元素，可检索密钥容器中的 RSA 私钥，用其来解密会话密钥，然后使用会话密钥来解密文档。有关如何解密使用此过程加密的 XML 元素的详细信息，请参阅如何：用非对称密钥解密 XML 元素。

此示例适用于以下情况：多个应用程序需要共享加密数据，或应用程序需要保存它各次运行之间的加密数据。

使用非对称密钥加密 XML 元素

创建 CspParameters 对象，并指定密钥容器的名称。

CspParameters cspParams = new CspParameters();
cspParams.KeyContainerName = "XML_ENC_RSA_KEY";

Dim cspParams As New CspParameters()
cspParams.KeyContainerName = "XML_ENC_RSA_KEY"

使用 RSACryptoServiceProvider 类生成一个非对称密钥。当将 CspParameters 对象传递 RSACryptoServiceProvider 类的构造函数时，密钥将自动保存在密钥容器中。该密钥将用于加密 AES 会话密钥，并且稍后可检索该密钥以便对其进行解密。
```
RSACryptoServiceProvider rsaKey = new RSACryptoServiceProvider(cspParams);
```
```
Dim rsaKey As New RSACryptoServiceProvider(cspParams)
```

通过从磁盘加载 XML 文件来创建 XmlDocument 对象。 XmlDocument 对象包含要加密的 XML 元素。

// Create an XmlDocument object.
XmlDocument xmlDoc = new XmlDocument();

// Load an XML file into the XmlDocument object.
try
{
    xmlDoc.PreserveWhitespace = true;
    xmlDoc.Load("test.xml");
}
catch (Exception e)
{
    Console.WriteLine(e.Message);
}

' Create an XmlDocument object.
Dim xmlDoc As New XmlDocument()

' Load an XML file into the XmlDocument object.
Try
    xmlDoc.PreserveWhitespace = True
    xmlDoc.Load("test.xml")
Catch e As Exception
    Console.WriteLine(e.Message)
End Try

在 XmlDocument 对象中查找指定元素，并创建一个新的 XmlElement 对象来表示想要加密的元素。在此示例中，加密了 "creditcard" 元素。

XmlElement? elementToEncrypt = Doc.GetElementsByTagName(ElementToEncrypt)[0] as XmlElement;

// Throw an XmlException if the element was not found.
if (elementToEncrypt == null)
{
    throw new XmlException("The specified element was not found");
}

Dim elementToEncrypt As XmlElement = Doc.GetElementsByTagName(EncryptionElement)(0)

' Throw an XmlException if the element was not found.
If elementToEncrypt Is Nothing Then
    Throw New XmlException("The specified element was not found")
End If

使用 Aes 类创建新的会话密钥。此密钥将加密 XML 元素，然后其自身将被加密并被放置在 XML 文档中。
```
// Create an AES key.
sessionKey = Aes.Create();
```
```
' Create an AES key.
sessionKey = Aes.Create()
```

创建 EncryptedXml 类的新实例，并通过它使用会话密钥对指定元素进行加密。 EncryptData 方法以加密的字节数组的形式返回加密元素。

EncryptedXml eXml = new EncryptedXml();

byte[] encryptedElement = eXml.EncryptData(elementToEncrypt, sessionKey, false);

Dim eXml As New EncryptedXml()

Dim encryptedElement As Byte() = eXml.EncryptData(elementToEncrypt, sessionKey, False)

构造一个 EncryptedData 对象并对其填充加密 XML 元素的 URL 标识符。此 URL 标识符可使解密方知道 XML 包含一个加密元素。可使用 XmlEncElementUrl 字段来指定 URL 标识符。纯文本 XML 元素将被替换为此 EncryptedData 对象封装的 <EncryptedData> 元素。
```
EncryptedData edElement = new EncryptedData();
edElement.Type = EncryptedXml.XmlEncElementUrl;
edElement.Id = EncryptionElementID;
```
```
Dim edElement As New EncryptedData()
edElement.Type = EncryptedXml.XmlEncElementUrl
edElement.Id = EncryptionElementID
```
创建一个 EncryptionMethod 对象，将它初始化为用于生成会话密钥的加密算法的 URL 标识符。将 EncryptionMethod 对象传递给 EncryptionMethod 属性。
```
edElement.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES256Url);
```
```
edElement.EncryptionMethod = New EncryptionMethod(EncryptedXml.XmlEncAES256Url)
```

创建一个 EncryptedKey 对象，以便包含加密的会话密钥。加密会话密钥，将其添加到 EncryptedKey 对象，并输入会话密钥名称和密钥标识符 URL。

EncryptedKey ek = new EncryptedKey();

byte[] encryptedKey = EncryptedXml.EncryptKey(sessionKey.Key, Alg, false);

ek.CipherData = new CipherData(encryptedKey);

ek.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncRSA15Url);

Dim ek As New EncryptedKey()

Dim encryptedKey As Byte() = EncryptedXml.EncryptKey(sessionKey.Key, Alg, False)

ek.CipherData = New CipherData(encryptedKey)

ek.EncryptionMethod = New EncryptionMethod(EncryptedXml.XmlEncRSA15Url)

创建新的 DataReference 对象，它将加密数据映射到特定的会话密钥。此可选步骤使你能够轻松地指定 XML 文档的多个部件由单个密钥进行加密。

DataReference dRef = new DataReference();

// Specify the EncryptedData URI.
dRef.Uri = "#" + EncryptionElementID;

// Add the DataReference to the EncryptedKey.
ek.AddReference(dRef);

Dim dRef As New DataReference()

' Specify the EncryptedData URI.
dRef.Uri = "#" + EncryptionElementID

' Add the DataReference to the EncryptedKey.
ek.AddReference(dRef)

将加密的密钥添加到 EncryptedData 对象。

edElement.KeyInfo.AddClause(new KeyInfoEncryptedKey(ek));

edElement.KeyInfo.AddClause(New KeyInfoEncryptedKey(ek))

创建新的 KeyInfo 对象以指定 RSA 密钥的名称。将其添加到 EncryptedData 对象。这有助于解密方确定解密会话密钥时要使用的正确的非对称密钥。


// Create a new KeyInfoName element.
KeyInfoName kin = new KeyInfoName();

// Specify a name for the key.
kin.Value = KeyName;

// Add the KeyInfoName element to the
// EncryptedKey object.
ek.KeyInfo.AddClause(kin);

' Create a new KeyInfoName element.
Dim kin As New KeyInfoName()

' Specify a name for the key.
kin.Value = KeyName

' Add the KeyInfoName element to the
' EncryptedKey object.
ek.KeyInfo.AddClause(kin)

将加密的元素数据添加到 EncryptedData 对象。

edElement.CipherData.CipherValue = encryptedElement;

edElement.CipherData.CipherValue = encryptedElement

将原始 XmlDocument 对象中的元素替换为 EncryptedData 元素。

EncryptedXml.ReplaceElement(elementToEncrypt, edElement, false);

EncryptedXml.ReplaceElement(elementToEncrypt, edElement, False)

保存 XmlDocument 对象。

xmlDoc.Save("test.xml");

xmlDoc.Save("test.xml")

示例

此示例假定名为 "test.xml" 的文件与已编译程序存在于同一目录中。它还假定 "test.xml" 包含 "creditcard" 元素。可以将以下 XML 放在名为 test.xml 的文件，并将其用于以下示例。

<root>  
    <creditcard>  
        <number>19834209</number>  
        <expiry>02/02/2002</expiry>  
    </creditcard>  
</root>


using System;
using System.Xml;
using System.Security.Cryptography;
using System.Security.Cryptography.Xml;
using System.Runtime.Versioning;

[SupportedOSPlatform("windows")]
class Program
{
    static void Main(string[] args)
    {
        // Create an XmlDocument object.
        XmlDocument xmlDoc = new XmlDocument();

        // Load an XML file into the XmlDocument object.
        try
        {
            xmlDoc.PreserveWhitespace = true;
            xmlDoc.Load("test.xml");
        }
        catch (Exception e)
        {
            Console.WriteLine(e.Message);
        }

        // Create a new CspParameters object to specify
        // a key container.
        CspParameters cspParams = new CspParameters();
        cspParams.KeyContainerName = "XML_ENC_RSA_KEY";

        // Create a new RSA key and save it in the container.  This key will encrypt
        // a symmetric key, which will then be encrypted in the XML document.
        RSACryptoServiceProvider rsaKey = new RSACryptoServiceProvider(cspParams);

        try
        {
            // Encrypt the "creditcard" element.
            Encrypt(xmlDoc, "creditcard", "EncryptedElement1", rsaKey, "rsaKey");

            // Save the XML document.
            xmlDoc.Save("test.xml");

            // Display the encrypted XML to the console.
            Console.WriteLine("Encrypted XML:");
            Console.WriteLine();
            Console.WriteLine(xmlDoc.OuterXml);
            Decrypt(xmlDoc, rsaKey, "rsaKey");
            xmlDoc.Save("test.xml");
            // Display the encrypted XML to the console.
            Console.WriteLine();
            Console.WriteLine("Decrypted XML:");
            Console.WriteLine();
            Console.WriteLine(xmlDoc.OuterXml);
        }
        catch (Exception e)
        {
            Console.WriteLine(e.Message);
        }
        finally
        {
            // Clear the RSA key.
            rsaKey.Clear();
        }

        Console.ReadLine();
    }

    public static void Encrypt(XmlDocument Doc, string ElementToEncrypt, string EncryptionElementID, RSA Alg, string KeyName)
    {
        // Check the arguments.
        if (Doc == null)
            throw new ArgumentNullException("Doc");
        if (ElementToEncrypt == null)
            throw new ArgumentNullException("ElementToEncrypt");
        if (EncryptionElementID == null)
            throw new ArgumentNullException("EncryptionElementID");
        if (Alg == null)
            throw new ArgumentNullException("Alg");
        if (KeyName == null)
            throw new ArgumentNullException("KeyName");

        ////////////////////////////////////////////////
        // Find the specified element in the XmlDocument
        // object and create a new XmlElement object.
        ////////////////////////////////////////////////
        XmlElement? elementToEncrypt = Doc.GetElementsByTagName(ElementToEncrypt)[0] as XmlElement;

        // Throw an XmlException if the element was not found.
        if (elementToEncrypt == null)
        {
            throw new XmlException("The specified element was not found");
        }
        Aes? sessionKey = null;

        try
        {
            //////////////////////////////////////////////////
            // Create a new instance of the EncryptedXml class
            // and use it to encrypt the XmlElement with the
            // a new random symmetric key.
            //////////////////////////////////////////////////

            // Create an AES key.
            sessionKey = Aes.Create();

            EncryptedXml eXml = new EncryptedXml();

            byte[] encryptedElement = eXml.EncryptData(elementToEncrypt, sessionKey, false);
            ////////////////////////////////////////////////
            // Construct an EncryptedData object and populate
            // it with the desired encryption information.
            ////////////////////////////////////////////////

            EncryptedData edElement = new EncryptedData();
            edElement.Type = EncryptedXml.XmlEncElementUrl;
            edElement.Id = EncryptionElementID;
            // Create an EncryptionMethod element so that the
            // receiver knows which algorithm to use for decryption.

            edElement.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES256Url);
            // Encrypt the session key and add it to an EncryptedKey element.
            EncryptedKey ek = new EncryptedKey();

            byte[] encryptedKey = EncryptedXml.EncryptKey(sessionKey.Key, Alg, false);

            ek.CipherData = new CipherData(encryptedKey);

            ek.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncRSA15Url);

            // Create a new DataReference element
            // for the KeyInfo element.  This optional
            // element specifies which EncryptedData
            // uses this key.  An XML document can have
            // multiple EncryptedData elements that use
            // different keys.
            DataReference dRef = new DataReference();

            // Specify the EncryptedData URI.
            dRef.Uri = "#" + EncryptionElementID;

            // Add the DataReference to the EncryptedKey.
            ek.AddReference(dRef);
            // Add the encrypted key to the
            // EncryptedData object.

            edElement.KeyInfo.AddClause(new KeyInfoEncryptedKey(ek));
            // Set the KeyInfo element to specify the
            // name of the RSA key.


            // Create a new KeyInfoName element.
            KeyInfoName kin = new KeyInfoName();

            // Specify a name for the key.
            kin.Value = KeyName;

            // Add the KeyInfoName element to the
            // EncryptedKey object.
            ek.KeyInfo.AddClause(kin);
            // Add the encrypted element data to the
            // EncryptedData object.
            edElement.CipherData.CipherValue = encryptedElement;
            ////////////////////////////////////////////////////
            // Replace the element from the original XmlDocument
            // object with the EncryptedData element.
            ////////////////////////////////////////////////////
            EncryptedXml.ReplaceElement(elementToEncrypt, edElement, false);
        }
        finally
        {
            sessionKey?.Clear();
        }
    }

    public static void Decrypt(XmlDocument Doc, RSA Alg, string KeyName)
    {
        // Check the arguments.
        if (Doc == null)
            throw new ArgumentNullException("Doc");
        if (Alg == null)
            throw new ArgumentNullException("Alg");
        if (KeyName == null)
            throw new ArgumentNullException("KeyName");

        // Create a new EncryptedXml object.
        EncryptedXml exml = new EncryptedXml(Doc);

        // Add a key-name mapping.
        // This method can only decrypt documents
        // that present the specified key name.
        exml.AddKeyNameMapping(KeyName, Alg);

        // Decrypt the element.
        exml.DecryptDocument();
    }
}

Imports System.Xml
Imports System.Security.Cryptography
Imports System.Security.Cryptography.Xml

Class Program

    Shared Sub Main(ByVal args() As String)
        ' Create an XmlDocument object.
        Dim xmlDoc As New XmlDocument()

        ' Load an XML file into the XmlDocument object.
        Try
            xmlDoc.PreserveWhitespace = True
            xmlDoc.Load("test.xml")
        Catch e As Exception
            Console.WriteLine(e.Message)
        End Try
        ' Create a new CspParameters object to specify
        ' a key container.
        Dim cspParams As New CspParameters()
        cspParams.KeyContainerName = "XML_ENC_RSA_KEY"
        ' Create a new RSA key and save it in the container.  This key will encrypt
        ' a symmetric key, which will then be encrypted in the XML document.
        Dim rsaKey As New RSACryptoServiceProvider(cspParams)
        Try
            ' Encrypt the "creditcard" element.
            Encrypt(xmlDoc, "creditcard", "EncryptedElement1", rsaKey, "rsaKey")


            ' Save the XML document.
            xmlDoc.Save("test.xml")
            ' Display the encrypted XML to the console.
            Console.WriteLine("Encrypted XML:")
            Console.WriteLine()
            Console.WriteLine(xmlDoc.OuterXml)
            Decrypt(xmlDoc, rsaKey, "rsaKey")
            xmlDoc.Save("test.xml")
            ' Display the encrypted XML to the console.
            Console.WriteLine()
            Console.WriteLine("Decrypted XML:")
            Console.WriteLine()
            Console.WriteLine(xmlDoc.OuterXml)

        Catch e As Exception
            Console.WriteLine(e.Message)
        Finally
            ' Clear the RSA key.
            rsaKey.Clear()
        End Try


        Console.ReadLine()

    End Sub


    Public Shared Sub Encrypt(ByVal Doc As XmlDocument, ByVal EncryptionElement As String, ByVal EncryptionElementID As String, ByVal Alg As RSA, ByVal KeyName As String)
        ' Check the arguments.
        ArgumentNullException.ThrowIfNull(Doc)
        ArgumentNullException.ThrowIfNull(EncryptionElement)
        ArgumentNullException.ThrowIfNull(EncryptionElementID)
        ArgumentNullException.ThrowIfNull(Alg)
        ArgumentNullException.ThrowIfNull(KeyName)
        '//////////////////////////////////////////////
        ' Find the specified element in the XmlDocument
        ' object and create a new XmlElement object.
        '//////////////////////////////////////////////
        Dim elementToEncrypt As XmlElement = Doc.GetElementsByTagName(EncryptionElement)(0)

        ' Throw an XmlException if the element was not found.
        If elementToEncrypt Is Nothing Then
            Throw New XmlException("The specified element was not found")
        End If
        Dim sessionKey As Aes = Nothing

        Try
            '////////////////////////////////////////////////
            ' Create a new instance of the EncryptedXml class
            ' and use it to encrypt the XmlElement with the
            ' a new random symmetric key.
            '////////////////////////////////////////////////
            ' Create an AES key.
            sessionKey = Aes.Create()
            Dim eXml As New EncryptedXml()

            Dim encryptedElement As Byte() = eXml.EncryptData(elementToEncrypt, sessionKey, False)
            '//////////////////////////////////////////////
            ' Construct an EncryptedData object and populate
            ' it with the desired encryption information.
            '//////////////////////////////////////////////
            Dim edElement As New EncryptedData()
            edElement.Type = EncryptedXml.XmlEncElementUrl
            edElement.Id = EncryptionElementID
            ' Create an EncryptionMethod element so that the
            ' receiver knows which algorithm to use for decryption.
            edElement.EncryptionMethod = New EncryptionMethod(EncryptedXml.XmlEncAES256Url)
            ' Encrypt the session key and add it to an EncryptedKey element.
            Dim ek As New EncryptedKey()

            Dim encryptedKey As Byte() = EncryptedXml.EncryptKey(sessionKey.Key, Alg, False)

            ek.CipherData = New CipherData(encryptedKey)

            ek.EncryptionMethod = New EncryptionMethod(EncryptedXml.XmlEncRSA15Url)
            ' Create a new DataReference element
            ' for the KeyInfo element.  This optional
            ' element specifies which EncryptedData
            ' uses this key.  An XML document can have
            ' multiple EncryptedData elements that use
            ' different keys.
            Dim dRef As New DataReference()

            ' Specify the EncryptedData URI.
            dRef.Uri = "#" + EncryptionElementID

            ' Add the DataReference to the EncryptedKey.
            ek.AddReference(dRef)
            ' Add the encrypted key to the
            ' EncryptedData object.
            edElement.KeyInfo.AddClause(New KeyInfoEncryptedKey(ek))
            ' Set the KeyInfo element to specify the
            ' name of the RSA key.
            ' Create a new KeyInfoName element.
            Dim kin As New KeyInfoName()

            ' Specify a name for the key.
            kin.Value = KeyName

            ' Add the KeyInfoName element to the
            ' EncryptedKey object.
            ek.KeyInfo.AddClause(kin)
            ' Add the encrypted element data to the
            ' EncryptedData object.
            edElement.CipherData.CipherValue = encryptedElement
            '//////////////////////////////////////////////////
            ' Replace the element from the original XmlDocument
            ' object with the EncryptedData element.
            '//////////////////////////////////////////////////
            EncryptedXml.ReplaceElement(elementToEncrypt, edElement, False)
        Catch e As Exception
            ' re-throw the exception.
            Throw
        Finally
            If Not (sessionKey Is Nothing) Then
                sessionKey.Clear()
            End If
        End Try

    End Sub



    Public Shared Sub Decrypt(ByVal Doc As XmlDocument, ByVal Alg As RSA, ByVal KeyName As String)
        ' Check the arguments.
        ArgumentNullException.ThrowIfNull(Doc)
        ArgumentNullException.ThrowIfNull(Alg)
        ArgumentNullException.ThrowIfNull(KeyName)
        ' Create a new EncryptedXml object.
        Dim exml As New EncryptedXml(Doc)

        ' Add a key-name mapping.
        ' This method can only decrypt documents
        ' that present the specified key name.
        exml.AddKeyNameMapping(KeyName, Alg)

        ' Decrypt the element.
        exml.DecryptDocument()

    End Sub
End Class

编译代码

在面向 .NET Framework 的项目中，包含对 System.Security.dll 的引用。
在面向 .NET Core 或 .NET 5 的项目中，安装 NuGet 包 System.Security.Cryptography.Xml。
包括以下命名空间：System.Xml、System.Security.Cryptography 和 System.Security.Cryptography.Xml。

.NET 安全性

永远不要以纯文本形式存储对称加密密钥，也不要以纯文本形式在计算机之间传输对称密钥。此外，绝不存储或传输纯文本形式的非对称密钥的私钥。有关对称和非对称加密密钥的详细信息，请参阅生成加密和解密的密钥。

提示

对于开发，请使用机密管理器进行安全机密存储。生产中，考虑产品 Azure Key Vault。

绝不将密钥直接嵌入源代码。可通过使用 Ildasm.exe（IL 反汇编程序）或在文本编辑器（如记事本）中打开程序集的方式从程序集中轻松读取嵌入的密钥。

当你使用加密密钥执行操作后，通过将每个字节设置为零或通过调用托管加密类的 Clear 方法来将它从内存中清除。加密密钥有时可从内存由调试器读取，或从硬盘读取（如果内存位置分页到磁盘）。

用非对称密钥加密 XML 元素

使用非对称密钥加密 XML 元素

示例

编译代码

.NET 安全性

另请参阅

反馈

其他资源