using System;

using System.Security.Cryptography;

using System.Text;

//using System.IO;

​

class RsaEncryptionOaepSha1 {

    static void Main() {

    Console.WriteLine("RSA AES GCM hybrid encryption");

​

    Console.WriteLine("\nuses AES GCM 256 random key for the plaintext encryption");

    Console.WriteLine("and RSA OAEP SHA 1 2048 bit for the encryption of the random key\n");

​

    string plaintextString = "The quick brown fox jumps over the lazy dog";

    Console.WriteLine("plaintext: " + plaintextString);

​

    // # # # usually we would load the private and public key from a file or keystore # # #

    // # # # here we use hardcoded keys for demonstration - don't do this in real programs # # #

    string filenamePrivateKeyPem = "privatekey2048.pem";

    string filenamePublicKeyPem = "publickey2048.pem";

​

        try {

        // encryption

        Console.WriteLine("\n* * * Encryption * * *");

        string publicKeyLoad = loadRsaPublicKeyPem();

        // use this in production

        //string publicKeyLoad = File.ReadAllText(filenamePublicKeyXml);

        string completeCiphertextBase64 = rsaOaepSha1AesGcm256HybridStringEncryption(publicKeyLoad, plaintextString);

        Console.WriteLine("complete ciphertext: " + completeCiphertextBase64);

        Console.WriteLine("output is (Base64) encryptionKey : (Base64) nonce : (Base64) ciphertext : (Base64) gcmTag");

​

        // transport the encrypted data to recipient

​

        // receiving the encrypted data, decryption

        Console.WriteLine("\n* * * Decryption * * *");

        string completeCiphertextReceivedBase64 = completeCiphertextBase64;

        Console.WriteLine("completeCiphertextReceivedBase64: " + completeCiphertextReceivedBase64);

        string privateKeyLoad = loadRsaPrivateKeyPem();

        // use this in production

        //string privateKeyLoad = File.ReadAllText(filenamePrivateKeyXml);

        string decryptedText = rsaOaepSha1AesGcm256HybridStringDecryption(privateKeyLoad, completeCiphertextReceivedBase64);

        Console.WriteLine("plaintext: " + decryptedText);

        }

        catch(ArgumentNullException) {

            Console.WriteLine("The data was not RSA encrypted");

        }

    }

​

  static string rsaOaepSha1AesGcm256HybridStringEncryption (string publicKeyPem, string plaintext) {

    // generate random key

    byte[] encryptionKey = GenerateRandomAesKey();

    // encrypt plaintext

    string ciphertextBase64 = aesGcmEncryptToBase64(encryptionKey, plaintext);

    // encrypt the aes encryption key with the rsa public key

    string encryptionKeyBase64 = Base64Encoding(rsaEncryptionOaepSha1(publicKeyPem, encryptionKey));

    // complete output

    return encryptionKeyBase64 + ":" + ciphertextBase64;

  }

​

  static string rsaOaepSha1AesGcm256HybridStringDecryption (string privateKeyPem, string data) {

    String[] parts = data.Split(':');

    byte[] encryptedKeyReceived = Base64Decoding(parts[0]);

    byte[] nonce = Base64Decoding(parts[1]);

    byte[] encryptedData = Base64Decoding(parts[2]);

    byte[] gcmTag = Base64Decoding(parts[3]);

    // decrypt the encryption key with the rsa private key

    byte[] decryptionKey = rsaDecryptionOaepSha1(privateKeyPem, encryptedKeyReceived);

    return aesGcmDecrypt(decryptionKey, nonce, encryptedData, gcmTag);

  }

​

    static string aesGcmEncryptToBase64(byte[] key, string data) {

        byte[] plaintext = Encoding.UTF8.GetBytes(data);

        byte[] gcmTag = new byte[16];

        byte[] nonce = GenerateRandomNonce();

        byte[] cipherText = new byte[plaintext.Length];

        byte[] associatedData = new byte[0];

        using(var cipher = new AesGcm(key)) {

            cipher.Encrypt(nonce, plaintext, cipherText, gcmTag, associatedData);

            return Base64Encoding(nonce) + ":" + Base64Encoding(cipherText) + ":" + Base64Encoding(gcmTag);

        }

    }

​

    static string aesGcmDecrypt(byte[] key, byte[] nonce, byte[] ciphertext, byte[] gcmTag) {

        string decryptedtext;

        byte[] associatedData = new byte[0];

        byte[] decryptedData = new byte[ciphertext.Length];

        using(var cipher = new AesGcm(key)) {

            cipher.Decrypt(nonce, ciphertext, gcmTag, decryptedData, associatedData);

            decryptedtext = Encoding.UTF8.GetString(decryptedData, 0, decryptedData.Length);

            return decryptedtext;

        }

    }   

  static byte[] GenerateRandomAesKey() {

    RNGCryptoServiceProvider rngCsp = new RNGCryptoServiceProvider();

    byte[] key = new byte[32];

    rngCsp.GetBytes(key);

    return key;

  }

​

  static byte[] GenerateRandomNonce() {

        RNGCryptoServiceProvider rngCsp = new RNGCryptoServiceProvider();

        byte[] nonce = new byte[12];

        rngCsp.GetBytes(nonce);

        return nonce;

  }     

​

  public static byte[] rsaEncryptionOaepSha1(string publicKeyPem, byte[] plaintext) {

        RSA RSAalg = RSA.Create();

        RSAalg.ImportFromPem(publicKeyPem);

    //RSACryptoServiceProvider RSAalg = new RSACryptoServiceProvider(2048);

        //RSAalg.PersistKeyInCsp = false;

        //RSAalg.FromXmlString(publicKeyXml);

        return RSAalg.Encrypt(plaintext, System.Security.Cryptography.RSAEncryptionPadding.OaepSHA1);

  }

​

  public static byte[] rsaDecryptionOaepSha1(string privateKeyPem, byte[] ciphertext) {

        RSA RSAalg = RSA.Create();

        byte[] privateKeyByte = getRsaPrivateKeyEncodedFromPem(privateKeyPem);

        int _out;

        RSAalg.ImportPkcs8PrivateKey(privateKeyByte, out _out);

    return RSAalg.Decrypt(ciphertext, System.Security.Cryptography.RSAEncryptionPadding.OaepSHA1);

  }

​

  private static byte[] getRsaPrivateKeyEncodedFromPem(string rsaPrivateKeyPem) {

        string rsaPrivateKeyHeaderPem = "-----BEGIN PRIVATE KEY-----\n";

        string rsaPrivateKeyFooterPem = "-----END PRIVATE KEY-----";

        string rsaPrivateKeyDataPem = rsaPrivateKeyPem.Replace(rsaPrivateKeyHeaderPem, "").Replace(rsaPrivateKeyFooterPem, "").Replace("\n", "");

        return Base64Decoding(rsaPrivateKeyDataPem);

  } 

  static string Base64Encoding(byte[] input) {

    return Convert.ToBase64String(input);

  }

​

  static byte[] Base64Decoding(String input) {

    return Convert.FromBase64String(input);

  }

  private static string loadRsaPrivateKeyPem() {

  // this is a sample key - don't worry !

    return "-----BEGIN PRIVATE KEY-----\n" +

            "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDwSZYlRn86zPi9\n" +

            "e1RTZL7QzgE/36zjbeCMyOhf6o/WIKeVxFwVbG2FAY3YJZIxnBH+9j1XS6f+ewjG\n" +

            "FlJY4f2IrOpS1kPiO3fmOo5N4nc8JKvjwmKtUM0t63uFFPfs69+7mKJ4w3tk2mSN\n" +

            "4gb8J9P9BCXtH6Q78SdOYvdCMspA1X8eERsdLb/jjHs8+gepKqQ6+XwZbSq0vf2B\n" +

            "MtaAB7zTX/Dk+ZxDfwIobShPaB0mYmojE2YAQeRq1gYdwwO1dEGk6E5J2toWPpKY\n" +

            "/IcSYsGKyFqrsmbw0880r1BwRDer4RFrkzp4zvY+kX3eDanlyMqDLPN+ghXT1lv8\n" +

            "snZpbaBDAgMBAAECggEBAIVxmHzjBc11/73bPB2EGaSEg5UhdzZm0wncmZCLB453\n" +

            "XBqEjk8nhDsVfdzIIMSEVEowHijYz1c4pMq9osXR26eHwCp47AI73H5zjowadPVl\n" +

            "uEAot/xgn1IdMN/boURmSj44qiI/DcwYrTdOi2qGA+jD4PwrUl4nsxiJRZ/x7PjL\n" +

            "hMzRbvDxQ4/Q4ThYXwoEGiIBBK/iB3Z5eR7lFa8E5yAaxM2QP9PENBr/OqkGXLWV\n" +

            "qA/YTxs3gAvkUjMhlScOi7PMwRX9HsrAeLKbLuC1KJv1p2THUtZbOHqrAF/uwHaj\n" +

            "ygUblFaa/BTckTN7PKSVIhp7OihbD04bSRrh+nOilcECgYEA/8atV5DmNxFrxF1P\n" +

            "ODDjdJPNb9pzNrDF03TiFBZWS4Q+2JazyLGjZzhg5Vv9RJ7VcIjPAbMy2Cy5BUff\n" +

            "EFE+8ryKVWfdpPxpPYOwHCJSw4Bqqdj0Pmp/xw928ebrnUoCzdkUqYYpRWx0T7YV\n" +

            "RoA9RiBfQiVHhuJBSDPYJPoP34kCgYEA8H9wLE5L8raUn4NYYRuUVMa+1k4Q1N3X\n" +

            "Bixm5cccc/Ja4LVvrnWqmFOmfFgpVd8BcTGaPSsqfA4j/oEQp7tmjZqggVFqiM2m\n" +

            "J2YEv18cY/5kiDUVYR7VWSkpqVOkgiX3lK3UkIngnVMGGFnoIBlfBFF9uo02rZpC\n" +

            "5o5zebaDImsCgYAE9d5wv0+nq7/STBj4NwKCRUeLrsnjOqRriG3GA/TifAsX+jw8\n" +

            "XS2VF+PRLuqHhSkQiKazGr2Wsa9Y6d7qmxjEbmGkbGJBC+AioEYvFX9TaU8oQhvi\n" +

            "hgA6ZRNid58EKuZJBbe/3ek4/nR3A0oAVwZZMNGIH972P7cSZmb/uJXMOQKBgQCs\n" +

            "FaQAL+4sN/TUxrkAkylqF+QJmEZ26l2nrzHZjMWROYNJcsn8/XkaEhD4vGSnazCu\n" +

            "/B0vU6nMppmezF9Mhc112YSrw8QFK5GOc3NGNBoueqMYy1MG8Xcbm1aSMKVv8xba\n" +

            "rh+BZQbxy6x61CpCfaT9hAoA6HaNdeoU6y05lBz1DQKBgAbYiIk56QZHeoZKiZxy\n" +

            "4eicQS0sVKKRb24ZUd+04cNSTfeIuuXZrYJ48Jbr0fzjIM3EfHvLgh9rAZ+aHe/L\n" +

            "84Ig17KiExe+qyYHjut/SC0wODDtzM/jtrpqyYa5JoEpPIaUSgPuTH/WhO3cDsx6\n" +

            "3PIW4/CddNs8mCSBOqTnoaxh\n" +

            "-----END PRIVATE KEY-----";

  }

​

  private static string loadRsaPublicKeyPem() {

  // this is a sample key - don't worry !

    return "-----BEGIN PUBLIC KEY-----\n" +

            "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8EmWJUZ/Osz4vXtUU2S+\n" +

            "0M4BP9+s423gjMjoX+qP1iCnlcRcFWxthQGN2CWSMZwR/vY9V0un/nsIxhZSWOH9\n" +

            "iKzqUtZD4jt35jqOTeJ3PCSr48JirVDNLet7hRT37Ovfu5iieMN7ZNpkjeIG/CfT\n" +

            "/QQl7R+kO/EnTmL3QjLKQNV/HhEbHS2/44x7PPoHqSqkOvl8GW0qtL39gTLWgAe8\n" +

            "01/w5PmcQ38CKG0oT2gdJmJqIxNmAEHkatYGHcMDtXRBpOhOSdraFj6SmPyHEmLB\n" +

            "ishaq7Jm8NPPNK9QcEQ3q+ERa5M6eM72PpF93g2p5cjKgyzzfoIV09Zb/LJ2aW2g\n" +

            "QwIDAQAB\n" +

            "-----END PUBLIC KEY-----";

  }

}

​