通过windows cng api 实现rsa非对称加密

参考：

1,使用 CNG 加密数据 - Win32 apps | Microsoft Learn

2,不记得了

（下文通过cng api演示rsa加密，不做原理性介绍）

相对于aes等对称加密算法，rsa加密算法不可逆性更强。非对称加密在通常情况下，使用公钥对数据进行加密之后，如果没有私钥，基本是不可能实现解密的。在一些勒索程序中，非对称加密会经常出现；这里算是填个坑吧。

下面代码实现：

1，rsa加密

2，公钥/私钥导出

#define RsaKeyLen 2048

HRESULT bthr(BOOL b)
{
    return b ? S_OK : HRESULT_FROM_WIN32(GetLastError());
}


//确实不需要直接从 BCryptExportKey 或 NCryptExportKey 进行 base64 编码输出，但需要执行额外的步骤 :
//
//使用 BCryptExportKey(或 NCryptExportKey) BCRYPT_RSAFULLPRIVATE_BLOB(但不是 BCRYPT_RSAPRIVATE_BLOB)或 BCRYPT_RSAPUBLIC_BLOB
//对生成的 BCRYPT_RSAKEY_BLOB 进行编码 CNG_RSA_PRIVATE_KEY_BLOB 或 CNG_RSA_PUBLIC_KEY_BLOB 并放入 CRYPT_PRIVATE_KEY_INFO
//使用 PKCS_PRIVATE_KEY_INFO 对 CRYPT_PRIVATE_KEY_INFO 进行编码 >
//调用CryptBinaryToStringA


HRESULT ExportToPem(_In_ BCRYPT_KEY_HANDLE hKey, BOOL bPrivate, _Out_ PSTR* ppsz, _Out_ PULONG pcch)
{
    HRESULT hr;
    CRYPT_PRIVATE_KEY_INFO PrivateKeyInfo = { 0, {const_cast<PSTR>(szOID_RSA_RSA)} };
    CERT_PUBLIC_KEY_INFO   PublicKeyInfo = { {const_cast<PSTR>(szOID_RSA_RSA)} };
  
    ULONG cbKey = 0;
    PUCHAR pbKey = 0;//really PBCRYPT_RSAKEY_BLOB

    PCWSTR pszBlobType;
    PCSTR lpszStructType;

    if (bPrivate)
    {
        pszBlobType = BCRYPT_RSAFULLPRIVATE_BLOB;
        lpszStructType = CNG_RSA_PRIVATE_KEY_BLOB;
    }
    else
    {
        pszBlobType = BCRYPT_RSAPUBLIC_BLOB;
        lpszStructType = CNG_RSA_PUBLIC_KEY_BLOB;
    }

    while (0 <= (hr = BCryptExportKey(hKey, 0, pszBlobType, pbKey, cbKey, &cbKey, 0)))
    {
        if (pbKey)
        {
            if (bPrivate)
            {
                if (0 <= (hr = bthr(CryptEncodeObjectEx(
                    X509_ASN_ENCODING,
                    lpszStructType,
                    pbKey, 
                    CRYPT_ENCODE_ALLOC_FLAG, 
                    0,
                    &PrivateKeyInfo.PrivateKey.pbData,
                    &PrivateKeyInfo.PrivateKey.cbData))))
                {
                    hr = bthr(CryptEncodeObjectEx(
                        X509_ASN_ENCODING, 
                        PKCS_PRIVATE_KEY_INFO,
                        &PrivateKeyInfo, 
                        CRYPT_ENCODE_ALLOC_FLAG,
                        0,
                        &pbKey, 
                        &cbKey));

                    LocalFree(PrivateKeyInfo.PrivateKey.pbData);
                }
            }
            else
            {
                //public key
                if (0 <= (hr = bthr(CryptEncodeObjectEx(
                    X509_ASN_ENCODING,
                    lpszStructType, 
                    pbKey, 
                    CRYPT_ENCODE_ALLOC_FLAG, 
                    0,
                    &PublicKeyInfo.PublicKey.pbData,
                    &PublicKeyInfo.PublicKey.cbData))))
                {
                    hr = bthr(CryptEncodeObjectEx(
                        X509_ASN_ENCODING,
                        X509_PUBLIC_KEY_INFO,
                        &PublicKeyInfo, 
                        CRYPT_ENCODE_ALLOC_FLAG, 
                        0,
                        &pbKey, 
                        &cbKey));

                    LocalFree(PublicKeyInfo.PublicKey.pbData);
                }
            }

            if (0 <= hr)
            {
                PSTR psz = 0;
                ULONG cch = 0;
                while (0 <= (hr = bthr(CryptBinaryToStringA(
                    pbKey,
                    cbKey,
                    CRYPT_STRING_BASE64HEADER, //CRYPT_STRING_BASE64HEADER without the "---------BEGIN CERTIFICATE---------"
                    psz,
                    &cch))))
                {
                    if (psz)
                    {
                        *ppsz = psz, * pcch = cch;
                        break;
                    }

                    if (!(psz = (PSTR)LocalAlloc(0, cch)))
                    {
                        hr = HRESULT_FROM_WIN32(GetLastError());
                        break;
                    }
                }

                LocalFree(pbKey);
            }

            break;
        }

        pbKey = (PUCHAR)malloc(cbKey);
    }

    return hr;
}

BOOL DecryptAnd(BCRYPT_KEY_HANDLE hKey, PUCHAR pbData, ULONG cbData)
{
    UCHAR buf[0x1000] = { 0 };
    ULONG pbcResult = 0;
    NTSTATUS status = 0;

    if (!NT_SUCCESS(BCryptDecrypt(
        hKey,
        pbData,
        cbData,
        NULL,
        NULL,
        0,
        buf,
        0x1000,
        &pbcResult,
        BCRYPT_PAD_PKCS1)))
    {
        wprintf(L"BCryptDecrypt fail,error:%d\n", GetLastError());
        goto end;
    }

    //print cipher text
    PrintBytes(buf, pbcResult);

end:
    return status == 0 ? TRUE : FALSE;
}

BOOL EncryptAnd(BCRYPT_KEY_HANDLE hKey, PUCHAR pbData, ULONG cbData)
{
    UCHAR buf[0x1000] = { 0 };
    ULONG pbcResult = 0;
    NTSTATUS status = 0;

    printf("plain text length:%d\n", cbData);

    if (!NT_SUCCESS(BCryptEncrypt(
        hKey,
        pbData,
        cbData,
        NULL,
        NULL,
        0,
        buf,
        0x1000,
        &pbcResult,
        BCRYPT_PAD_PKCS1)))
    {
        wprintf(L"BCryptEncrypt fail,error:%d\n", GetLastError());
        goto end;
    }

    //print cipher text
    printf("cipher text length:%d\n", pbcResult);

    PrintBytes(buf, pbcResult);

    printf("begin to decrypt \n");
    //begin to decrypt
    DecryptAnd(hKey, buf, pbcResult);

end:
    return status == 0 ? TRUE : FALSE;
}





void UnsymmetricEncrypt()
{
    NTSTATUS status =0;
    BCRYPT_ALG_HANDLE hAlgRsa=NULL;
    BCRYPT_KEY_HANDLE hRsaKey=NULL;

    DWORD rsaPublicKeyLen = (RsaKeyLen) * 2;
    UCHAR rsaPublicKey[(RsaKeyLen) * 2] = { 0 };
    UCHAR rsaPrivateKey[(RsaKeyLen) * 2] = { 0 };
    ULONG cbResult = 0;
    PSTR PublicKey = NULL;
    PSTR PrivateKey = NULL;

    UCHAR plainText[0x20] = "abcdefghijklm";

    //opne rsa algorithm provider
    if (!NT_SUCCESS(status = BCryptOpenAlgorithmProvider(
        &hAlgRsa,
        BCRYPT_RSA_ALGORITHM,
        NULL,
        0)))
    {
        wprintf(L"BCryptOpenAlgorithmProvider fail,error:%d\n", GetLastError());
        goto end;
   }

    //generate key pair 
    if (!NT_SUCCESS(status = BCryptGenerateKeyPair(
        hAlgRsa,
        &hRsaKey,
        RsaKeyLen,
        0
    )))
    {
        wprintf(L"BCryptGenerateKeyPair fail,error:%d\n", GetLastError());
        goto end;
    }

    //finalize
    if (!NT_SUCCESS(status = BCryptFinalizeKeyPair(
        hRsaKey,
        0)))
    {
        wprintf(L"BCryptFinalizeKeyPair fail,error:%d\n",GetLastError());
        goto end;
    }

    //encrypt and decrypt
    EncryptAnd(hRsaKey, plainText, 13);
    printf("\n");

    if (!NT_SUCCESS(status = BCryptExportKey(
        hRsaKey,
        NULL,
        BCRYPT_RSAPUBLIC_BLOB,
        rsaPublicKey,
        rsaPublicKeyLen,
        &cbResult,
        0)))
    {
        wprintf(L"BCryptExportKey fail,error:%d\n", GetLastError());
        goto end;
    }
    else
    {
        //printf public key
        //0x52, 0x53, 0x41, 0x31, 0x00, 0x02, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
        //0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0xb4, 0x7a, 0xb0, 0x43, 0xee,
        //0x48, 0xbf, 0x53, 0x05, 0x60, 0xe3, 0x0e, 0xd9, 0xe2, 0x52, 0xa3, 0xb2, 0xef, 0x08, 0x20, 0xef,
        //0xe4, 0x39, 0x40, 0xb7, 0xf9, 0xf3, 0x72, 0xe5, 0xf7, 0x3c, 0x25, 0x7e, 0x88, 0xe8, 0xe8, 0x9a,
        //0x13, 0x67, 0xca, 0x5d, 0x45, 0xd6, 0x33, 0x6f, 0x9d, 0xda, 0xcc, 0xae, 0x07, 0x44, 0x2c, 0x11,
        //0x5c, 0x82, 0xdf, 0xe9, 0x87, 0xd9, 0xf0, 0xcd, 0xb7, 0xb2, 0xc1,
        printf("rsa public key blob:\n");
        PrintBytes(rsaPublicKey, cbResult);

        //if (S_OK != ExportToPem(
        //    hRsaKey,
        //    TRUE,
        //    &PrivateKey,
        //    &cbResult))
        //{
        //    wprintf(L"ExportToPem PrivateKey fail!\n");
        //    goto end;
        //}

        if (S_OK != ExportToPem(
            hRsaKey,
            FALSE,
            &PublicKey,
            &cbResult))
        {
            wprintf(L"ExportToPem PrivateKey fail!\n");
            goto end;
        }

        printf("\npublic key in pem:\n%s\n", PublicKey);
        //printf("private key in pem:\n%s\n", PrivateKey);
    }

    wprintf(L"\n UnsymmetricEncrypt success!\n");
end:
    if (hAlgRsa)
    {
        BCryptCloseAlgorithmProvider(hAlgRsa, 0);
    }
    if (hRsaKey)
    {
        BCryptDestroyKey(hRsaKey);
    }
}

运行结果如下图：