CryptoAPICryptoAPI--PAGE10前 目 新功 消息函 輔助函 PFX函 待 1MSCryptoAPI飛速發(fā)展，CAPI已趨于穩(wěn)定。MSCryptoAPICAPICOM（目前版本2.0Windows上寫一個(gè)桌面安全的軟件，所以為\hadylee@。CryptoAPI（一個(gè)應(yīng)用程序編程接口）WindowsPKI的編證書管理和證書存儲(chǔ)等功能。對(duì)于加密和解密，CryptoAPI同時(shí)提供基于會(huì)話密鑰和公CryptoAPI2.0提供了用于密碼學(xué)的函數(shù)。2.0版本包括了基本加密函數(shù)。這些函數(shù)提供字證書，有一種趨勢(shì)就是要把證書合并到安全通訊中。CryptoAPI2.0中提供了管理和使用證書的函數(shù)，另外，2.0PKCS#7（ASN.1）消息。證書管理函數(shù)維護(hù)和管理了一個(gè)證書的可持續(xù)庫——證書庫。CryptoAPI2.0在兩個(gè)級(jí)CSP的通訊都是通過一個(gè)CSPProviderCSPCSP就是卻省的。CSPCryptoAPI提供了一套不同的實(shí)現(xiàn)。一些提供了更加強(qiáng)大的加密算法，CSPCSPCSPCSPHCRYPTPROVCryptAcquireContext CSPCSPCryptInstallDefaultContext對(duì)于指定證書上下文得到一個(gè)HCRYPTPROVCSPBLOB中BLOBCSP編碼/lpszStructType結(jié)構(gòu)進(jìn)行解碼，此函數(shù)支持內(nèi)存分配lpszStructType結(jié)構(gòu)進(jìn)行編碼，此函數(shù)支持內(nèi)存分配鑰時(shí)要指定加密算法。CryptSetKeyParam函數(shù)可以指定額外的加密參數(shù)。中CSPBOOLWINAPICryptAcquireContext(HCRYPTPROV*phProv,LPCTSTRpszContainer,DWORDdwProvType,DWORDdwFlags[out]CSP[in]密鑰容器名稱，指向密鑰容器的字符串指針。如果dwFlags[in]CSPNULLCSP。[in]CSPpszContainerpszContainerNULL，卻省名稱CSPCSPCSPCSPdwFlags標(biāo)志，這個(gè)函數(shù)就可以創(chuàng)建和銷毀密鑰CSP臨時(shí)密鑰容器的訪問。BOOLWINAPICryptReleaseContext(HCRYPTPROVhProv,DWORD[in]CryptAcquireContextCSPCSP的句柄。對(duì)于每一次調(diào)用，CSP10if(CryptAcquireContext(hCryptProv,NULL,BOOLWINAPICryptEnumProviders(DWORDdwIndex,DWORD*pdwReserved,DWORDdwFlags,LPTSTRpszProvName,DWORD*pcbProvName[in]CSP[out]CSP[out]CSPNULL，用來得到字符[in/out]指出pszProvNameCSP。 dwIndex=0; //NULLcbNameCSP {if(!(pszName=(LPTSTR)LocalAlloc(LMEM_ZEROINIT,{printf("ERROR-LocalAlloc}//CSPif{}{}

printf("%4.0d%s\n",dwType,printf("ERROR-CryptEnumProviders");}//CSPBOOLWINAPICryptGetProvParam(HCRYPTPROVhProv,DWORDdwParam,BYTE*pbData,DWORD*pdwDataLen,DWORDdwFlags[in]CSP 不斷的讀出CSP支持的所有算法 比PP_ENUMALGS獲得更多的算法信息 不斷的讀出CSP支持的密鑰容器 CSP CSP CSP的版本號(hào) AT_SIGNATURE的位數(shù)PP_KEYX_KEYSIZE_INCAT_KEYEXCHANGE的位數(shù)PP_KEYSET_SEC_DESCR密鑰的安全描述符PP_UNIQUE_CONTAINER當(dāng)前密鑰容器的唯一名稱 CSP類型 CSP[in/out]pbDataCSPHCRYPTPROVhCryptProv; DWORD//CSPcbData=1000;{}{}

printf("CryptGetProvParamsucceeded.\n");printf("Providername:%s\n",pbData);printf("ErrorreadingCSPname.\n");cbData=1000;{}{}

printf("CryptGetProvParamsucceeded.\n");printf("KeyContainername:%s\n",pbData);printf("Errorreadingkeycontainername.\n");BOOLWINAPICryptCreateHash(HCRYPTPROVhProv,ALG_IDAlgid,DWORDdwFlags,[in]CSP[in]HMACMACNULL。此函數(shù)初始化哈希數(shù)據(jù)流。它創(chuàng)建并返回了一個(gè)CSP哈希對(duì)象的句柄。此句柄由CryptHashDataCryptHashSessionKeyBOOLWINAPICryptHashData(HCRYPTHASHhHash,BYTE*pbData,DWORDdwDataLen,DWORDdwFlags 略此參數(shù)，如果置此參數(shù)，CSP提示用戶直接數(shù)據(jù)數(shù)據(jù)。BOOLWINAPICryptGetHashParam(HCRYPTHASHhHash,DWORDdwParam,BYTE*pbData,DWORD*pdwDataLen,DWORDdwFlags hHashBOOLWINAPICryptDestroyHash(HCRYPTHASHhHashhHash…if(CryptCreateHash(…BOOLWINAPICryptDeriveKey(HCRYPTPROVhProv,ALG_IDAlgid,DWORDdwFlags,HCRYPTKEY*phKey[in]CSP 40 CSP種情況，CryptDeriveKeyCSP和算法相同時(shí)，從相同基本BOOLWINAPICryptDestroyKey(HCRYPTKEYhKey…if(CryptDeriveKey(hCryptProv,m_algid,m_hHash,0,&hCryptKey))…加密/BOOLWINAPICryptEncrypt(HCRYPTKEYhKey,HCRYPTHASHhHash,BOOLFinal,DWORDdwFlags,BYTE*pbData,DWORD*pdwDataLen,DWORDdwBufLen[in]哈希對(duì)象的句柄。如果數(shù)據(jù)需要同時(shí)被哈希并且加密，hHash就指出了哈希[in]FinalTRUE，就為最后一次，否則為[in/out]DWORD值的地址。在調(diào)用此函數(shù)前，這個(gè)值就是需要加密的數(shù)[in]pbData的數(shù)據(jù)長度。hKeyBOOLWINAPICryptDecrypt(HCRYPTKEYhKey,HCRYPTHASHhHash,BOOLFinal,DWORDdwFlags,BYTE*pbData,DWORD[in]哈希對(duì)象的句柄。如果需要解密數(shù)據(jù)并且同時(shí)作哈希，hHash[in/out]DWORD值的指針，此值指出解密數(shù)據(jù)的長度。在調(diào)用此函數(shù)前，此CryptEncryptHCRYPTPROVhCryptProv;HCRYPTKEYhCryptKey;hCryptProv,NULL,)staticcharszHash[]=”PISAHASHDATA”;//原始字符串DWORDdwLen=strlen(szHash);CryptHashData(hCryptHash,BYTE*)szHashdwLen,0);CryptDeriveKey(hCryptProv,CALG_RC2,hCryptHash,0,staticcharszEntry[]=“PISA2002”;DWORDdwLenIn=strlen(szEntry);DWORDdwLenOut=dwLenIn;CryptEncrypt(hCryptKey,0,TRUE,0,(BYTE*)szEntry,&dwLenOut,dwLenIn);CryptDecrypt(hCryptKey,0,TRUE,0,(BYTE*)szEntry,&dwLenOut);簽名/BOOLWINAPICryptSignMessage(DWORDcToBeSigned,constBYTE*rgpbToBeSigned[],DWORDrgcbToBeSigned[],

BYTE*pbSignedBlob,DWORD*pcbSignedBlob pSigningCert;CRYPT_ALGORITHM_IDENTIFIERHashAlgorithm; #ifdefCRYPT_SIGN_MESSAGE_PARA_HAS_CMS_FIELDSCRYPT_ALGORITHM_IDNETIFIERHashEncryptionAlgorithm; X509_ASN_ENCODING|PKCS_7_ASN_ENCODINGrgpMsgCertCERT_CONTEXT0，則rgpMsgCert數(shù)組中。CRL_CONTEXT結(jié)構(gòu)。CRL_CONTEXTrgUnauthAttr0。0。0[in]TRUEFALSETRUE，1。[in/out]DWORDpbSignedBlob…#define (PKCS_7_ASN_ENCODING|#defineSIGNER_NAME #defineCERT_STORE_NAME voidHandleError(charvoid{////BYTE*pbMessage(BYTE*)"CryptoAPIisagoodwaytohandleDWORDcbMessage=strlen((char*)//CRYPT_SIGN_MESSAGE_PARASigParams;DWORDcbSignedMessageBlob; DWORDcbDecodedMessageBlob; constBYTE*MessageArray[]={pbMessage};DWORDMessageSizeArray[1];MessageSizeArray[0]=cbMessage;printf("Beginprocessing.printf("Themessagetobesignedis\n->//Openacertificateif(!(hStoreHandle=CertOpenStore({HandleError("TheMYstorecouldnotbe}if(pSignerCert=CertFindCertificateInStore({printf("Thesigner'scertificatewas}{}

HandleError("SignercertificatenotSigParams.dwMsgEncodingType=MY_TYPE;SigParams.pSigningCert=pSignerCert;SigParams.HashAlgorithm.pszObjId=szOID_RSA_MD5;SigParams.HashAlgorithm.Parameters.cbData=NULL;SigParams.cMsgCert=1;SigParams.rgpMsgCert=&pSignerCert;SigParams.cAuthAttr=0;SigParams.dwInnerContentType=SigParams.cMsgCrl=SigParams.cUnauthAttr=SigParams.dwFlags=0;SigParams.pvHashAuxInfo=NULL;SigParams.rgAuthAttr=NULL;//BLOB //Signature //Not //Numberof //Messagestobesigned //Sizeofmessages //Bufferforsignedmessage&cbSignedMessageBlob))//Sizeofbuffer{}{}

printf("ThesizeoftheBLOBisHandleError("GettingsignedBLOBsize//BLOB的內(nèi)存if(!(pbSignedMessageBlob={HandleError("Memoryallocationerrorwhile} // //待簽名的消息 //消息大小 //緩沖區(qū)&cbSignedMessageBlob))//緩沖區(qū)大小{}{}

printf("Themessagewassignedsuccessfully.HandleError("Errorgettingsigned////VerifyParams結(jié)構(gòu)VerifyParams.dwMsgAndCertEncodingType=MY_TYPE;VerifyParams.hCryptProv=0;VerifyParams.pvGetArg=NULL; //. //Pointertosignercertificate.{}{}

printf("%dbytesneedfortheprintf("Verificationmessagefailed.//為緩沖區(qū)分配內(nèi)存if(!(pbDecodedMessageBlob={HandleError("Memoryallocationerrorallocatingdecode} //Signer //PointertosignedBLOB. //SizeofsignedBLOB. //Bufferfordecodedmessage. //Sizeofbuffer. //Pointertosigner{}{}

printf("Theverifiedmessageis\n->%sprintf("Verificationmessagefailed.{}{}…

printf("Thestoreclosedandallcertificatesarefreed.printf("Storeclosedaftersigning--"notallcertificates,CRLsorCTLswereCryptoAPICTLCTLCTLCRLCTL接里顯示證書、CRLCRLCRL把編碼CRL轉(zhuǎn)化成CRLCRLCRLCRLCRLCRLCRLCRLCRLCRLCRLCTLCRL把編碼CTL轉(zhuǎn)化成CTL里CTLCTLCTLCTLCTLCTLCTLCTLCRLCTLCRLCTLCRLCTL打開/HCRYPTPROVhProv,LPCTSTRszSubsystemProtocol[in]CSPNULLCSPNULL，它必須是由CryptAcquireContextCSP句柄。BOOLWINAPICertCloseStore(HCERTSTOREhCertStore,DWORDdwFlags[in]0。卻省就是關(guān)閉證書庫，對(duì)于為上下文分配的內(nèi)存并不釋放。如果想要檢查并且釋放所有為證