使用C#生成PKCS#1 v2.1签名的问题求助

我正尝试将Java中使用PKCS#12证书签名挑战的参考实现迁移到C#。根据理解，该签名应为PKCS#1 v2.1签名，原Java实现采用Bouncy Castle库，优先考虑使用C#系统库实现。

我尝试了多种方法，但生成的签名始终不被目标API认可：

• 基于Bouncy Castle的1:1移植：生成的签名前约30字节匹配，但后续内容不符，长度也不同（Java生成2324字节，C#生成2231字节）。
• 使用System.Security.Cryptography.Pkcs实现：代码更简洁，但同样未成功。

Java参考代码 #

private byte[] signChallenge(final byte[] challenge) {
    X509Certificate sigCert = ...;
    PrivateKey sigKey = ...;

    ContentSigner signer = new JcaContentSignerBuilder("SHA256withRSAandMGF1").setProvider("BC").build(sigKey);
    CMSTypedData cmsData = new CMSProcessableByteArray(challenge);

    CMSSignedDataGenerator cmsGenerator = new CMSSignedDataGenerator();
    cmsGenerator.addSignerInfoGenerator(
        new JcaSignerInfoGeneratorBuilder(
            new JcaDigestCalculatorProviderBuilder().build()
        ).build(signer, sigCert)
    );
    Store certs = new JcaCertStore(Collections.singletonList(sigCert));
    cmsGenerator.addCertificates(certs);

    CMSSignedData cms = cmsGenerator.generate(cmsData, false);
    byte[] signedMessage = cms.getEncoded();
    return signedMessage;
}

基于Bouncy Castle的C#尝试代码 #

private byte[] SignChallenge(byte[] challenge)
{
    var sigCert = DotNetUtilities.FromX509Certificate(Cert);
    var sigKey = DotNetUtilities.GetRsaKeyPair(Cert.GetRSAPrivateKey()).Private;
    
    var signer = SignerUtilities.InitSigner("SHA256withRSAandMGF1", true, sigKey, new());
    var cmsData = new CmsProcessableByteArray(challenge);

    var cmsGenerator = new CmsSignedDataGenerator();
    var factory = new Asn1SignatureFactory("SHA256withRSAandMGF1", sigKey);
    cmsGenerator.AddSignerInfoGenerator(new SignerInfoGeneratorBuilder().Build(factory, sigCert));
    cmsGenerator.AddCertificate(sigCert);

    var cms = cmsGenerator.Generate(cmsData, false);
    var signedMessage = cms.GetEncoded();
    return signedMessage;
}

使用C#系统库的尝试代码 #

private byte[] SignChallenge(byte[] challenge)
{
    var contentInfo = new System.Security.Cryptography.Pkcs.ContentInfo(challenge);

    var signedCms = new SignedCms(contentInfo, true);
    var signer = new CmsSigner(Cert);
    signer.DigestAlgorithm = Oid.FromFriendlyName("SHA256", OidGroup.HashAlgorithm);
    signer.SignaturePadding = RSASignaturePadding.Pss;

    signedCms.ComputeSignature(signer);
    var signedMessage = signedCms.Encode();
    return signedMessage;
}

内容的提问来源于stack exchange，提问作者BaerMitUmlaut