Invalidcastexception: Unable to cast Object of type 'System.Security.Cryptography.Rsacng'

Question

I am trying to pass the PIN through the code, so that the user does not need to enter it always, it is returning me this error:

Invalidcastexception: Unable to cast Object of type 'System.Security.Cryptography.Rsacng'

This is the function I’m using:

public static RSACryptoServiceProvider LerDispositivo(RSACryptoServiceProvider key, string PIN)
{
    CspParameters csp = new CspParameters(key.CspKeyContainerInfo.ProviderType, key.CspKeyContainerInfo.ProviderName);
    SecureString ss = new SecureString();
    foreach (char a in PIN)
    {
        ss.AppendChar(a);
    }
    csp.ProviderName = key.CspKeyContainerInfo.ProviderName;
    csp.ProviderType = key.CspKeyContainerInfo.ProviderType;
    csp.KeyNumber = key.CspKeyContainerInfo.KeyNumber == KeyNumber.Exchange ? 1 : 2;
    csp.KeyContainerName = key.CspKeyContainerInfo.KeyContainerName;
    csp.KeyPassword = ss;
    csp.Flags = CspProviderFlags.NoPrompt | CspProviderFlags.UseDefaultKeyContainer;

    RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(csp);
    return rsa;
}

And I added those three lines to my signing job:

RSACryptoServiceProvider Key = new RSACryptoServiceProvider();
                    Key = (System.Security.Cryptography.RSACryptoServiceProvider)x509Cert.PrivateKey;
                    signedXml.SigningKey = x509Cert.PrivateKey;
                    signedXml.SigningKey = LerDispositivo(Key, "senhaaqui");

Error occurs on this line:

 Key = (System.Security.Cryptography.RSACryptoServiceProvider)x509Cert.PrivateKey;

EDIT I have seen several examples on the Internet, but none of them solved my problem. I managed to find this link, that has an explanation, but I can not adapt to the code.

Following the LINK above, I tried to do this way:

RSACryptoServiceProvider publicKeyProvider = (System.Security.Cryptography.RSACryptoServiceProvider)x509Cert.GetRSAPrivateKey();
                        signedXml.KeyInfo = keyInfo;
                        signedXml.SigningKey = LerDispositivo(publicKeyProvider, "senhaaqui");

and it returns the same error:

Invalidcastexception: Unable to cast Object of type 'System.Security.Cryptography.Rsacng' to type 'System.Security.Cryptography.Rsacryptoserviceprovider'.

Is there any way to convert Rsacryptoserviceprovider to Rsacng ? Every way I try returns the same error.

EDIT

According to Pedro’s answer, I made the changes, but even so without success, it returns the following error:

error CS0433: Type "Cngpropertyoptions" exists in "System.Security.Cryptography.Algorithms, Version=4.3.1.0, Culture=neutral, Publickeytoken=b03f5f7f11d50a3a" and "System.Security.Cryptography.Cng, Version=4.3.1.0, Culture=neutral, Publickeytoken=b03f5f7f11d50a3a"

I tried several "solutions" that could solve the problem, but none solved the problem yet.

Answer 1

On Windows there are two generations of encryption Apis:

• The old generation (link), which includes Cryptographic Service Providers (CSP), which is the technology used by the class RSACryptoServiceProvider;
• And the new generation (link), Cryptography API: Next Generation (CNG), which is the technology used by the class RSACng.

The estate X509Certificate2.PrivateKey returns an object of type AsymmetricAlgorithm, which may be of the RSA or DSA. From . NET Framework 4.6 it is possible to use the extension method X509Certificate2.GetRSAPrivateKey, that returns a direct object RSA.

A certificate key can implement the two cryptographic generations, or just one of them. In the case of your certificate, it seems that only the new cryptographic generation is implemented, so the property X509Certificate2.PrivateKey is returning an object of the type RSACng, which cannot be directly converted to the type RSACryptoServiceProvider, since they are totally different.

Only that the routine you have to inform the PIN of your hardware certificate only works with the type RSACryptoServiceProvider, then you’ll have to adapt it to the type RSACng. I don’t have a hardware certificate here to test, but I wrote a routine for you to test.

First the function LerDispositivo() (kept the name you used, but now you pass directly the certificate X509Certificate2 for her) forehead to see what kind of RSA received from the certificate, if it is CNG (Cryptography API: Next Generation) or CSP (Cryptographic Service Provider), and then redirects to the function that knows how to handle each case:

using System.Security;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;

public static RSA LerDispositivo(X509Certificate2 cert, string pin)
{
   // Obtém a chave privada RSA do certificado.
   RSA rsa = cert.GetRSAPrivateKey();

   // Se a chave for do tipo CNG chama a função que trata desse tipo.
   RSACng rsaCng = rsa as RSACng;
   if (rsaCng != null)
   {
      return LerDispositivoCng(rsaCng, pin);
   }

   // Se a chave for do tipo CSP chama a função que trata desse tipo.
   RSACryptoServiceProvider rsaCsp = rsa as RSACryptoServiceProvider;
   if (rsaCsp != null)
   {
      return LerDispositivoCsp(rsaCsp, pin);
   }

   // A chave não era nem CNG nem CSP.
   return null;
}

private static RSA LerDispositivoCng(RSACng rsaCng, string pin)
{
   byte[] propValue;

   // O valor da propriedade deve ser informado como um array de bytes em
   // formato Unicode, e deve contar um caractere nulo como terminador.
   if (pin[pin.Length - 1] == '\0')
   {
      propValue = Encoding.Unicode.GetBytes(pin);
   }
   else
   {
      propValue = new byte[Encoding.Unicode.GetByteCount(pin) + 2];
      Encoding.Unicode.GetBytes(pin, 0, pin.Length, propValue, 0);
   }

   const string NCRYPT_PIN_PROPERTY = "SmartCardPin";

   CngProperty prop = new CngProperty(NCRYPT_PIN_PROPERTY,
                                      propValue,
                                      CngPropertyOptions.None);
   rsaCng.Key.SetProperty(prop);

   return rsaCng;
}

private static RSA LerDispositivoCsp(RSACryptoServiceProvider rsaCsp, string pin)
{
   var securePin = new SecureString();
   foreach (char c in pin)
   {
      securePin.AppendChar(c);
   }

   var cspParams = new CspParameters(
                           rsaCsp.CspKeyContainerInfo.ProviderType,
                           rsaCsp.CspKeyContainerInfo.ProviderName,
                           rsaCsp.CspKeyContainerInfo.KeyContainerName,
                           null,
                           securePin);
   cspParams.KeyNumber = (int) KeyNumber.Signature;
   cspParams.Flags = CspProviderFlags.NoPrompt |
                     CspProviderFlags.UseDefaultKeyContainer;

   return new RSACryptoServiceProvider(cspParams);
}

---

References:

• Encryptedxml Decryptdocument method error after . Net framework update - Stack Overflow
• Verify Private Key Protection before Signing with Rsacryptoserviceprovider - Stack Overflow
• Cngkey Assign permission to machine key - Stack Overflow
• Cngkey.Setproperty - Reference Source
• Ncryptsetproperty Function | Microsoft Docs
• Key Storage Property Identifiers | Microsoft Docs
• How can I set PIN for a X509certificate2 programmatically? - Stack Overflow