本地PEM公钥加密字符串，Azure Key Vault私钥解密报错求助

错误信息 #

System.AggregateException: 'One or more errors occurred. (Error occurred while decoding OAEP padding.
Status: 400 (Bad Request)
ErrorCode: BadParameter

问题描述 #

我正在做一个POC：用本地存储的从Azure Key Vault下载的PEM格式公钥加密字符串，再通过Azure Key Vault中的对应私钥解密。直接用Azure Key Vault密钥完成加解密能正常运行，但本地加密后调用Azure Key Vault私钥解密时出现上述错误，怀疑是加密端的RSAEncryptionPadding与解密端的EncryptionAlgorithm不兼容，但不知道怎么解决。

相关代码 #

using System.Security.Cryptography;
using System.Text;
using System.Windows.Forms;
using Azure.Identity;
using Azure.Security.KeyVault.Keys;
using Azure.Security.KeyVault.Keys.Cryptography;


string input = "SomeString";
var encryptStringAsync = EncryptStringAsync(input);

var valenc = encryptStringAsync.Result;

Console.WriteLine(valenc);

var decryptStringAsync = DecryptStringAsync(valenc);

var valueenc = decryptStringAsync.Result;

Console.WriteLine(valueenc);

static async Task<string> EncryptStringAsync(string input)
{
    byte[] inputAsByteArray = Encoding.UTF8.GetBytes(input);

    using (RSA rsa = GetRSAFromPemFile())
    {
        byte[] encryptedData = rsa.Encrypt(inputAsByteArray, RSAEncryptionPadding.OaepSHA256);
        return Convert.ToBase64String(encryptedData);
    }

    RSA GetRSAFromPemFile()
    {
        string publicKey = File.ReadAllText("C:\\temp\\20231117.pem");

        var rsaPublicKey = RSA.Create();
        rsaPublicKey.ImportFromPem(publicKey);

        return rsaPublicKey;
    }
}


static async Task<string> DecryptStringAsync(string input)
{

    string keyVaultName = "xxx";
    string keyVaultUri = "https://" + keyVaultName + ".vault.azure.net";
    string keyVaultKeyName = "xxx";
    
    var client = new KeyClient(new Uri(keyVaultUri), new DefaultAzureCredential());
    KeyVaultKey key = await client.GetKeyAsync(keyVaultKeyName).ConfigureAwait(false);
    var cryptoClient = new CryptographyClient(key.Id, new DefaultAzureCredential());
    
    byte[] inputAsByteArray = Convert.FromBase64String(input);
    DecryptResult decryptResult = await cryptoClient.DecryptAsync(EncryptionAlgorithm.RsaOaep, inputAsByteArray).ConfigureAwait(false);
    return Encoding.Default.GetString(decryptResult.Plaintext);
}

解决方案 #

核心问题：OAEP哈希算法不匹配 #

你本地加密用的是RSAEncryptionPadding.OaepSHA256（基于SHA-256的OAEP填充），但解密时调用Azure Key Vault用的是EncryptionAlgorithm.RsaOaep——这个枚举对应的默认哈希算法是SHA-1，两者不匹配导致填充解码失败。

具体修复步骤 #

1. 解密时指定对应SHA-256的加密算法
   将解密代码中的EncryptionAlgorithm.RsaOaep替换为EncryptionAlgorithm.RsaOaep256，确保哈希算法和加密端一致：

   DecryptResult decryptResult = await cryptoClient.DecryptAsync(EncryptionAlgorithm.RsaOaep256, inputAsByteArray).ConfigureAwait(false);
   

2. 统一编码格式
   加密时用Encoding.UTF8转字节，解密时也用Encoding.UTF8转回字符串，避免编码不一致导致乱码或潜在问题：

   return Encoding.UTF8.GetString(decryptResult.Plaintext);
   

3. 优化异步调用方式（可选但推荐）
   避免直接用.Result阻塞异步方法，改成await调用，防止死锁：

   string input = "SomeString";
   var valenc = await EncryptStringAsync(input);
   Console.WriteLine(valenc);
   var valueenc = await DecryptStringAsync(valenc);
   Console.WriteLine(valueenc);
   

额外验证要点 #

• 确认下载的PEM公钥确实是Azure Key Vault中目标密钥的公钥，避免密钥不匹配。
• Azure Key Vault中的密钥需要启用解密权限，确保CryptographyClient有足够权限执行解密操作。

内容的提问来源于stack exchange，提问作者Damo